Backdoor:Linux/Mirai.DN!MTB

user@threatcheck.sh ~ threat-analysis

bash

$ analyze-threat Backdoor:Linux/Mirai.DN!MTB

Backdoor:Linux/Mirai.DN!MTB - Windows Defender threat signature analysis

$ cat analysis.txt

=== THREAT ANALYSIS REPORT ===

Threat Name: Backdoor:Linux/Mirai.DN!MTB

Classification:

Type:Backdoor

Platform:Linux

Family:Mirai

Detection Type:Concrete

Known malware family with identified signatures

Variant:DN

Specific signature variant within the malware family

Suffix:!MTB

Detected via machine learning and behavioral analysis

Detection Method:Behavioral

Confidence:Very High

False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family Mirai

Summary:

This threat is a backdoor from the Mirai malware family, which targets Linux-based systems and IoT devices. It infects systems by exploiting weak or default credentials, incorporating them into a botnet to conduct large-scale Distributed Denial of Service (DDoS) attacks.

Severity:

Medium

VDM Static Detection:

No specific strings found for this threat

YARA Rule:

rule Backdoor_Linux_Mirai_DN_2147828188_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Backdoor:Linux/Mirai.DN!MTB"
        threat_id = "2147828188"
        type = "Backdoor"
        platform = "Linux: Linux platform"
        family = "Mirai"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "4"
        strings_accuracy = "High"
    strings:
        $x_1_1 = {75 20 8b 29 89 c8 29 e8 8b 70 08 8b 50 0c 8b 4e 0c 39 c1 75 3d 39 4a 08 75 38 01 ef 89 56 0c 89 72 08}  //weight: 1, accuracy: High
        $x_1_2 = {83 c4 10 85 ff 74 19 31 c0 81 bc 24 a8 01 00 00 ff 64 cd 1d 0f 9f c0 03 84 24 a4 01 00 00}  //weight: 1, accuracy: High
        $x_1_3 = "/dev/null" ascii //weight: 1
        $x_1_4 = "TSource Engine Query" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}

Known malware which is associated with this threat: