user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:Linux/Mirai.GB!MTB
Backdoor:Linux/Mirai.GB!MTB - Windows Defender threat signature analysis

Backdoor:Linux/Mirai.GB!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:Linux/Mirai.GB!MTB
Classification:
Type:Backdoor
Platform:Linux
Family:Mirai
Detection Type:Concrete
Known malware family with identified signatures
Variant:GB
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family Mirai

Summary:

This detection indicates a Mirai variant, specifically Mirai.GB, targeting a Linux system, identified through behavioral analysis (!MTB). Mirai malware typically establishes a backdoor on compromised IoT devices or Linux servers, enrolling them into a botnet used to launch distributed denial-of-service (DDoS) attacks.

Severity:
Medium
VDM Static Detection:
No specific strings found for this threat
YARA Rule:
rule Backdoor_Linux_Mirai_GB_2147907428_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Backdoor:Linux/Mirai.GB!MTB"
        threat_id = "2147907428"
        type = "Backdoor"
        platform = "Linux: Linux platform"
        family = "Mirai"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "2"
        strings_accuracy = "Low"
    strings:
        $x_1_1 = {61 ff 00 00 08 28 2d 40 ff f8 61 ff 00 00 07 a6 2d 40 ff fc 20 2e ff f8 b0 ae ff fc ?? ?? 70 01 2d 40 ff ec}  //weight: 1, accuracy: Low
        $x_1_2 = {4e 56 ff ec 61 ff 00 00 08 8a 2d 40 ff f0 61 ff 00 00 08 08 2d 40 ff f4 20 2e ff f0 b0 ae ff f4 ?? ?? 70 01 2d 40 ff ec}  //weight: 1, accuracy: Low
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
Filename: zerm68k
dbd962339ad6d9573d4a2ab32a8374dfc4759a2ed25e1c11bcf0fb15c38a783e
27/01/2026
→VirusTotal↓Download Sample
Filename: zerm68k
434cd56194c113e0f8aff30ec957050758f02fde33b07ed8314fc90e757318c4
27/01/2026
→VirusTotal↓Download Sample
Filename: nklm68k
df416e33fd0768b5385fa8fc02b91175ca2f103aa79c49817dac0d76cb9ddd69
27/01/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the affected Linux device from the network. Eradicate the malware, which often requires a full system re-image or thorough manual cleanup. Patch all system and application vulnerabilities, enforce strong, unique passwords, and disable unnecessary services to prevent re-infection.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 27/01/2026. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊