MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64e06c23f1377eeda3f363d1d26c5bbd3202b1dddc74aa3c9c893900a4ca20c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	64e06c23f1377eeda3f363d1d26c5bbd3202b1dddc74aa3c9c893900a4ca20c8
SHA3-384 hash:	f274f7926685de88b70dbc11636dedd2d0158ee85a2b92fc27c3725a3b87e6dbafc024940a3c3c4ac4b527e05df8d55b
SHA1 hash:	c5addd4a1f41215e68fa2779192e793ada36fd6e
MD5 hash:	31875807fde87f25a091d6955a39c7ec
humanhash:	north-robert-illinois-oxygen
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'910 bytes
First seen:	2025-08-10 19:42:59 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v77w7N7h7h6G7gZzP7RKW7HoU77H7o7U7fy3b7A9R7Tcg7EpV7ZSO79+C7CfT7a2:v77w7N7h7h6G7gZzP7RKW7HoU77H7o70
TLSH	T151518FC5526C4C303963EE5BF6F742283091A2B31DF26BA9B9C8BBE5424ED247248753
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.42.188.67/hiddenbin/boatnet.x86	1de34a1f0805995359792984938f3f2e09897abbe03d6b5aca08ed87065aa673	Mirai	mirai opendir
http://31.42.188.67/hiddenbin/boatnet.mips	4453f389f1634fd21ce0406053b8a9f2fd0a7016bf20b28d24c3cf20ae9576e5	Mirai	mirai opendir
http://31.42.188.67/hiddenbin/boatnet.arc	830af79c1eeff9d005d0623af6ef6f21a3f6896f259ecb06a2f3cbf277d24422	Mirai	mirai opendir
http://31.42.188.67/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://31.42.188.67/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://31.42.188.67/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://31.42.188.67/hiddenbin/boatnet.mpsl	a1eed10299a694a7813a0f5c6aecb41f05c48555e2f3874a293a5cfa763cce03	Mirai	mirai opendir
http://31.42.188.67/hiddenbin/boatnet.arm	36e1c4b0bd7381d713d96a4b9557bbdbf0924e5d5f8fdae553c206c6e8997f13	Mirai	mirai opendir
http://31.42.188.67/hiddenbin/boatnet.arm5	652fc0ac476ce5dbf7a697ace919c856b2c422d0f81797559271b4124bb6d15c	Mirai	mirai opendir
http://31.42.188.67/hiddenbin/boatnet.arm6	38591ba82f02973b5d3911a77ebc4e191ef7880858afd160529c36c8f91705ca	Mirai	mirai opendir
http://31.42.188.67/hiddenbin/boatnet.arm7	b68496857a7d843170080b2d3b0d9f0572ad2e9ff0bb4cbc0f49cda81f1011eb	Mirai	mirai opendir
http://31.42.188.67/hiddenbin/boatnet.ppc	cbdf199d010afad4544f62c40336237521d9c8101a3e0f78146e70f594399900	Mirai	mirai opendir
http://31.42.188.67/hiddenbin/boatnet.spc	n/a	n/a	elf ua-wget
http://31.42.188.67/hiddenbin/boatnet.m68k	5c41d6fef32c34bb0ba9108ac36fd6e9e979e5556c253670c7cf4499561caa04	Mirai	mirai opendir
http://31.42.188.67/hiddenbin/boatnet.sh4	f16a9ee3e97fa65c067cb5ca5152bff8a438d9067b61488688524e56430e5b7d	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/148dba01-93ae-4881-b7f2-742abc7c3f37

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/64e06c23f1377eeda3f363d1d26c5bbd3202b1dddc74aa3c9c893900a4ca20c8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/64e06c23f1377eeda3f363d1d26c5bbd3202b1dddc74aa3c9c893900a4ca20c8/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/64e06c23f1377eeda3f363d1d26c5bbd3202b1dddc74aa3c9c893900a4ca20c8

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-08-10 19:47:26 UTC

File Type:

Text (Shell)

AV detection:

24 of 37 (64.86%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mtqgyi7rg57o3i7tmpi5e3c3xuzafmo53r2kupe4re4qbjgkedea._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250810-yhe3hahp5t/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/64e06c23f137/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.34

Link:

https://yomi.yoroi.company/submissions/64e06c23f1377eeda3f363d1d26c5bbd3202b1dddc74aa3c9c893900a4ca20c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.