Backdoor:Linux/Mirai.AU!xp - Windows Defender Threat Analysis

No specific strings found for this threat

rule Backdoor_Linux_Mirai_AU_2147818398_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Backdoor:Linux/Mirai.AU!xp"
        threat_id = "2147818398"
        type = "Backdoor"
        platform = "Linux: Linux platform"
        family = "Mirai"
        severity = "Critical"
        info = "xp: an internal category used to refer to some threats"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "4"
        strings_accuracy = "Low"
    strings:
        $x_2_1 = {2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f [0-32] 2f}  //weight: 2, accuracy: Low
        $x_1_2 = "TVWSVPVT" ascii //weight: 1
        $x_1_3 = "POST /cdn-cgi/" ascii //weight: 1
        $x_1_4 = "/dev/null" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (
            ((1 of ($x_2_*) and 2 of ($x_1_*))) or
            (all of ($x*))
        )
}