MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0b29a983f8d41bd63c41107323a1a918d4d47360f230175532b9ed525c3e178. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	f0b29a983f8d41bd63c41107323a1a918d4d47360f230175532b9ed525c3e178
SHA3-384 hash:	b2208b8241af9bf0ec3dafa197905c87ae137e7a80c65e347c4c226427ad4c0f639c8cf7ee96b01e8ae0389abf3b2e3b
SHA1 hash:	ebd19613dcd7c16108a53d5b3c5f8bfb7a7733ba
MD5 hash:	44185e737bd0a9cece293d99cb3cffdd
humanhash:	autumn-delta-utah-four
File name:	aws
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'685 bytes
First seen:	2025-12-03 06:46:53 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:q0F2ZkNPVFKX0F2wkB7VFKX0F2oiko4fVFKX0F2RktVFKX0F2QLkQ2hVDVFKX0FM:vNUPtUIlYhZ7qOcQhVpCNC0
TLSH	T1B55174CF15CE97F0DDB5999171E948446CC2F697B4C3DE42E9E834A88C8ED8072D1E89
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://158.94.210.88//Yboats.x86	2d7aad4cd9f534449106df11d19e3aed6a65db961acdd232885aee5cde939131	Mirai	elf ua-wget
http://158.94.210.88//Yboats.mips	151ac329ae310dfb04c56227b1dbd901bee5ba48700702c568b8989010ff726d	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.mpsl	6184c95af0c3d0bb886b0298184a6d05657d8a5737a272e256f0c8be71cbe2db	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.arm	2cec0b417608931a403cfe5b028bb36d7308fce48c7b6ebf6dd6b5e5ea4fda0d	Gafgyt	elf gafgyt ua-wget
http://158.94.210.88//Yboats.arm5	f16f375df54b3c485164167423f7278339a1f7d87f9384be20a1dfb57e131d89	Mirai	elf ua-wget
http://158.94.210.88//Yboats.arm6	a30d85f2dfd1b463fcc0c7feb9c912e55590c7ec02837b526cd1298010533860	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.arm7	72b307a2d81e94f93e41c15f04a62d4d84a76d2d3b807ed76db9b533b41bd4c2	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.ppc	32315ee27ad49dc1519356e0b107fbd7db8269cbf6f283648056d6459160af5e	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.m68k	9c05f063af0c3b63e7bd4b990303914a24722d6ec637aaf282faf050b9ae4166	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.spc	63f12222899ed2a303643d9d674a6375680eb5bcab4fb2959789b6be44bd505a	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.i686	n/a	n/a	elf ua-wget
http://158.94.210.88//Yboats.sh4	a41516a742c34feb6fcc2814a4539b74a817c78699935b515fb51f333f29a139	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.arc	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/692fdcf0ddcd694c78b9fd6e/reports/66397d81-0333-4574-add8-e51f940eab8d/overview

Result

Gathering data

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f0b29a983f8d41bd63c41107323a1a918d4d47360f230175532b9ed525c3e178

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f0b29a983f8d41bd63c41107323a1a918d4d47360f230175532b9ed525c3e178/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/f0b29a983f8d41bd63c41107323a1a918d4d47360f230175532b9ed525c3e178

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-12-03 06:47:12 UTC

File Type:

Text (Shell)

AV detection:

21 of 36 (58.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6czjvgb7rva32y6ecedteoq2sggu2rzwb4rqc5ktfopnkjod4f4a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251203-hj8s7swlfk/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.