user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat VirTool:Linux/Sliver.A!MTB
VirTool:Linux/Sliver.A!MTB - Windows Defender threat signature analysis

VirTool:Linux/Sliver.A!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: VirTool:Linux/Sliver.A!MTB
Classification:
Type:VirTool
Platform:Linux
Family:Sliver
Detection Type:Concrete
Known malware family with identified signatures
Variant:A
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Virus Tool - Tool used to create or modify malware for Linux platform, family Sliver

Summary:

This detection identifies VirTool:Linux/Sliver.A!MTB, a Linux-based post-exploitation framework. It provides attackers with extensive remote access and command and control capabilities, enabling activities like session management, process manipulation, network reconnaissance, and data exfiltration, detected via concrete signatures and malicious behavioral patterns.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - sliverpb.Register.ActiveC2 (PEHSTR_EXT)
 - sliverpb.KillSessionReq (PEHSTR_EXT)
 - sliverpb.Register.PidPid (PEHSTR_EXT)
 - sliverpb.IfconfigReq (PEHSTR_EXT)
 - sliverpb.TerminateReq (PEHSTR_EXT)
 - sliverpb.NetInterfaces (PEHSTR_EXT)
 - /xc/load.go (PEHSTR_EXT)
 - main.bake (PEHSTR_EXT)
 - syscall/zsyscall_windows.go (PEHSTR_EXT)
 - sliverpb.NetInterface (PEHSTR_EXT)
 - sliverpb.WGSocksServer (PEHSTR_EXT)
 - sliverpb.PortfwdProtocol (PEHSTR_EXT)
 - sliverpb.WGTCPForwarder (PEHSTR_EXT)
 - .sliverpb.RegistryType (PEHSTR_EXT)
 - .sliverpb.WindowsPrivilegeEntryR (PEHSTR_EXT)
 - *sliverpb.Process (PEHSTR_EXT)
 - *sliverpb. (PEHSTR_EXT)
 - *sliverpb.Migrate (PEHSTR_EXT)
 - *sliverpb.Elevate (PEHSTR_EXT)
 - *sliverpb.Kill (PEHSTR_EXT)
 - H;a (PEHSTR_EXT)
 - |#d1e49aac-8f56-4280-b9ba-993a6d77406c (NID)
 - }#d1e49aac-8f56-4280-b9ba-993a6d77406c (NID)
 - &|#b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 (NID)
 - &}#b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 (NID)
 - y*|#56a863a9-875e-4185-98a7-b882c64b5ce5 (NID)
 - y*}#56a863a9-875e-4185-98a7-b882c64b5ce5 (NID)
 - C|#be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 (NID)
 - C}#be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 (NID)
 - L|#3b576869-a4ec-4529-8536-b80a7769e899 (NID)
 - L}#3b576869-a4ec-4529-8536-b80a7769e899 (NID)
 - |#5beb7efe-fd9a-4556-801d-275e5ffc04cc (NID)
 - }#5beb7efe-fd9a-4556-801d-275e5ffc04cc (NID)
 - |#01443614-cd74-433a-b99e-2ecdc07bfc25 (NID)
 - }#01443614-cd74-433a-b99e-2ecdc07bfc25 (NID)
 - |#d3e037e1-3eb8-44c8-a917-57927947596d (NID)
 - }#d3e037e1-3eb8-44c8-a917-57927947596d (NID)
 - |#7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c (NID)
 - }#7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c (NID)
 - |#92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b (NID)
 - }#92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b (NID)
YARA Rule:
rule VirTool_Linux_Sliver_A_2147888493_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "VirTool:Linux/Sliver.A!MTB"
        threat_id = "2147888493"
        type = "VirTool"
        platform = "Linux: Linux platform"
        family = "Sliver"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "3"
        strings_accuracy = "High"
    strings:
        $x_1_1 = "ScreenshotReq" ascii //weight: 1
        $x_1_2 = "SSHCommandReq" ascii //weight: 1
        $x_1_3 = "runtime.persistentalloc" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
Filename: update
3633dddcaf46a323cbcad2d7dbc8e4a5a3405d0346eda8c916b1298d905fbbc3
14/01/2026
→VirusTotal↓Download Sample
Filename: update
e3d5dec266eadd53bd507d450e556aafe6707e936f45f92b6e4a25b9fd571e75
14/01/2026
→VirusTotal↓Download Sample
Filename: update
adaaebe10e8686a0e05ab0b1b07ed86731d65b1ce5b4488d7dca47bca5fa2443
14/01/2026
→VirusTotal↓Download Sample
Filename: updatea
e2af492aa9a1d034518023323f999627f42f1cfa7618cbf3d10565d28859185d
14/01/2026
→VirusTotal↓Download Sample
Filename: implant_amd64
38e0b2c4756bcb35c8405502f29b0b447a849e795e11ec24ef058ae2489e0452
11/01/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the affected Linux system. Perform a comprehensive forensic analysis to identify the initial compromise, lateral movement, and any backdoors. Remove the threat, patch all vulnerabilities, strengthen authentication, and monitor for further suspicious activity.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 14/12/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊