MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbaaf28db4832370b1a845df018962671e81f2937341c4eff174fdfa79d01462. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	bbaaf28db4832370b1a845df018962671e81f2937341c4eff174fdfa79d01462
SHA3-384 hash:	c2882838aeab72094455b6290e40e54344438f60f223f455f48620761330ec9ee0b9267d15c903c3e3d020c119915de2
SHA1 hash:	1f4289bea2522d49f24057d06ff1c8d7e410187a
MD5 hash:	ed4652aa957668e47fcb700addc9444f
humanhash:	artist-autumn-uniform-high
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'037 bytes
First seen:	2025-09-29 16:13:46 UTC
Last seen:	2025-10-14 12:30:36 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:if7G7x7xf5oUfghgwbfpYEfryef7r7y7eff8fH/fWBBfnOifKldfhwsfl0ofMXH9:if7G7x7xf5oUfghgwbfpYEfryef7r7yg
TLSH	T11A51B5C466464F306E67AE13FBBA837C7483A4C294D3AFE2DAC4BAE2054ED14B144753
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.77.241.50/hiddenbin/boatnet.x86	feaba977cfd0e1e4425e0d56d92782dcd1786005a2f03d94a11d7c63ac534e09	Mirai	elf mirai ua-wget
http://103.77.241.50/hiddenbin/boatnet.mips	4e990ac1bc50db17828444e2600ddc4d5514877817cdeb293526372216b88307	Mirai	elf mirai ua-wget
http://103.77.241.50/hiddenbin/boatnet.arc	8b4392f5e42a6bdeb931bf558317559c7d6ecaef43a7c85d528a0b4874619240	Mirai	elf mirai ua-wget
http://103.77.241.50/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://103.77.241.50/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://103.77.241.50/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://103.77.241.50/hiddenbin/boatnet.mpsl	54e204c8f9067d96b8911ef14805c86d90f80e1222e7e857499adc4184ecbd14	Mirai	elf mirai ua-wget
http://103.77.241.50/hiddenbin/boatnet.arm	067b4b56691cb695a200cb454c3a1fcd287a6f41b2b61fb7bb68cf271791b0cd	Mirai	elf mirai ua-wget
http://103.77.241.50/hiddenbin/boatnet.arm5	41fb32ab9163156cbd705ef8def0aa50033d668b7beec1f08e1ee970d57e3c9c	Mirai	elf mirai ua-wget
http://103.77.241.50/hiddenbin/boatnet.arm6	6452e6700617b2c717ddb7a9bbf003b140ecf7a7370e13bea9b136309d17610f	Mirai	elf mirai ua-wget
http://103.77.241.50/hiddenbin/boatnet.arm7	9a504252ea186e57aa2214b7a35d0ab17106889c36ecba618beaf574e1556d25	Mirai	32-bit elf mirai Mozi
http://103.77.241.50/hiddenbin/boatnet.ppc	197379db18fbf64f99d2e04affd477105b2cacbf41ae7bfb6b177409f290907a	Mirai	elf mirai ua-wget
http://103.77.241.50/hiddenbin/boatnet.spc	1493eba601c4412f7af6a2bd7f805c86ab34d37138d040438ceff472335396bd	Mirai	elf mirai ua-wget
http://103.77.241.50/hiddenbin/boatnet.m68k	3d303d75c9125049280956f6fb65fb2f4e926d307392162c46192dad6bdc6823	Mirai	elf mirai ua-wget
http://103.77.241.50/hiddenbin/boatnet.sh4	1ee3906d598021906d645b52dc150ff54aa01502c1738769846700bc15894a6d	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-29T13:11:00Z UTC

Last seen:

2025-09-29T13:11:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/bbaaf28db4832370b1a845df018962671e81f2937341c4eff174fdfa79d01462/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/5dcced86-13ce-4ba3-bf25-93ef71971900

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bbaaf28db4832370b1a845df018962671e81f2937341c4eff174fdfa79d01462

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bbaaf28db4832370b1a845df018962671e81f2937341c4eff174fdfa79d01462/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/bbaaf28db4832370b1a845df018962671e81f2937341c4eff174fdfa79d01462

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-09-29 16:06:17 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xovpfdnuqmrxbmniixpqdclcm4pid4utona4j37rot67u6oqcrra._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery linux

Link:

https://tria.ge/reports/250929-tpw75ssnz5/

Behaviour

Reads runtime system information

Writes file to tmp directory

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bbaaf28db483/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.37

Link:

https://yomi.yoroi.company/submissions/bbaaf28db4832370b1a845df018962671e81f2937341c4eff174fdfa79d01462

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.