user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:Linux/Mirai.GS!MTB
Backdoor:Linux/Mirai.GS!MTB - Windows Defender threat signature analysis

Backdoor:Linux/Mirai.GS!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:Linux/Mirai.GS!MTB
Classification:
Type:Backdoor
Platform:Linux
Family:Mirai
Detection Type:Concrete
Known malware family with identified signatures
Variant:GS
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family Mirai

Summary:

This threat is a variant of the Mirai botnet malware, designed to infect Linux-based systems like IoT devices. The infected device is then incorporated into a botnet to participate in large-scale Distributed Denial of Service (DDoS) attacks. This specific detection was triggered by a machine learning model analyzing the file's behavior.

Severity:
Medium
VDM Static Detection:
No specific strings found for this threat
YARA Rule:
rule Backdoor_Linux_Mirai_GS_2147913427_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Backdoor:Linux/Mirai.GS!MTB"
        threat_id = "2147913427"
        type = "Backdoor"
        platform = "Linux: Linux platform"
        family = "Mirai"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "2"
        strings_accuracy = "Low"
    strings:
        $x_1_1 = {00 95 04 20 80 0f 00 00 00 60 45 20 00 0c 00 b5 94 ?? 0f 85 42 20 40 00 0f a5 ?? ?? f0 a5 40 25 00 1e 2f 27 0c 10 15 0f 92 10 8a 20 81 18 81 d9 01 da 00 db 6f 22 3f 00}  //weight: 1, accuracy: Low
        $x_1_2 = {0b 20 00 a4 ae 01 04 00 04 26 80 1f 00 00 03 80 01 68 21 6f 04 79 99 09 21 80 04 1d 00 14 06 26 c0 73 00 00 00 04 cb 78 ?? ?? 04 27 8f 1f 00 00 00 80 e5 7e 44 26 c0 10 20 95 01 68 47 20 c0 00 14 68 04 21 81 0f 00 00 00 20 04 26 8e 1f ff ff 00 84}  //weight: 1, accuracy: Low
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
Filename: nwfaiehg4ewijfgriehgirehaughrarg.arc
49706f08e21ef6e66d89bcf96ee360a0aee4722f4c4a132500fbce8a34f02cbc
07/12/2025
→VirusTotal↓Download Sample
Filename: nwfaiehg4ewijfgriehgirehaughrarg.arc
38c706c7f53415b957a10b9602de9a31418684e5ab213f26e35af857c7790e7c
07/12/2025
→VirusTotal↓Download Sample
Filename: boatnet.arc
fbfe556c69e1aa5011126241d906a8bc18fd5d69ce69e9a3efcf12c8288d47fb
19/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the affected device from the network. Re-image the system or perform a factory reset to ensure complete removal. Harden the device by changing all default credentials, disabling unnecessary services like Telnet, and applying the latest security patches and firmware updates to prevent reinfection.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 19/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊