MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb9b45b7abc8d45c47a7e245efdde63bd9e97beead746c23637536841145482e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	bb9b45b7abc8d45c47a7e245efdde63bd9e97beead746c23637536841145482e
SHA3-384 hash:	648237c274146e1f6d082cbe8814ae05cff3e38c4bd34cf7a1e98b917483a019df36b366121a8fe1835a4857a804b217
SHA1 hash:	8b9f165b8f03b4b0d7731a8f4d62170e3c03bd68
MD5 hash:	80613cdec18650bd06116088dc0619e7
humanhash:	echo-oscar-diet-music
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'932 bytes
First seen:	2025-09-03 21:03:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:iVc7Qc7x7/Vcvco8Vcg3cgwdVc/cYMVcJcy6Vc7Jc7y76VcfmcfHpVcAcBvVc9cx:iu757x7/u0o8ugMgwdukYMuqy6u7q7yG
TLSH	T1E0519ACA51C54F302C73AE5BEAB7892C748298D294DBEFAADAD4B9E4414ED343340753
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://74.48.84.6/hiddenbin/boatnet.x86	c8134232868449489961522cbc0cc8a46d6c44a64e07b8a05c22fcf858db7bce	Mirai	elf mirai
http://74.48.84.6/hiddenbin/boatnet.mips	8e1e06561d8d155243c78fd7e1cd25fdafd5d888bef8e13ee3fddcaeb6e58ecc	Mirai	elf mirai
http://74.48.84.6/hiddenbin/boatnet.arc	defc9fd73bad423fee5e4ad053c780ea3c0bcafd6d373d636bac158e7d269377	Mirai	elf mirai ua-wget
http://74.48.84.6/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://74.48.84.6/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://74.48.84.6/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://74.48.84.6/hiddenbin/boatnet.mpsl	981e40eaca72e93f0185c2ccd9053465248589bafa7f39fe387650383d4cecec	Mirai	elf mirai
http://74.48.84.6/hiddenbin/boatnet.arm	01a08a8b56c100f9661f0e44d613adf2a04bd82e7d0087a819d28350b63d0516	Mirai	elf mirai
http://74.48.84.6/hiddenbin/boatnet.arm5	bb726ff30dbc75167ef572d225cd9347ee63ffd906cd7639d49854fb70a2c844	Mirai	elf mirai
http://74.48.84.6/hiddenbin/boatnet.arm6	fc9035c94f225e93a6a547d4d972d7eb6aec3628ec82d7538fdc33633d557491	Mirai	elf mirai
http://74.48.84.6/hiddenbin/boatnet.arm7	1881bc058ce4be5b9fa0eb3751e28790bf6e1d6f76b1291841d2c24ed3b93afc	Mirai	elf mirai
http://74.48.84.6/hiddenbin/boatnet.ppc	4d7415c458b1c581dddb7f04978a17d0a2aa5190b1703ee91b5ae3b4c7785abb	Mirai	elf mirai
http://74.48.84.6/hiddenbin/boatnet.spc	9bc04e987dd1e6aaa5a8974314b2b9eb639e81f2ac7489b67fd3d355c3573055	Mirai	elf mirai ua-wget
http://74.48.84.6/hiddenbin/boatnet.m68k	7458e03e496aaad57bfa71c492e95d144065572172e0afbec1ac0c56b07207c6	Mirai	elf mirai
http://74.48.84.6/hiddenbin/boatnet.sh4	0e57457be2a76226a70704ce00fab0775150e5b30cb9ce1e37f6f0ee4b1a3436	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-03T14:50:00Z UTC

Last seen:

2025-09-03T14:50:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bb9b45b7abc8d45c47a7e245efdde63bd9e97beead746c23637536841145482e/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c602997b-eadb-4eab-9de7-5bb694538a6a

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bb9b45b7abc8d45c47a7e245efdde63bd9e97beead746c23637536841145482e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb9b45b7abc8d45c47a7e245efdde63bd9e97beead746c23637536841145482e/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/bb9b45b7abc8d45c47a7e245efdde63bd9e97beead746c23637536841145482e

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-09-03 17:15:37 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xonuln5lzdkfyr5h4jc67xpghpm6s67ovv2gyi3dou3iiekfjaxa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250903-zwa65sdm8w/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bb9b45b7abc8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/bb9b45b7abc8d45c47a7e245efdde63bd9e97beead746c23637536841145482e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.