MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71bcb1ff944476d06565e1b4ebc6aa74712ecfb8ef4dd0e581f440ebb87fff1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	71bcb1ff944476d06565e1b4ebc6aa74712ecfb8ef4dd0e581f440ebb87fff1e
SHA3-384 hash:	9d6b191815d0f7079e4a73fd8b2c3c958f140f8db48a1767a26a1cfaecf4bf84637f27973c070a1290da9797224091ca
SHA1 hash:	eb27c1575b8bfea55bb8787632f0b20eb8332cf0
MD5 hash:	64a547c9b1970e6ebdf9c1d2d10f39bc
humanhash:	william-oranges-salami-wisconsin
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	4'041 bytes
First seen:	2026-08-15 20:29:47 UTC
Last seen:	2026-08-15 22:57:39 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:VGaR6xmPOFQNDRz9u8m9D0k2N/Xb7xgLpY8CiKmkSSYbN0FbuQvMSW4Gl:cj7uZakSDbN0JuQvMMW
TLSH	T190816492B572C5B1358F443EDF8F92907A83192F8D1ABD05B44E28542F3D57470B87B9
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

63

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a80cc63e4000759a37e22fe/reports/71eeb2a4-35df-41b9-8944-a040a750cb43/overview

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/718a9241-0783-4b38-ad15-edbfb1576122

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

4%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/71bcb1ff944476d06565e1b4ebc6aa74712ecfb8ef4dd0e581f440ebb87fff1e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/71bcb1ff944476d06565e1b4ebc6aa74712ecfb8ef4dd0e581f440ebb87fff1e/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=og6ld74uir3nazlf4g2oxrvkorys5t5y55g5bzmb6raoxod774pa._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery execution linux persistence privilege_escalation upx

Link:

https://tria.ge/reports/260815-zadp5stxey/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Checks CPU configuration

UPX packed file

Creates/modifies Cron job

Enumerates running processes

Modifies init.d

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Family: Mirai

Malware Config

C2 Extraction:

31.77.227.111

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/71bcb1ff944476d06565e1b4ebc6aa74712ecfb8ef4dd0e581f440ebb87fff1e