user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:Linux/Mirai.HQ!MTB
Backdoor:Linux/Mirai.HQ!MTB - Windows Defender threat signature analysis

Backdoor:Linux/Mirai.HQ!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:Linux/Mirai.HQ!MTB
Classification:
Type:Backdoor
Platform:Linux
Family:Mirai
Detection Type:Concrete
Known malware family with identified signatures
Variant:HQ
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family Mirai

Summary:

This detection identifies a backdoor from the Mirai malware family, a botnet that primarily infects Linux-based systems and IoT devices. The infected system is then controlled by a remote server and used to participate in large-scale Distributed Denial of Service (DDoS) attacks.

Severity:
High
VDM Static Detection:
No specific strings found for this threat
YARA Rule:
rule Backdoor_Linux_Mirai_HQ_2147907547_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Backdoor:Linux/Mirai.HQ!MTB"
        threat_id = "2147907547"
        type = "Backdoor"
        platform = "Linux: Linux platform"
        family = "Mirai"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "5"
        strings_accuracy = "High"
    strings:
        $x_1_1 = {64 42 9f e5 00 00 a0 e3 02 19 a0 e3 7e ff ff eb 01 00 a0 e3 04 10 a0 e1 7b ff ff eb 04 10 a0 e1 02 00 a0 e3 78 ff ff eb 04 00 9d e5 3c 32 9f e5 00 20 90 e5 00 10 9d e5 03 20 81 e7 00 40 90 e5 00 00 54 e3 0d 00 00 0a 24 32 9f e5 03 30 91 e7 00 40 83 e5 2f 10 a0 e3}  //weight: 1, accuracy: High
        $x_4_2 = {5c 31 9f e5 00 10 9d e5 03 20 91 e7 02 30 a0 e1 00 00 53 e3 03 00 00 0a 0f e0 a0 e1 12 ff 2f e1 00 30 a0 e3 00 30 80 e5 10 00 8d e2 9c 00 00 eb 00 00 50 e3 12 00 00 1a a2 00 00 eb}  //weight: 4, accuracy: High
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
Filename: n8
554cb7af5469c5d2154f0f7c74cf50c4af15cbb7c652a47c5d9b40cb03a3579c
13/12/2025
→VirusTotal↓Download Sample
Filename: n8
0ebe2ca14a0ecfef86cc3e8efc1611c3ca581992a78e889126585950e7d1dd82
12/12/2025
→VirusTotal↓Download Sample
Filename: nabarm7
defdc05bda40e0a72fba993a34fc10a62691e98d771731767d1893f7ced923ee
12/12/2025
→VirusTotal↓Download Sample
Filename: nabarm7
d893f3c968c6c6f01196a102274420b992d8ff3c0e9da740bd8548add4e8e230
11/12/2025
→VirusTotal↓Download Sample
Filename: h437
8067c9bf0ca1a67352fc7b8c9cc99fed8d9f3f57246712a6cd692edc4b66d323
08/12/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the affected system from the network immediately to prevent command-and-control communication. Re-image the device from a trusted source or restore from a known-clean backup. Harden the system by changing all default credentials, disabling unnecessary services, and applying the latest security patches.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 23/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊