MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b1a2fb6b358484b7769aeeb63209f2b277d91b5015cf28ce471a67e0ef83d28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	8b1a2fb6b358484b7769aeeb63209f2b277d91b5015cf28ce471a67e0ef83d28
SHA3-384 hash:	a19b392fd5903b486615797995b00aff501d5a59674e89d0a90220660aa846fdfdc6add8a9bdb01a623659903fb8e69a
SHA1 hash:	d4269e7b17f3e05fa1395a59f5f6815c87753bd6
MD5 hash:	ffed68702b8dccbccbd3634bb647f603
humanhash:	timing-paris-high-pennsylvania
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'527 bytes
First seen:	2026-08-04 05:24:40 UTC
Last seen:	2026-08-04 08:05:44 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:JCkp0Fz7LNTv0FzaN4i3v0FzBGiNBFv0FzONhv0FzkN1v0Fz96N9Cwv0FzqiNVHH:ItarikVDyTh1OqSC14xHXVaWWmc
TLSH	T1305181C53251AE746CA79AB773BA042C3183B0E1D4CBAED564E93DE555CEE04B4C8E43
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.123//bot.x86	n/a	n/a	n/a
http://94.154.43.123//bot.mips	fd78a811e383f0432e35820902307068a63d4dacaf852e20baad04a9fc9fbc6c	Mirai	mirai
http://94.154.43.123//bot.arc	n/a	n/a	n/a
http://94.154.43.123//bot.i468	n/a	n/a	n/a
http://94.154.43.123//bot.i686	f2bf68b8fa67d260779cc22b2023a705bd05498c96a8e4a15fa3cefae289e1ba	Mirai	elf mirai opendir ua-wget x86
http://94.154.43.123//bot.x86_64	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a	Mirai	elf mirai opendir ua-wget x86
http://94.154.43.123//bot.mpsl	n/a	n/a	ua-wget
http://94.154.43.123//bot.arm	cbc16099286916817265a13929b5ac638052a82ed2013e0f6768d63620cfa151	Mirai	arm elf mirai opendir ua-wget
http://94.154.43.123//bot.arm5	n/a	n/a	ua-wget
http://94.154.43.123//bot.arm6	n/a	n/a	ua-wget
http://94.154.43.123//bot.arm7	867d505204d8d593c6ebd2ac0ba93204627ae8898a2efd62461ee147258b62d6	Mirai	arm elf mirai opendir ua-wget
http://94.154.43.123//bot.ppc	0644d1d1844e7b9846d0f771c292564614c74daacca6c80e1a29d46fd28c3124	Mirai	elf mirai opendir PowerPC ua-wget
http://94.154.43.123//bot.spc	n/a	n/a	ua-wget
http://94.154.43.123//bot.m68k	n/a	n/a	ua-wget
http://94.154.43.123//bot.sh4	922ce5db29a8aca86b72dfdd106ed012c193246dafd41d5fa431bfdd214b3f78	Mirai	elf mirai opendir SuperH ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox downloader mirai

Link:

https://www.filescan.io/uploads/6a7177cb5ab7943135dc6a82/reports/4dddf7fd-d833-468a-85ca-c5b2f4fa3d53/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-04T02:43:00Z UTC

Last seen:

2026-08-05T20:10:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8b1a2fb6b358484b7769aeeb63209f2b277d91b5015cf28ce471a67e0ef83d28/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ba648e60-f212-4612-9eff-fe5260700dad

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8b1a2fb6b358484b7769aeeb63209f2b277d91b5015cf28ce471a67e0ef83d28

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8b1a2fb6b358484b7769aeeb63209f2b277d91b5015cf28ce471a67e0ef83d28/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-08-04 05:25:41 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rmnc7nvtlbeew53jv3vwgie7fmtx3envafopfdheogth4dxyhuua._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260804-f4g5wagm6s/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Creates a desktop entry file

Reads CPU attributes

Modifies Bash startup script

Creates/modifies Cron job

Creates/modifies environment variables

Deletes log files

Modifies init.d

Modifies rc script

Modifies systemd

Write file to user bin folder

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Traces itself

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8b1a2fb6b358/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/8b1a2fb6b358484b7769aeeb63209f2b277d91b5015cf28ce471a67e0ef83d28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh