user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:Linux/Rekobee
Backdoor:Linux/Rekobee - Windows Defender threat signature analysis

Backdoor:Linux/Rekobee - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:Linux/Rekobee
Classification:
Type:Backdoor
Platform:Linux
Family:Rekobee
Detection Type:Concrete
Known malware family with identified signatures
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family Rekobee

Summary:

Backdoor:Linux/Rekobee is a concrete detection of a malicious program that provides unauthorized remote access and control over compromised Linux systems. While the analysis includes Windows-specific strings, the primary target platform is Linux, enabling attackers to execute commands, exfiltrate data, and establish persistence.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
YARA Rule:
rule Backdoor_Linux_Rekobee_2147773042_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Backdoor:Linux/Rekobee"
        threat_id = "2147773042"
        type = "Backdoor"
        platform = "Linux: Linux platform"
        family = "Rekobee"
        severity = "Critical"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "5"
        strings_accuracy = "Low"
    strings:
        $x_4_1 = {c6 00 2f c6 40 04 2f c6 40 01 62 (c6 40|48 8d 70 05 c6) [0-5] c6 40 02 69 c6 40 06 68 [0-3] c6 40 03 6e c6 40 07 00 [0-23] e8}  //weight: 4, accuracy: Low
        $x_1_2 = {be 14 54 00 00 31 01 be e8}  //weight: 1, accuracy: Low
        $x_1_3 = {68 14 54 00 00 [0-49] e8}  //weight: 1, accuracy: Low
        $x_1_4 = {c7 44 24 04 14 54 00 00 [0-49] e8}  //weight: 1, accuracy: Low
        $x_4_5 = {c6 00 48 c6 40 05 49 c6 40 01 49 c6 40 06 4c c6 40 02 53 c6 40 07 45 c6 40 03 54 c6 40 08 3d c6 40 04 46 c6 40 09 00}  //weight: 4, accuracy: High
    condition:
        (filesize < 20MB) and
        (
            ((1 of ($x_4_*) and 1 of ($x_1_*))) or
            ((2 of ($x_4_*))) or
            (all of ($x*))
        )
}
Known malware which is associated with this threat:
Filename: d
8068546fc20f0be3935f49dfcd0938b18ea2828427fd10902bd33ffd517ac5e3
23/06/2026
→VirusTotal↓Download Sample
Filename: n
672fef6902b0e20024f0af11f62f7a13c14db045ac418e5fab6f7c9beaa44977
23/06/2026
→VirusTotal↓Download Sample
Filename: e6f73e0919bc69b64ee445164c1706f42147d6f81d39d0fd0d688db92ef82905
e6f73e0919bc69b64ee445164c1706f42147d6f81d39d0fd0d688db92ef82905
13/12/2025
→VirusTotal↓Download Sample
Filename: e3ed539264312df5181b6ca9d8cbf7b0473d4df89983fdcaf2be0d6b26b2f19f
e3ed539264312df5181b6ca9d8cbf7b0473d4df89983fdcaf2be0d6b26b2f19f
13/12/2025
→VirusTotal↓Download Sample
Filename: ab1dff368dc04f2d04254973dc801b35ba8c49d14299a2526db80a7759ba5ae6
ab1dff368dc04f2d04254973dc801b35ba8c49d14299a2526db80a7759ba5ae6
13/12/2025
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate any affected Linux systems to prevent further compromise. Conduct a full scan to remove the Rekobee backdoor and perform a comprehensive forensic investigation to identify the infection vector, any lateral movement, and potential data exfiltration. Review system logs, network activity, and user accounts for unusual behavior. Apply all available security patches and implement robust endpoint detection and response (EDR) solutions on Linux hosts.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 10/12/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊