MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce58a8bf2ecc9e3a5d39d344e270b6ba28bed86333a06c820f6842d9b5db52cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	ce58a8bf2ecc9e3a5d39d344e270b6ba28bed86333a06c820f6842d9b5db52cd
SHA3-384 hash:	ca46f2ffd14eb565acd1b2aecd56c6da8d9c507ebde2734fa0c788f272d164adacdaf279cd1d9be227d8b52648f25cfd
SHA1 hash:	bc6fab78b4618c065828f4df2e82b0c79b0eeae0
MD5 hash:	55de1a5547c9a45945a29055a76252d9
humanhash:	sink-july-friend-august
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'970 bytes
First seen:	2026-03-27 15:25:52 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vS797N7hSE6GSgMzPS0KWS2oUS727o7USfj3bSN9RSacgS5pVSMSOSo+CSzfTS74:vS797N7hSE6GSgMzPS0KWS2oUS727o7Q
TLSH	T1A551548553864C3C39A7EB13E6BA8B783086D05258EBAF95DAD4BAF84B4FD143140B53
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec
Tags:	mirai

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://121.127.34.138/hiddenbin/boatnet.x86	c2f052c858b23137ac9f60e049136525b4363b72c0a1ec6acd8c52c24ec2e915	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.mips	9072d9bcce1cc389eec8bc7ada21f80dd06f6df7af6e4d973e473120072777db	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.arc	ecba636ba0ea98bfe34fa33bee6d18e453ec3e9c35461c095e55c6bf4bdaeeca	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.i468	n/a	n/a	n/a
http://121.127.34.138/hiddenbin/boatnet.i686	n/a	n/a	n/a
http://121.127.34.138/hiddenbin/boatnet.x86_64	n/a	n/a	n/a
http://121.127.34.138/hiddenbin/boatnet.mpsl	a76a8d84860fc7cb7cf7c3c15ed4ed5dd6d9490e174aee39e6c6ef274114d990	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.arm	e993811b292c79fc83ee134e86f6a0608a634dd61f932e57bf0038ca496ab6d7	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.arm5	3f0f9e048070dad1a8e3aa56185134701cf69cf579ab5ab6a53350dbc9e7d043	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.arm6	164435180e2a8287cb1c179fda496f4cd5fa49ba709a218bac7beb6ad6a674b5	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.arm7	06f2b552bf105b8601d11a253988afe620d7391a5a4e7c43eb5f627405c30633	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.ppc	cfb7f83f0d14d31635b9e584a10fa8f7b28a09c7d7fa7671e1308a320ef18495	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.spc	5d2f519e2d4ee2b40dfd17745df91b19fac2bb2e8aed2e01ab25c06d0a404bf1	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.m68k	beb6d9cb02645765a63886090ba380908487e8d8e6e670aa4c7921100da5228a	Mirai	elf mirai ua-wget
http://121.127.34.138/hiddenbin/boatnet.sh4	5535e5fddea098cf5306f59c85989aa8e6615d0036aa3e35e43579f99efb9cb3	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

medusa mirai

Link:

https://www.filescan.io/uploads/69c6a3422346b9da57ab6898/reports/ef62b6c2-f880-4b2b-b897-ba7307521418/overview

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/2def8e69-5a37-4c08-b713-4faea4f98054

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ce58a8bf2ecc9e3a5d39d344e270b6ba28bed86333a06c820f6842d9b5db52cd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ce58a8bf2ecc9e3a5d39d344e270b6ba28bed86333a06c820f6842d9b5db52cd/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/ce58a8bf2ecc9e3a5d39d344e270b6ba28bed86333a06c820f6842d9b5db52cd

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-03-27 15:24:52 UTC

File Type:

Text (Shell)

AV detection:

23 of 36 (63.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zzmkrpzozspduxjz2ncoe4fwxiul5wddgoqgzaqpnbbntno3klgq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260327-svd33scs2k/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Unexpected DNS network traffic destination

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ce58a8bf2ecc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/ce58a8bf2ecc9e3a5d39d344e270b6ba28bed86333a06c820f6842d9b5db52cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh