Backdoor:Linux/Mirai.LQ!MTB - Windows Defender Threat Analysis

This threat represents a concrete detection of a Mirai botnet variant, specifically 'LQ', targeting Linux systems. Mirai malware typically exploits vulnerabilities to establish a backdoor, allowing remote control and enlisting the compromised device into a botnet for launching Distributed Denial of Service (DDoS) attacks. The detection is further strengthened by machine learning behavioral analysis, indicating a high confidence malicious behavior.

No specific strings found for this threat

rule Backdoor_Linux_Mirai_LQ_2147951879_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Backdoor:Linux/Mirai.LQ!MTB"
        threat_id = "2147951879"
        type = "Backdoor"
        platform = "Linux: Linux platform"
        family = "Mirai"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "4"
        strings_accuracy = "High"
    strings:
        $x_2_1 = {00 00 51 e3 01 10 41 e2 0f 00 00 da 01 e0 d4 e4 00 c0 d5 e7 41 30 4e e2 41 20 4c e2 19 00 53 e3 60 e0 8e 93 19 00 52 e3 60 c0 8c 93 0c 00 5e e1 01 00 80 e2 00 00 a0 13 f0 ff ff 1a 06 00 50 e1 ee ff ff 1a 04 00 67 e0 f0 80 bd e8}  //weight: 2, accuracy: High
        $x_2_2 = {00 30 d0 e5 00 00 53 e3 03 c0 a0 01 04 00 00 0a 00 c0 a0 e3 01 c0 8c e2 00 30 dc e7 00 00 53 e3 fb ff ff 1a 00 30 d1 e5 00 00 53 e3 03 20 a0 01 04 00 00 0a 00 20 a0 e3 01 20 82 e2 01 30 d2 e7 00 00 53 e3 fb ff ff 1a 0c 00 52 e1 02 c0 a0 01 07 00 00 0a 00 00 a0 e3 0e f0 a0 e1}  //weight: 2, accuracy: High
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}

Immediately isolate the affected Linux system to prevent further network compromise. Utilize updated endpoint protection software to scan and thoroughly remove the Mirai malware. Patch all system vulnerabilities, enforce strong, unique passwords for all accounts and network-connected devices, and implement network segmentation with firewall rules to block known Mirai command-and-control (C2) traffic.