MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe76c6c965dc7d0be02f485bd7fa1876a5597e9548fb6612ce0ef3ee98061860. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	fe76c6c965dc7d0be02f485bd7fa1876a5597e9548fb6612ce0ef3ee98061860
SHA3-384 hash:	3e000489db8e230dfb4e82b6afb85802d694e40383c1ddd61c4da72ee869fce551d1f9f95b12f6d4a64408ecad9a848f
SHA1 hash:	dd5d8972ed3be4bb59bb4e54c296c6ac9229912e
MD5 hash:	9e4dda47da60681bd97353db552963ac
humanhash:	fix-november-spaghetti-eight
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'970 bytes
First seen:	2025-07-12 05:54:37 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v+7Z7N7h+Q6G+gozP+AKW+6oU+767o7U+ff3b+p9R+2cg+tpV+oSO+8+C+vfT+HA:v+7Z7N7h+Q6G+gozP+AKW+6oU+767o7w
TLSH	T1745191C542644C3D2C67EA13E6F642383482A5629EE17F95DBC4BEF93B8ED143248753
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://104.164.104.15/hiddenbin/boatnet.x86	1f5d03c5318947ab738e23a68b37e0626786af55a80eedc8d062136cd0ef1843	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.mips	bdc6bd5c9dfd922972d884b211b6f4c77941d42d0880dacd694baa1709846f8f	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.arc	9766ebb23b426170c310a2c8cc30aad8859d1f7fd77c18414af5e41b553f8262	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://104.164.104.15/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://104.164.104.15/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://104.164.104.15/hiddenbin/boatnet.mpsl	14d0d85738a4aabfcb9132d638ced96fd52f26606a588efb196ddb2eb348a27d	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.arm	f3adc8c087398203b3b2707a0a495871351024669e5b004736b0e5165e0896a6	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.arm5	0729ef02769920beb437f560b20f9e0ffd42c6d1897bda24036bbb5f0ead26c2	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.arm6	c71dce36e1bfb040b6ed1b47a9bcad03fb3cd76eae743e6a0dd2f5eb1d9ef283	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.arm7	3c8340230b57d8a58b506f8a4aa805023ccd6a27ad5513ccedf9a17d95c9b558	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.ppc	725b11382108ecbf7f502fb72af99a113fa59d00e62e58c351ef5df875b5b636	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.spc	138224c13af0de8c8ed274f2644976102b0e41f3f5f7523e58b6364406fd7e85	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.m68k	34a673dd99a858d01f92650a1fe20cf8927064ee0f448dca9a570ebde6d13bdd	Mirai	elf mirai ua-wget
http://104.164.104.15/hiddenbin/boatnet.sh4	6f5aafc550615a7446b2bc08cff02a7b42763b3ce2e66130f8c1b9aa7d67483a	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6871f8e0900df8e7f86a0a96linux22vpnfull_triage

Tags:

trojandownloader downloader agent

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/2b6be4f9-677e-4d97-a358-34215737aa6d

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fe76c6c965dc7d0be02f485bd7fa1876a5597e9548fb6612ce0ef3ee98061860

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fe76c6c965dc7d0be02f485bd7fa1876a5597e9548fb6612ce0ef3ee98061860/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-07-12 05:55:37 UTC

File Type:

Text (Shell)

AV detection:

24 of 38 (63.16%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7z3mnslf3r6qxybpjbn5p6qyo2svs7uvjd5wmewob3z65gagdbqa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250712-gmq7wswzhy/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/fe76c6c965dc7d0be02f485bd7fa1876a5597e9548fb6612ce0ef3ee98061860

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.