MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8bbdb5ee6b89a572fb2ca4a1675038ac9181653adc8efdc9a50120d3c6e05bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	d8bbdb5ee6b89a572fb2ca4a1675038ac9181653adc8efdc9a50120d3c6e05bb
SHA3-384 hash:	8aa33dbbda5940305c517f37fa922b1464750eb61a8ba36da622e7cd7156d70373d93ffe66a52d8107ec1e281b74c540
SHA1 hash:	bd8f2e18d7a18974b1bf13646b8f35ec4333cee8
MD5 hash:	6f6bb1dbbc9b4e69f56e05e19afcc880
humanhash:	lake-winter-seven-echo
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'910 bytes
First seen:	2026-01-22 11:13:38 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vl7q7N7hlL6GlgzzPl7KWlBoUl7B7o7Ulfc3bl69RlNcglupVlzSOln+ClsfTl0W:vl7q7N7hlL6GlgzzPl7KWlBoUl7B7o7Y
TLSH	T110518AC653464D341CA3EE13F6B6432C3482D66278E5ABA9EDDCBAE8836ED1C3540753
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.137.70.87/hiddenbin/boatnet.x86	c811a6e1c2ce0ab065243c933d779e9714b77eabfe3b61f8485f327918cd8b98	Mirai	elf geofenced mirai ua-wget USA x86
http://45.137.70.87/hiddenbin/boatnet.mips	56dea9ca76de7db27c1e6f642938b817beb8cb79154f1f5b11c30642b973e89f	Mirai	elf geofenced mips mirai ua-wget USA
http://45.137.70.87/hiddenbin/boatnet.arc	837376c26ad572f22629ada682107a92fe3c9175ae4c23c835f81c6570ec624a	Mirai	arc elf geofenced mirai ua-wget USA
http://45.137.70.87/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://45.137.70.87/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://45.137.70.87/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://45.137.70.87/hiddenbin/boatnet.mpsl	n/a	n/a	elf geofenced mips ua-wget USA
http://45.137.70.87/hiddenbin/boatnet.arm	3deed254c6f60963f0e8f22ac995c9006bdeee07edee1d83e243e6a06872b4b7	Mirai	arm elf geofenced mirai ua-wget USA
http://45.137.70.87/hiddenbin/boatnet.arm5	e650b7a53507d960edc2b1469f05068c9a60229a33486985741a9d8364926ac9	Mirai	arm elf geofenced mirai ua-wget USA
http://45.137.70.87/hiddenbin/boatnet.arm6	76e8f651959da39b0e0aeea40efa9e3f97d544805e2eb136f7f9bdb963d78729	Mirai	arm elf geofenced mirai ua-wget USA
http://45.137.70.87/hiddenbin/boatnet.arm7	edda5b721eb32bbaa38f253667fe19201194dcd886ae82dc458f008b09c398ac	Mirai	arm elf geofenced mirai ua-wget USA
http://45.137.70.87/hiddenbin/boatnet.ppc	ebba9680d1f52d8674ac18ee60a3879f7fb8edfdd4a3b19532758d7b92763d40	Mirai	elf geofenced mirai PowerPC ua-wget USA
http://45.137.70.87/hiddenbin/boatnet.spc	b1a49420e9f1a0a926c1dfc9968461ebd2f461ff9e84ac67d0d57b3ada7fc61b	Mirai	elf geofenced mirai sparc ua-wget USA
http://45.137.70.87/hiddenbin/boatnet.m68k	a8eb5ed9a59ff35256160050252325a763008e2c00fc7b7ece1dd142f262fe3c	Mirai	elf geofenced m68k mirai ua-wget USA
http://45.137.70.87/hiddenbin/boatnet.sh4	256a9826a1a0caa7f56aa24933a42a33d083ac8cbbea3e94dab33a19cc0a33b5	Mirai	elf geofenced mirai SuperH ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/49e066d7-a7cd-42aa-8a30-b831ae241429

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d8bbdb5ee6b89a572fb2ca4a1675038ac9181653adc8efdc9a50120d3c6e05bb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d8bbdb5ee6b89a572fb2ca4a1675038ac9181653adc8efdc9a50120d3c6e05bb/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3c55wxxgxcnfol5szjfbm5idrlerqfstvxeo7xe2kaja2pdoaw5q._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260122-nb82wsdw7b/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d8bbdb5ee6b8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.37

Link:

https://yomi.yoroi.company/submissions/d8bbdb5ee6b89a572fb2ca4a1675038ac9181653adc8efdc9a50120d3c6e05bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh