user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:Linux/Mirai!AMTB
Trojan:Linux/Mirai!AMTB - Windows Defender threat signature analysis

Trojan:Linux/Mirai!AMTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:Linux/Mirai!AMTB
Classification:
Type:Trojan
Platform:Linux
Family:Mirai
Detection Type:Concrete
Known malware family with identified signatures
Suffix:!AMTB
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for Linux platform, family Mirai

Summary:

This is a concrete detection of a Linux-based Trojan from the Mirai botnet family. The malware infects Linux systems to enslave them for Distributed Denial-of-Service (DDoS) attacks. Evidence suggests this variant also contains capabilities to scan for and exploit Microsoft SQL Server vulnerabilities on Windows systems to propagate further within a network.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - /ver.txt (PEHSTR_EXT)
 - /update.txt (PEHSTR_EXT)
 - http://%s:8888/ (PEHSTR_EXT)
 - \msinfo.exe (PEHSTR_EXT)
 - /delete /f /tn msinfo (PEHSTR_EXT)
 - //%s:8888/ups.rar (PEHSTR_EXT)
 - //%s:8888/wpd.dat (PEHSTR_EXT)
 - //%s:8888/wpdmd5.txt (PEHSTR_EXT)
 - //down2.b5w91.com:8443 (PEHSTR_EXT)
 - /shell?%s (PEHSTR_EXT)
 - ;exec sp_add_jobserver (PEHSTR_EXT)
 - ;EXEC sp_droplogin (PEHSTR_EXT)
 - ;exec(@a); (PEHSTR_EXT)
 - <sip:carol@chicago.com> (PEHSTR_EXT)
 - @name='bat.exe',@freq_type=4,@active_start_date (PEHSTR_EXT)
 - @shell INT EXEC SP_ (PEHSTR_EXT)
 - [Cracker:MSSQL] Host:%s, blindExec CMD: %s (PEHSTR_EXT)
 - [ExecCode] (PEHSTR_EXT)
 - [ExecCode]AUTHORIZATION [dbo] FROM 0x4D5A (PEHSTR_EXT)
 - \Run','rundll32'; (PEHSTR_EXT)
 - C:\Progra~1\kugou2010&attrib (PEHSTR_EXT)
 - C:\Progra~1\mainsoft&attrib (PEHSTR_EXT)
 - C:\Progra~1\shengda&attrib (PEHSTR_EXT)
 - cmd3:[%s] (PEHSTR_EXT)
 - DROP ASSEMBLY ExecCode (PEHSTR_EXT)
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
YARA Rule:
rule Trojan_Linux_Mirai_AMTB_2147957847_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Trojan:Linux/Mirai!AMTB"
        threat_id = "2147957847"
        type = "Trojan"
        platform = "Linux: Linux platform"
        family = "Mirai"
        severity = "Critical"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "5"
        strings_accuracy = "High"
    strings:
        $x_1_1 = "fuser -k -n tcp %d 2>/dev/null" ascii //weight: 1
        $x_1_2 = "NFnhiFSDfdsfFSD" ascii //weight: 1
        $x_1_3 = "[locker] fcntl F_GETFL" ascii //weight: 1
        $x_1_4 = "[locker] fcntl F_SETFL" ascii //weight: 1
        $x_1_5 = "npxXoudifFeEgGaACScs" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
Filename: godisdead.8
e3f701ea1b5f8770d46bfa14c3a622fecea562f2586b652e7d7a1042e666b1ff
20/06/2026
→VirusTotal↓Download Sample
Filename: godisdead.1
8848dc31c6c08faf0617aa0f915e9e3833857a29a1fe0126d978b45f6c0ed1f7
20/06/2026
→VirusTotal↓Download Sample
Filename: godisdead.2
ea63c9e7f92a5f90ceb1e78a2f9e4d06910cf8234905ad3858e711767a109702
20/06/2026
→VirusTotal↓Download Sample
Filename: godisdead.13
889c9ae1ab2208fca436eeaa6790363b805a6da3fcf979daa85c269240cba02b
20/06/2026
→VirusTotal↓Download Sample
Filename: godisdead.2
c3068da9847a485086ca9a4f18c82b2ebabcc61a096bc42c7fa79c25f8d45bc4
14/06/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the infected Linux device from the network to prevent C2 communication and participation in DDoS attacks. Identify and terminate the malicious process, then delete the associated file. Review firewall and server logs for outbound scanning and exploitation attempts against Windows and MSSQL systems originating from this host. Change all credentials on the compromised device and ensure all services are patched and securely configured.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 01/12/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊