MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b137569d4481d484479fac6302fd1dfe64e42535f172a20b1e752c203ed99df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	7b137569d4481d484479fac6302fd1dfe64e42535f172a20b1e752c203ed99df
SHA3-384 hash:	1139f86252840f692896b12bcff08534ed67cf97f25541a2cffbd096311fd48ff5eba32817039784ddb35627701cfeb5
SHA1 hash:	e0de58f14ea8192ab1f4bc28e22890827f0d9df4
MD5 hash:	70054e7ea584c889759b2256cad05966
humanhash:	rugby-bacon-xray-jupiter
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'940 bytes
First seen:	2025-11-08 11:43:59 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vn7q7N7hnJ6GnghzPn5KWn7oUn777o7Unfw3bn69Rn/cgn2pVnhSOn9+CnAfTn4K:vn7q7N7hnJ6GnghzPn5KWn7oUn777o7i
TLSH	T1A451E9C5E2E46D302CABEE13F6B6436C7085965318E37FA6DAE4BAE0064FD143141753
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://178.16.54.217/hiddenbin/boatnet.x86	ee464b46f46ba9a46a7c761e4a8d9bd598b1e941a09e942205496a98413c708f	Mirai	elf mirai
http://178.16.54.217/hiddenbin/boatnet.mips	81cb1e83da1d0fb40e1d5b6a09666b962fa9ad5a82b6555b2a4cda9ba9b01c36	Mirai	elf mirai
http://178.16.54.217/hiddenbin/boatnet.arc	60cb51687150b73eb86f84fa7c9e8f67df859cf26f96fa0a7ff1a994c82cf4a8	Mirai	elf mirai
http://178.16.54.217/hiddenbin/boatnet.i468	n/a	n/a	censys elf ua-wget
http://178.16.54.217/hiddenbin/boatnet.i686	n/a	n/a	censys elf ua-wget
http://178.16.54.217/hiddenbin/boatnet.x86_64	n/a	n/a	censys elf ua-wget
http://178.16.54.217/hiddenbin/boatnet.mpsl	99ddb63f960cc3abe3d8a73f44b6e41ef010d6d90b633dbfcc5ead3752f83475	Mirai	32-bit elf mirai Mozi
http://178.16.54.217/hiddenbin/boatnet.arm	e139e43d30c84b84378965d71227d0618e551b3be40dc2264101d44bb3d7579b	Mirai	elf mirai
http://178.16.54.217/hiddenbin/boatnet.arm5	9b6dca6a5be10dd548440b7191edcb9a74b68da57906a7a7e0275fefdc4afa51	Mirai	elf mirai
http://178.16.54.217/hiddenbin/boatnet.arm6	b61d7a6b9f3a14070c3afcc9a7c5da255cb4ead06f9607b7705f138977606a44	Mirai	elf mirai
http://178.16.54.217/hiddenbin/boatnet.arm7	4557b71c488335a3e95189240efd4e8ca27643717a0212b0b29371f17fe6a965	Mirai	elf mirai
http://178.16.54.217/hiddenbin/boatnet.ppc	2313a270cebf5b69ccc34a66cb02b78cb5b04ec984fc3a7c63be1076b806c861	Mirai	elf mirai
http://178.16.54.217/hiddenbin/boatnet.spc	7d86b02fd526c394cf92aeb29ee8f46f20a2f67b09463f1ae7de03f5bcd33654	Mirai	elf mirai
http://178.16.54.217/hiddenbin/boatnet.m68k	0b2ad1055b4e7805b44fef67931a2b3b61bb906bb743ae3a7278ef9a9111c993	Mirai	elf mirai
http://178.16.54.217/hiddenbin/boatnet.sh4	b1f5e98e63e81978965cd386c8870f22687d1acf246dfb5153bce47d2e097c4f	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Gathering data

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-08T09:00:00Z UTC

Last seen:

2025-11-10T06:15:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/7b137569d4481d484479fac6302fd1dfe64e42535f172a20b1e752c203ed99df/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c9bf4ce0-99c8-4386-8ab8-7abf19237c3c

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7b137569d4481d484479fac6302fd1dfe64e42535f172a20b1e752c203ed99df

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7b137569d4481d484479fac6302fd1dfe64e42535f172a20b1e752c203ed99df/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/7b137569d4481d484479fac6302fd1dfe64e42535f172a20b1e752c203ed99df

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-11-08 11:44:41 UTC

File Type:

Text (Shell)

AV detection:

23 of 36 (63.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pmjxk2oujaouqrdz7lddal6r37te4qstl4lsuifr45jmea7nthpq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251108-nwbbcsyjaj/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7b137569d448/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.