MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c34d99e973394e77264d16444ec6a0fa44594aac40a027ba716f420bb16eb229. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	c34d99e973394e77264d16444ec6a0fa44594aac40a027ba716f420bb16eb229
SHA3-384 hash:	9abd716c28e38906347fff79336cb2ae73edb257ca56e6deb5b556bd3290dc3339ad33ecbed0d16dc68a215cdadc750b
SHA1 hash:	6493e846eb12a042bac2705c673fc28798f3589c
MD5 hash:	70ed345ee9ee505db6de5499f1c5fb17
humanhash:	mississippi-venus-massachusetts-beer
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'880 bytes
First seen:	2025-09-30 05:30:20 UTC
Last seen:	2025-09-30 08:21:07 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v+7v7N7h+M6G+g0zP+8KW+CoU+7C7o7U+f53b+/9R+Gcg+7pV+0SO+A+C+JfT+xS:v+7v7N7h+M6G+g0zP+8KW+CoU+7C7o78
TLSH	T18D5109C647464C302D63AA17F6B7C12C32CA94BE18E17BD5D9CAFAE1026ED247B41763
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://89.32.41.64/hiddenbin/boatnet.x86	547e40db9112c994302969d750d45e08661f2cda1473d2afb6ccc3d2621187b7	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.mips	7859535218f3770a9020ae89d64a1e98cc5f87af985d77dafd412ef897170ae1	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.arc	3813d1132f0656a076abe35617fddffe64af45bd0d4a3624a0953e8988f023f0	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://89.32.41.64/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://89.32.41.64/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://89.32.41.64/hiddenbin/boatnet.mpsl	966645cdcb838f93a637269ce794aa5375b3bc75c54c0068590ffd7ba8552b62	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.arm	330a9c68f98ded65eaff4ef38db7f692f2d6f690c31d0bcd2b470b2799006c85	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.arm5	904ebd2ac0980029659bb582fb5757a111af3f9f9cf4a8b3cd63a1ce45b261f3	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.arm6	6b55f1e89a6eb1126c2f20c23613997922c0e86c54c92f2a448b15441a5ffe00	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.arm7	7ab405cce467e6ba3d1aa2ac96b99463ef9307cace0216659bddb6ac96b7564a	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.ppc	798baf89502e85d53e70925e87eb7b5df4d2aa7fd48195670125ee1245f50489	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.spc	17431b4964109df1003a94e26ca6e02a85fe5a93927162097fa4a1ddfc896b1e	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.m68k	8c841974254eb09d7bf53430055de592e43741590533bb98203675db399cb0e9	Mirai	32-bit elf mirai Mozi
http://89.32.41.64/hiddenbin/boatnet.sh4	3ff5ab76461f67f90d3aeddc7463757740b737ce4f2f94299468639335106a7f	Mirai	32-bit elf mirai Mozi

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-30T02:51:00Z UTC

Last seen:

2025-09-30T02:51:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/c34d99e973394e77264d16444ec6a0fa44594aac40a027ba716f420bb16eb229/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b819788c-6c36-422c-bdc4-89403aa42c2d

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c34d99e973394e77264d16444ec6a0fa44594aac40a027ba716f420bb16eb229

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c34d99e973394e77264d16444ec6a0fa44594aac40a027ba716f420bb16eb229/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/c34d99e973394e77264d16444ec6a0fa44594aac40a027ba716f420bb16eb229

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-09-30 05:31:25 UTC

File Type:

Text (Shell)

AV detection:

24 of 38 (63.16%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yngzt2lthfhhojsnczce5rva7jcfssvmicqcpotrn5baxmlowiuq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250930-f7gnhstrx6/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c34d99e97339/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/c34d99e973394e77264d16444ec6a0fa44594aac40a027ba716f420bb16eb229

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.