MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd59679a9241cd40cea3f3cd08033ee17e1f323d7d671c56612fae098806248d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	fd59679a9241cd40cea3f3cd08033ee17e1f323d7d671c56612fae098806248d
SHA3-384 hash:	78f54e8c073f48a7d050ae08b78947ff9b2a495c7d13748d8e714e11c084614ce6257232bc4747abfc1731a29148f752
SHA1 hash:	cffb5daad11f991f455410fa5036fbdc2f992eb8
MD5 hash:	a54dba5434bebc25f7cb0c0852c891fa
humanhash:	april-may-emma-solar
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'970 bytes
First seen:	2026-02-23 10:28:02 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vD787N7hD56GDghzPDpKWD/oUD7/7o7UDfW3bDM9RDrcgDgpVDhSODV+CDmfTDum:vD787N7hD56GDghzPDpKWD/oUD7/7o7o
TLSH	T18E51058A61084D343DAB6E52E7B6912834C164630DFA6FA5DFE4BDE1818EE103784F63
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.180.127/hiddenbin/boatnet.x86	8e16401a4591be92aeebdff09aa11fd5aed10676f0c2bc1e5b5c011e0ab2cb60	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.mips	95dbd6e36abeaa9e8823c1216abbe965a2d4c60b4f362c0b369d162b6d8086a5	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.arc	07a33efcafcc394742514478a61363c9d63522c8cfa39f988e471fae566c8702	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://130.12.180.127/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://130.12.180.127/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://130.12.180.127/hiddenbin/boatnet.mpsl	102d932cf2f7afe40923fa2832b444d6b9f3f4995a710ef9fbbd413d03d8c216	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.arm	3d7f8cb01aa7265a866a2724eb6222b3bc720dc52ebfd96366e5948b5626c382	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.arm5	b2937b0644708222a2c384157ac5fd0ed9d30e03561000872595d7caa87b9339	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.arm6	a8b258531c208202b0bd8dd07f3b64bfa3aec56fed34d049490903163229cd58	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.arm7	9976094a4cf95e878f6b504a52c73b3a54b5742db047a119b251fc51ca1b4bbf	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.ppc	46b4c0036369f33e246d79a30879593742df277dbfd38f85d928103381239eca	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.spc	e1514369e66b2e62e966bc55a83534a04c04afa74b50b4e419004f015ac58ed9	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.m68k	52f802201f8ea9e9a0a43a17329030e9daa26c49c9627799c16027f84bb15720	Mirai	elf mirai ua-wget
http://130.12.180.127/hiddenbin/boatnet.sh4	c2d884856950bef91a5f0841966b5b07bb2da4c6d3730e6d8970a8adb0f586ce	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/699c2bf397feb4afd6537755/reports/0112b74e-b43c-41f8-80a2-2fd355895d39/overview

Result

Gathering data

Verdict:

Malicious

File Type:

unix shell

Link:

https://opentip.kaspersky.com/fd59679a9241cd40cea3f3cd08033ee17e1f323d7d671c56612fae098806248d/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f9f8fb4a-e447-4ca1-aea8-6bac3f303b88

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fd59679a9241cd40cea3f3cd08033ee17e1f323d7d671c56612fae098806248d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd59679a9241cd40cea3f3cd08033ee17e1f323d7d671c56612fae098806248d/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7vmwpgusihgubtvd6pgqqaz64f7b6mr5pvtryvtbf6xatcagesgq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260223-mhydasdx9f/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fd59679a9241/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fd59679a9241cd40cea3f3cd08033ee17e1f323d7d671c56612fae098806248d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh