MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bb7d78bbcfc4b6b4354a691cbfb03284087e6bcbef08cbdfc806c62c0e92634. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	7bb7d78bbcfc4b6b4354a691cbfb03284087e6bcbef08cbdfc806c62c0e92634
SHA3-384 hash:	3ff8b73acdd2c731aaed2ac9562af069e5bcffc97f7e26e32eede2e6663741751e0360940112a7ee72ad56750b9b626e
SHA1 hash:	42c8e69866ffa3fdcd873828563feb4db7db2a2a
MD5 hash:	83ea03897665cc4fe3806d669ef6af1e
humanhash:	virginia-eight-twelve-floor
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'460 bytes
First seen:	2025-02-16 20:07:22 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v0QFQp0QEQX0QyWQN0Q8Q70QqQ70QiQb0QJdQF0Q5QB0QqQ70QdQp0QgQr0QkQxW:v0QFQp0QEQX0QyWQN0Q8Q70QqQ70QiQZ
TLSH	T1A1518EC59091E0742CB7D9B773BA9C0D3190B2EA74E96F5DEEF938B4418DD063080AA7
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://36.50.135.137/bot.x86	0308459dfb913a3648bc2221a6cb559e6959335f59b40ee5fe67112f59020edc	Mirai	elf mirai moobot
http://36.50.135.137/bot.mips	a7b7a683e1b1607f9565ef324595a683e74d7a6ccb6818797dc4950e799df3b4	Mirai	elf mirai moobot
http://36.50.135.137/bot.arc	n/a	n/a	n/a
http://36.50.135.137/bot.i468	n/a	n/a	n/a
http://36.50.135.137/bot.i686	n/a	n/a	n/a
http://36.50.135.137/bot.x86_64	4721d351f7d60b6f73dd6e749d5d089aa6f55afa52fa84051e10a719229d6434	Mirai	elf mirai moobot
http://36.50.135.137/bot.mpsl	e6098ccc165ae47685de413442c912af1e929360f14f95b4a34f07b0f39cc187	Mirai	elf mirai moobot
http://36.50.135.137/bot.arm	2158bd12bf7b7edd41b04e2b7571e9fabd62ab35c3168296973b1c1e74cd6e81	Mirai	elf mirai moobot
http://36.50.135.137/bot.arm5	3fa6d7197bbec5bb1d96f97f1737645b22cb844c11a3aed930cd2b2b3d659be3	Mirai	32-bit elf mirai
http://36.50.135.137/bot.arm6	1f33e44067287ff5c4104f8bbe22b77ad05d935458a6f5c71462bdff49d0ece1	Mirai	elf mirai moobot
http://36.50.135.137/bot.arm7	a22926e5a56297c9f3f2081362b07caf284b599ac41febb56242fc6d3ef12797	Mirai	elf mirai moobot
http://36.50.135.137/bot.ppc	d8a26bc1b096eb6147dbef58c33722f8f6d71ca64b7249998cb38978f7aabe76	Mirai	elf mirai moobot
http://36.50.135.137/bot.spc	d8a26bc1b096eb6147dbef58c33722f8f6d71ca64b7249998cb38978f7aabe76	Mirai	elf mirai moobot
http://36.50.135.137/bot.m68k	641b2dc15b24ce75704e00821fd1558f4e6eef1993cdb5d809ead88bcab07ae1	Mirai	elf mirai moobot
http://36.50.135.137/bot.sh4	d20191393a69e18e27b6aec10bbe5357232b7f1175beae18ffd743f511cb0ca1	Mirai	elf mirai moobot

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b2463ea0fd713c335b453dlinux22vpnfull_triage

Tags:

downloader trojan agent

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67b245b0991985e0a959f625/reports/8f7f72dc-54f0-4f09-be6a-6e3b7ae3979a/overview

Result

Verdict:

MALICIOUS

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7bb7d78bbcfc4b6b4354a691cbfb03284087e6bcbef08cbdfc806c62c0e92634

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7bb7d78bbcfc4b6b4354a691cbfb03284087e6bcbef08cbdfc806c62c0e92634/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2025-02-06 12:54:09 UTC

File Type:

Text (Shell)

AV detection:

23 of 37 (62.16%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=po35pc547rfwwq2uu2i4x6ydfbaipzv4x3yizpp4qbwgfqhjey2a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/250216-ywlgfaxmcr/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7bb7d78bbcfc4b6b4354a691cbfb03284087e6bcbef08cbdfc806c62c0e92634

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.