user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:Linux/Gafgyt.BS!xp
Backdoor:Linux/Gafgyt.BS!xp - Windows Defender threat signature analysis

Backdoor:Linux/Gafgyt.BS!xp - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:Linux/Gafgyt.BS!xp
Classification:
Type:Backdoor
Platform:Linux
Family:Gafgyt
Detection Type:Concrete
Known malware family with identified signatures
Variant:BS
Specific signature variant within the malware family
Suffix:!xp
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family Gafgyt

Summary:

Backdoor:Linux/Gafgyt.BS!xp is a variant of the Gafgyt botnet malware targeting Linux-based systems, including servers and IoT devices. It compromises the device, incorporating it into a botnet to launch Distributed Denial-of-Service (DDoS) attacks and allowing a remote attacker to execute commands.

Severity:
Critical
VDM Static Detection:
No specific strings found for this threat
YARA Rule:
rule Backdoor_Linux_Gafgyt_BS_2147819149_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Backdoor:Linux/Gafgyt.BS!xp"
        threat_id = "2147819149"
        type = "Backdoor"
        platform = "Linux: Linux platform"
        family = "Gafgyt"
        severity = "Critical"
        info = "xp: an internal category used to refer to some threats"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "2"
        strings_accuracy = "High"
    strings:
        $x_1_1 = {a0 00 0b e5 a4 10 0b e5 a8 20 0b e5 ac 30 0b e5 00 30 a0 e3 9c 30 0b e5 a4 30 1b e5 98 30 0b e5 94 30 4b e2 10 30 0b e5 00 30 a0 e3 14 30 0b e5 06 00 00}  //weight: 1, accuracy: High
        $x_1_2 = {30 9f e5 00 10 93 e5 20 20 1b e5 24 30 1b e5 02}  //weight: 1, accuracy: High
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
Filename: SecuriteInfo.com.Linux.Siggen.9999.28503.16268
d753e3c32a09a9c6017db1b4908597c26d3479ac9d5450c5f47345adba598bbf
20/11/2025
→VirusTotal↓Download Sample
Filename: SecuriteInfo.com.Linux.Siggen.9999.2611.1182
39138c90dbb6276dce8b3637ead0b2f2f07b79427882255b2b582ad29c11740f
20/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the affected system from the network to prevent further malicious activity. Remove the detected file and conduct a full system scan. Investigate the initial access vector, change all credentials, and apply all available security patches to prevent reinfection.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 20/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊