MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a147cbde451e4a8a0c461c0e969d733d83abf5daae8ea15616da8bd7daa9cfc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	a147cbde451e4a8a0c461c0e969d733d83abf5daae8ea15616da8bd7daa9cfc5
SHA3-384 hash:	bf9a3af59adcbd9203395847743f5a044c6a6b6fd8f4af0a77acc45bfd4e056f28454536c362af8878ea53e034a757ba
SHA1 hash:	8c6fc0b2da7f1934bddf8dc5409e44701829269e
MD5 hash:	71f1d1a49346cda47ba641953ab4ebfd
humanhash:	item-butter-spaghetti-utah
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'670 bytes
First seen:	2026-02-22 09:27:24 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vh/3/gh/0l/0bikh/5P/5Hyh/x2/xynh/xTQ/xTYh/+/Ch/is/N3Ch/5pj/5Oh/P:vWiObsXaYXsktcwCBUNU3Ush7kKM
TLSH	T120510887127255B43CE29DBE72B51514F280E4692DC69DEDECD93AF48ACCE08229D783
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.90.163.37/network/bin.x86	7a230c866f44cec2e20b1d146f0f2cef759a7642f41981c0532371cc98f97cfa	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.mips	d5c9fca326e5157fd60b1e8bca867b3803a121795a4ab737765e9198a593b096	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.arc	n/a	n/a	censys elf ua-wget
http://45.90.163.37/network/bin.i468	n/a	n/a	censys elf ua-wget
http://45.90.163.37/network/bin.i686	n/a	n/a	censys elf ua-wget
http://45.90.163.37/network/bin.x86_64	c7e698a05ce1f31a85c30c227ff9e25e83d5fd29d4a1f3ff8da9eefcdf4a1621	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.mpsl	faca2984de1ec208338d07a58785a2424adc8a7c019338a03871f0583b48f5b0	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.arm	bf9f9ce8bdfa8766baf6602c1d3ec01a309d6e7af6c25b6935b708408af947bd	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.arm5	594300d42eb735eadc2e407ac84eaf7554c662450ebe9846d45e11888fd18137	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.arm6	4d954c25e320adeb7b44a2dfc6bf5c6936e83c8ceb2f14142fb8914edf672993	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.arm7	1f2ae3461a20228370543cb57585a0aec46216658815df0a2a1357108267c396	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.ppc	f9128964a1ce74a0e10a3abf497028981d7859875e8d565f2b880aec9bbd6b7c	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.spc	fa0b37d3c641fdd57113016a8183ec7e841fd4054c50a26ea8117ec1788eaf38	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.m68k	569af99f50e0aab7512e598f9d9cd95356e0ff19b478da2511fcbff02628d54a	Mirai	censys elf mirai ua-wget
http://45.90.163.37/network/bin.sh4	b8df72073674b33a20dcb9e597831f7926f8a0cb999dfd0f5d30d92f6fbd354b	Mirai	censys elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

Link:

https://opentip.kaspersky.com/a147cbde451e4a8a0c461c0e969d733d83abf5daae8ea15616da8bd7daa9cfc5/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/abdf071d-b361-4b87-8854-0e658c4eb2d5

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a147cbde451e4a8a0c461c0e969d733d83abf5daae8ea15616da8bd7daa9cfc5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a147cbde451e4a8a0c461c0e969d733d83abf5daae8ea15616da8bd7daa9cfc5/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-02-22 09:28:20 UTC

File Type:

Text (Shell)

AV detection:

16 of 23 (69.57%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ufd4xxsfdzfiudcgdqhjnhlthwb2x5o2v2hkcvqw3kf5pwvjz7cq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/260222-lfe89sev9a/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Unexpected DNS network traffic destination

Mirai

Mirai family

Malware Config

C2 Extraction:

45.90.163.37

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a147cbde451e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/a147cbde451e4a8a0c461c0e969d733d83abf5daae8ea15616da8bd7daa9cfc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh