MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac12224d300baa85a2ccb8becb3f9cc01c6165ea77a0f41cc17e14f6d7ea4185. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	ac12224d300baa85a2ccb8becb3f9cc01c6165ea77a0f41cc17e14f6d7ea4185
SHA3-384 hash:	99cc90104fabc5192debe9f6758216dba7bf530a1accff6c2644880a40ead52e8d7f07a56f6b9cd58d2db5c54da1312f
SHA1 hash:	747cb3c753e528c69a80fe2421aae8b5aa19fc86
MD5 hash:	242c5bd5126ac5b4d54ca6a97edf0678
humanhash:	sierra-saturn-sodium-one
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'066 bytes
First seen:	2026-03-31 12:29:59 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:ZpdXdgUpdgndgwdpdoXdd7pdZd2updydL1pdDdsgpd7dUopd2dfppdvdo8pd2dfG:ZzNgUzgdgwdzoNd7zj2uzIL1zhsgzJU/
TLSH	T1C751F4C445849E75ACB7EA52BAB6C21C7092A4C314DF7F9ADEC8B9E0858EE10F140793
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.59/hiddenbin/boatnet.aarch64	f20991717b62d88a44b917df63021187bdee72b4c92a7773eb66531f86c3a43f	Mirai	elf ua-wget
http://176.65.139.59/hiddenbin/boatnet.arc	cecaed0ffe519c83d77655e1c2f3409fa795fc97917fe9a258f2473b1f84788d	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.armv4l	128396e00e8d7f3b3ae0ea8764c8d05448861a825e872d729013768537c0fdde	Mirai	elf ua-wget
http://176.65.139.59/hiddenbin/boatnet.armv5l	3f064c305e1210001e661ebc6154f3f4f71a1de02a495a70bb266cdb50997377	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.armv6l	332e784b02746b3dd6054d71e22112fc4cede6384d4ef44ca447ccc34d84674f	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.armv7l	a7abb507c3fba818d313401ac9da83c6e7fc9a109f9dfc4e9c6b0d9d9703f6fa	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.i486	d24964dbf3bdd5ad822bcd66f4207275c238cb940eff4628dad7c6559648bd22	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.m68k	fb10cbce3b750290774de552141bdfee2b97f43c29b8a8e4be04fba0a2c0d5e7	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.mips	5b6399acbc07e044107ef03c275b998306324f53f5442f4c243abdc8bcb27a07	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.mipsel	72fc53134560249613c435b13044911019d1ea00b337f43fa539f21eb903b320	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.mipsrouter	e946662996cb04d86082d20460698495fc28cf36f9a876bb70185d986462d360	Mirai	elf ua-wget
http://176.65.139.59/hiddenbin/boatnet.powerpc	ab8e7ec76f4021ec7f0a2586d3a2d5bf27d1e78e531c07aa6c71afcb6b59a245	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.sh4	c5fabb7238edaf7d1f9b477a492fc8bfa1bdb6137784dca152e6187ccc4b6cdb	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.sparc	312c4ba029a605fae997860667eea6b46fdfacccd00c90b40f4b6dd392e6d304	Mirai	elf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.x86_64	36283e93299fb13567ff63d1ba6f1ae5a54a345473a6c30263ad45f61b2eb4b8	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Result

Gathering data

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-03-30T00:30:00Z UTC

Last seen:

2026-03-30T14:14:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ac12224d300baa85a2ccb8becb3f9cc01c6165ea77a0f41cc17e14f6d7ea4185/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ed52173d-504f-4fc5-907c-780e0480d859

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ac12224d300baa85a2ccb8becb3f9cc01c6165ea77a0f41cc17e14f6d7ea4185

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ac12224d300baa85a2ccb8becb3f9cc01c6165ea77a0f41cc17e14f6d7ea4185/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/ac12224d300baa85a2ccb8becb3f9cc01c6165ea77a0f41cc17e14f6d7ea4185

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-03-30 05:26:32 UTC

File Type:

Text (Shell)

AV detection:

21 of 36 (58.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vqjcetjqboviliwmxc7mwp44yaogczpko6qpihgbpykpnv7kigcq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260331-pps39saw5j/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

UPX packed file

Enumerates running processes

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ac12224d300b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/ac12224d300baa85a2ccb8becb3f9cc01c6165ea77a0f41cc17e14f6d7ea4185

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh