user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:Linux/Gafgyt.AM!MTB
Backdoor:Linux/Gafgyt.AM!MTB - Windows Defender threat signature analysis

Backdoor:Linux/Gafgyt.AM!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:Linux/Gafgyt.AM!MTB
Classification:
Type:Backdoor
Platform:Linux
Family:Gafgyt
Detection Type:Concrete
Known malware family with identified signatures
Variant:AM
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family Gafgyt

Summary:

This detection identifies a Linux backdoor from the Gafgyt malware family, which is designed to add compromised systems to a botnet. This botnet is typically used to launch Distributed Denial-of-Service (DDoS) attacks and grant attackers remote control. Its detection on Windows suggests the malicious file may be located within the Windows Subsystem for Linux (WSL), a container, or was simply downloaded to the filesystem.

Severity:
Medium
VDM Static Detection:
No specific strings found for this threat
YARA Rule:
rule Backdoor_Linux_Gafgyt_AM_2147814366_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Backdoor:Linux/Gafgyt.AM!MTB"
        threat_id = "2147814366"
        type = "Backdoor"
        platform = "Linux: Linux platform"
        family = "Gafgyt"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "5"
        strings_accuracy = "High"
    strings:
        $x_1_1 = "botkill" ascii //weight: 1
        $x_1_2 = "telnetadmin" ascii //weight: 1
        $x_1_3 = "BOTNET" ascii //weight: 1
        $x_1_4 = "hunt5759" ascii //weight: 1
        $x_1_5 = "7ujMko0admin" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
a7e4a8a3e820f0694211d21228136a78b42e83c53d6a4635653d1b74ff182ce4
08/11/2025
→VirusTotal↓Download Sample
f8b9acbdcbeeb5d59c9d31788ef5f717fb62bf728ddae01584e29b6a33d89dc5
08/11/2025
→VirusTotal↓Download Sample
cc3b129045b9810dbd7012b6da00909028dafaa42b60fe2ea143c8ebea4b5fb1
08/11/2025
→VirusTotal↓Download Sample
1e63edf262d21d49fe667fd7ada520626abd9f4395202a1ebee9b9558340cc5f
08/11/2025
→VirusTotal↓Download Sample
ebb162680dc89cf4612c8bd690a26dd4c92f7386de0e9a2c026a095632a50446
08/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the system from the network to prevent command-and-control communication. Use Windows Defender to quarantine or remove the detected file and verify its removal. Investigate the entry point, especially within WSL or container environments, patch any related vulnerabilities, and change system credentials.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 08/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊