MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fe4a29aea5a0488b8fac768a0dfad41e3dafd3ba6d3b761b95f9fc2e46b356c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	6fe4a29aea5a0488b8fac768a0dfad41e3dafd3ba6d3b761b95f9fc2e46b356c
SHA3-384 hash:	af457bc0cc3e346a8768406400ce15e0f35d1f5b40ec66385ba133a054e510d3d768fb74612abc56b2c5249f47d869fc
SHA1 hash:	cd4fb092d988f145bd88915b3b9426b9a40d7772
MD5 hash:	4fb75dc63e7da4ae21fe5fd1ec2b3246
humanhash:	mobile-low-helium-july
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'940 bytes
First seen:	2026-08-11 09:46:42 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vH7C7N7hH56GHghzPHpKWHroUH7r7o7UHfo3bHS9RHvcgHupVHhSOH9+CH4fTHga:vH7C7N7hH56GHghzPHpKWHroUH7r7o7q
TLSH	T11A51B6C561A84C383CE3FA13E6BB612C3091A65219FDBBA6E9E4BFF4524ED143144753
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.77.227.111/hiddenbin/boatnet.x86	1d777ad3b6b3c296b9322e4e8e6fd0c9954b94f628f25c4cf361a118976f4784	Mirai	elf mirai opendir ua-wget x86
http://31.77.227.111/hiddenbin/boatnet.mips	6bc17f9f0a1cda1924abfacf2aec3db6d996e0dd53b12ceb63254279aee0cc73	Mirai	elf mips mirai opendir ua-wget
http://31.77.227.111/hiddenbin/boatnet.arc	11930b03f4eabccdc20bbf11819e0cfa79b94c8119882a55f4a578e9e147aaea	Mirai	arc elf mirai opendir ua-wget
http://31.77.227.111/hiddenbin/boatnet.i468	n/a	n/a	censys elf ua-wget
http://31.77.227.111/hiddenbin/boatnet.i686	n/a	n/a	censys elf ua-wget
http://31.77.227.111/hiddenbin/boatnet.x86_64	n/a	n/a	censys elf ua-wget
http://31.77.227.111/hiddenbin/boatnet.mpsl	5c6a6a316d1312eb966889f61f29eb75b6a7387c5bedb72ffe4a36a0a7f08a0e	Mirai	elf mips mirai opendir ua-wget
http://31.77.227.111/hiddenbin/boatnet.arm	407f81370bad7fcc8988012886d8a36ac39b5e713b840af0783d9147bab34746	Mirai	elf iot mirai
http://31.77.227.111/hiddenbin/boatnet.arm5	1110d37053fbefa3ce931a85d8ae3207815d0fe73d30693d8f76fa3a70900555	Mirai	arm elf mirai opendir ua-wget
http://31.77.227.111/hiddenbin/boatnet.arm6	5c9170b6613b56562fb3ca05ee737cfd56343d3d65f751564a4bf3b2bb065d88	Mirai	arm elf mirai opendir ua-wget
http://31.77.227.111/hiddenbin/boatnet.arm7	090dcce5eaeda80bddf9c6a3dd58da737bdf6bdb904a995eab142c37b32a26d5	Mirai	elf iot mirai
http://31.77.227.111/hiddenbin/boatnet.ppc	3a33cd1573d30b6abb08ad7831d395221fae52158ec895fec050ba76e72bcf48	Mirai	elf mirai opendir PowerPC ua-wget
http://31.77.227.111/hiddenbin/boatnet.spc	a5a9448b346eac7a6a24f2fdb39357e919040cae21a8e16dc417ed69d83bf761	Mirai	elf mirai opendir sparc ua-wget
http://31.77.227.111/hiddenbin/boatnet.m68k	45dfcd594bb62bef5ca1edbc9a84ae9bda7069360e34545d8a2bc0ec272a505d	Mirai	elf m68k mirai opendir ua-wget
http://31.77.227.111/hiddenbin/boatnet.sh4	5411d557b2ad40f6b0b3ce68662897a98e54b4fc845a9c17dd9a347b43ee9388	Mirai	elf mirai opendir SuperH ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a7aefb4be5deddcffd25091/reports/64eb5714-cd7e-46f2-b2f8-a86b94a42c00/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/0b98f4b7-9669-4ffd-9353-ded51969eab9

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6fe4a29aea5a0488b8fac768a0dfad41e3dafd3ba6d3b761b95f9fc2e46b356c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6fe4a29aea5a0488b8fac768a0dfad41e3dafd3ba6d3b761b95f9fc2e46b356c/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-08-11 09:48:33 UTC

File Type:

Text (Shell)

AV detection:

23 of 36 (63.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n7skfgxkliciroh2y5ukbx5nihr5v7j3u3j3oynzl6p4fzdlgvwa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260811-lshj6awxgw/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Family: Mirai

Malware Config

C2 Extraction:

31.77.227.111
ip6.arpa

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6fe4a29aea5a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/6fe4a29aea5a0488b8fac768a0dfad41e3dafd3ba6d3b761b95f9fc2e46b356c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh