MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb4f85811554ad4c63a44e241ee6bc3fdc304fb15f7f50bf06514d84ac80383b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	eb4f85811554ad4c63a44e241ee6bc3fdc304fb15f7f50bf06514d84ac80383b
SHA3-384 hash:	fd9026c547460756d562bcb82fbec18f6d080d99ab8830abcd2698d3062fc3bba9bac84c50077f5e694cb39f3ab66fce
SHA1 hash:	8fb0b7bb41d9db58bc765e4b96ee58b609f801fc
MD5 hash:	a98e29b2f7afdbaa440a038190e0e551
humanhash:	ack-summer-texas-pluto
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'940 bytes
First seen:	2025-08-04 22:36:06 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vM7h7N7hMq6GMgSzPMaKWM4oUM747o7UMf73bMx9RMUcgMVpVMSSOM2+CMLfTMz+:vM7h7N7hMq6GMgSzPMaKWM4oUM747o7Q
TLSH	T19251E4C582444D302DA7AE23EBB6837C348195D21CE1EF95E9C8FEE0064EE24F269753
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.67.244.57/hiddenbin/boatnet.x86	3c3e36b9c5dcac4324d16ada4ec2b0100156ee43e98d4693317e574bbb5f7d2c	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.mips	f4dfb944cb657fb586818228afb57fc4cd19c5ba05358936e4f75b8c4d51f303	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.arc	5f87d62a958e779686e29261e31c0115da8e6b03141ca1a22c49ee5de2a1be26	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://103.67.244.57/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://103.67.244.57/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://103.67.244.57/hiddenbin/boatnet.mpsl	95f761923c051f49322fbeb65da632cd807c34eb5352ca7989c6b6c79db0c7ab	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.arm	16047a48e8841e9ff0f8e37ce6d90edeaaf92d1a4f590d7b7eab5626b13e6cd4	Mirai	32-bit elf mirai Mozi
http://103.67.244.57/hiddenbin/boatnet.arm5	6af2e5eca5aa3483754a8b5ecc20264bda5fd6c8b22b1ccca82fad8e9f6f3c77	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.arm6	39c8d341b0b356020ece614010fa7ccf3e581618c4178b753980552100feceb8	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.arm7	a0dbd4d368087f425a67004ca95fc6e6c68093e44171384c10755a055e59b775	Mirai	32-bit elf mirai Mozi
http://103.67.244.57/hiddenbin/boatnet.ppc	680d6800a4a131ca2afe8e89f704aae1baaa56d26cfe9097bea007cfaf233c25	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.spc	n/a	n/a	elf ua-wget
http://103.67.244.57/hiddenbin/boatnet.m68k	553379a9048929b6a3ddf2d6c4bdd90dabc6268327e75dd6afedaef620a0c3cd	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.sh4	f64bd010a6b4de34f00ff6f5170c1deffbe3ed481192917943bc0ffe2b86dc5c	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/3aca0c5e-b07d-4587-8b27-604834060b16

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/eb4f85811554ad4c63a44e241ee6bc3fdc304fb15f7f50bf06514d84ac80383b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eb4f85811554ad4c63a44e241ee6bc3fdc304fb15f7f50bf06514d84ac80383b/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/eb4f85811554ad4c63a44e241ee6bc3fdc304fb15f7f50bf06514d84ac80383b

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-07-31 03:19:14 UTC

File Type:

Text (Shell)

AV detection:

23 of 36 (63.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5nhylaivkswuyy5ejysb5zv4h7odat5rl57vbpygkfgyjleaha5q._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250804-2je1nswwdt/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/eb4f85811554/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/eb4f85811554ad4c63a44e241ee6bc3fdc304fb15f7f50bf06514d84ac80383b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.