user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:Linux/Mirai.LR!MTB
Backdoor:Linux/Mirai.LR!MTB - Windows Defender threat signature analysis

Backdoor:Linux/Mirai.LR!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:Linux/Mirai.LR!MTB
Classification:
Type:Backdoor
Platform:Linux
Family:Mirai
Detection Type:Concrete
Known malware family with identified signatures
Variant:LR
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family Mirai

Summary:

Backdoor:Linux/Mirai.LR is a variant of the Mirai botnet malware which targets Linux systems, often found within WSL or as staged files on Windows. It spreads by scanning for and brute-forcing weak credentials on IoT devices and servers, incorporating them into a botnet used for DDoS attacks. The '!MTB' suffix indicates this was identified by a machine learning model based on its behavior.

Severity:
Medium
VDM Static Detection:
No detailed analysis available from definition files.
Known malware which is associated with this threat:
Filename: nabmips
dbee10b17caefc5c607b0d6595801b049e770b89b020a4d80bb4fda714f3b088
07/12/2025
→VirusTotal↓Download Sample
Filename: nabmpsl
053a85f47ec4437ad7ef11ccbda0dcfb73a80ff698fcd27af171087c0613beff
07/12/2025
→VirusTotal↓Download Sample
Filename: nklmips
61eb1c5f9942b95b8ffbdf2f1267e7719d53c6cb5985d78767ab00c5d0e51cad
07/12/2025
→VirusTotal↓Download Sample
Filename: arm7
547d1e75421bbbfe0492e2191417ad070d3e1e40db837e9aa4737c7946cd67b7
03/12/2025
→VirusTotal↓Download Sample
Filename: aarch64
04ffe48e0d7b5fbdab26c29cb6a3f85aa60fd3f3fb78573f17ef49e25409e2af
01/12/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the affected system or WSL instance from the network. Quarantine and remove the detected file. Immediately change all user and root passwords to strong, unique values, and review system logs for any unauthorized access or outbound connections.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 09/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊