user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:Linux/Mirai!rfn
Backdoor:Linux/Mirai!rfn - Windows Defender threat signature analysis

Backdoor:Linux/Mirai!rfn - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:Linux/Mirai!rfn
Classification:
Type:Backdoor
Platform:Linux
Family:Mirai
Detection Type:Concrete
Known malware family with identified signatures
Suffix:!rfn
Specific ransomware family name
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family Mirai

Summary:

Backdoor:Linux/Mirai!rfn is a variant of the Mirai botnet malware. Although running on a Linux system, this variant is equipped with capabilities to scan for and exploit vulnerable Microsoft SQL (MSSQL) servers, enabling it to spread to Windows environments and add them to the botnet.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - /ver.txt (PEHSTR_EXT)
 - /update.txt (PEHSTR_EXT)
 - http://%s:8888/ (PEHSTR_EXT)
 - \msinfo.exe (PEHSTR_EXT)
 - /delete /f /tn msinfo (PEHSTR_EXT)
 - //%s:8888/ups.rar (PEHSTR_EXT)
 - //%s:8888/wpd.dat (PEHSTR_EXT)
 - //%s:8888/wpdmd5.txt (PEHSTR_EXT)
 - //down2.b5w91.com:8443 (PEHSTR_EXT)
 - /shell?%s (PEHSTR_EXT)
 - ;exec sp_add_jobserver (PEHSTR_EXT)
 - ;EXEC sp_droplogin (PEHSTR_EXT)
 - ;exec(@a); (PEHSTR_EXT)
 - <sip:carol@chicago.com> (PEHSTR_EXT)
 - @name='bat.exe',@freq_type=4,@active_start_date (PEHSTR_EXT)
 - @shell INT EXEC SP_ (PEHSTR_EXT)
 - [Cracker:MSSQL] Host:%s, blindExec CMD: %s (PEHSTR_EXT)
 - [ExecCode] (PEHSTR_EXT)
 - [ExecCode]AUTHORIZATION [dbo] FROM 0x4D5A (PEHSTR_EXT)
 - \Run','rundll32'; (PEHSTR_EXT)
 - C:\Progra~1\kugou2010&attrib (PEHSTR_EXT)
 - C:\Progra~1\mainsoft&attrib (PEHSTR_EXT)
 - C:\Progra~1\shengda&attrib (PEHSTR_EXT)
 - cmd3:[%s] (PEHSTR_EXT)
 - DROP ASSEMBLY ExecCode (PEHSTR_EXT)
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: 9a441a3b1c8da58b30543d91e1cb82bb8609a0f60b4c942d2696c23b9748863a
9a441a3b1c8da58b30543d91e1cb82bb8609a0f60b4c942d2696c23b9748863a
05/10/2026
→VirusTotal↓Download Sample
Filename: abb2c49a2cd2138aa82e13c87dd5d9b2957afac56325df9b4bfe9f4be11d5d91
abb2c49a2cd2138aa82e13c87dd5d9b2957afac56325df9b4bfe9f4be11d5d91
05/10/2026
→VirusTotal↓Download Sample
Filename: cf68e31b765dca742813f6d799d42a3aa0f5db390dfb787239a5c50d127b9fa2
cf68e31b765dca742813f6d799d42a3aa0f5db390dfb787239a5c50d127b9fa2
05/10/2026
→VirusTotal↓Download Sample
Filename: 2571f3fa3054da51c16e698cb1578ab9405c80a34172874bdb56dd7df98b0be1
2571f3fa3054da51c16e698cb1578ab9405c80a34172874bdb56dd7df98b0be1
05/10/2026
→VirusTotal↓Download Sample
Filename: 761e2fb33456b4c15d42998fe7cb5c51637f5f6bb8615c77ca2e7651f810bbb6
761e2fb33456b4c15d42998fe7cb5c51637f5f6bb8615c77ca2e7651f810bbb6
05/10/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the compromised Linux host to prevent further scanning and lateral movement. Investigate network logs for outbound connections to MSSQL servers (port 1433). Scan and patch all MSSQL servers for vulnerabilities, ensure strong 'sa' passwords, and block the identified command-and-control domains at the network perimeter.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 16/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊