user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:Linux/Rekobee
Backdoor:Linux/Rekobee - Windows Defender threat signature analysis

Backdoor:Linux/Rekobee - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:Linux/Rekobee
Classification:
Type:Backdoor
Platform:Linux
Family:Rekobee
Detection Type:Concrete
Known malware family with identified signatures
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family Rekobee

Summary:

Backdoor:Linux/Rekobee is a concrete detection of a malicious program that provides unauthorized remote access and control over compromised Linux systems. While the analysis includes Windows-specific strings, the primary target platform is Linux, enabling attackers to execute commands, exfiltrate data, and establish persistence.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
YARA Rule:
rule Backdoor_Linux_Rekobee_2147773042_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Backdoor:Linux/Rekobee"
        threat_id = "2147773042"
        type = "Backdoor"
        platform = "Linux: Linux platform"
        family = "Rekobee"
        severity = "Critical"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "5"
        strings_accuracy = "Low"
    strings:
        $x_4_1 = {c6 00 2f c6 40 04 2f c6 40 01 62 (c6 40|48 8d 70 05 c6) [0-5] c6 40 02 69 c6 40 06 68 [0-3] c6 40 03 6e c6 40 07 00 [0-23] e8}  //weight: 4, accuracy: Low
        $x_1_2 = {be 14 54 00 00 31 01 be e8}  //weight: 1, accuracy: Low
        $x_1_3 = {68 14 54 00 00 [0-49] e8}  //weight: 1, accuracy: Low
        $x_1_4 = {c7 44 24 04 14 54 00 00 [0-49] e8}  //weight: 1, accuracy: Low
        $x_4_5 = {c6 00 48 c6 40 05 49 c6 40 01 49 c6 40 06 4c c6 40 02 53 c6 40 07 45 c6 40 03 54 c6 40 08 3d c6 40 04 46 c6 40 09 00}  //weight: 4, accuracy: High
    condition:
        (filesize < 20MB) and
        (
            ((1 of ($x_4_*) and 1 of ($x_1_*))) or
            ((2 of ($x_4_*))) or
            (all of ($x*))
        )
}
Known malware which is associated with this threat:
Filename: e6f73e0919bc69b64ee445164c1706f42147d6f81d39d0fd0d688db92ef82905
e6f73e0919bc69b64ee445164c1706f42147d6f81d39d0fd0d688db92ef82905
13/12/2025
→VirusTotal↓Download Sample
Filename: e3ed539264312df5181b6ca9d8cbf7b0473d4df89983fdcaf2be0d6b26b2f19f
e3ed539264312df5181b6ca9d8cbf7b0473d4df89983fdcaf2be0d6b26b2f19f
13/12/2025
→VirusTotal↓Download Sample
Filename: ab1dff368dc04f2d04254973dc801b35ba8c49d14299a2526db80a7759ba5ae6
ab1dff368dc04f2d04254973dc801b35ba8c49d14299a2526db80a7759ba5ae6
13/12/2025
→VirusTotal↓Download Sample
Filename: aafe32438951f9cfed717a15ef5ec607cb34ce0e4590c9790cdd87ed000b33d5
aafe32438951f9cfed717a15ef5ec607cb34ce0e4590c9790cdd87ed000b33d5
13/12/2025
→VirusTotal↓Download Sample
Filename: 0bc65a55a84d1b2e2a320d2b011186a14f9074d6d28ff9120cb24fcc03c3f696
0bc65a55a84d1b2e2a320d2b011186a14f9074d6d28ff9120cb24fcc03c3f696
13/12/2025
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate any affected Linux systems to prevent further compromise. Conduct a full scan to remove the Rekobee backdoor and perform a comprehensive forensic investigation to identify the infection vector, any lateral movement, and potential data exfiltration. Review system logs, network activity, and user accounts for unusual behavior. Apply all available security patches and implement robust endpoint detection and response (EDR) solutions on Linux hosts.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 10/12/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊