user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:Linux/SAgnt!MSR
Backdoor:Linux/SAgnt!MSR - Windows Defender threat signature analysis

Backdoor:Linux/SAgnt!MSR - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:Linux/SAgnt!MSR
Classification:
Type:Backdoor
Platform:Linux
Family:SAgnt
Detection Type:Concrete
Known malware family with identified signatures
Suffix:!MSR
High-priority threat flagged by Microsoft Security Response
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for Linux platform, family SAgnt

Summary:

Backdoor:Linux/SAgnt!MSR is a concrete detection of a backdoor designed to gain persistent remote access and control over Linux systems. The presence of numerous Windows-specific utility strings suggests potential multi-platform capabilities, advanced evasion techniques, or the ability to deploy secondary payloads.

Severity:
High
VDM Static Detection:
Relevant strings associated with this threat:
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: lbdJkIHQ5p
3c45b91ac9d4eb5d058a16af2719b7b1acdcd2f59b177de8ce1f9fbc01e423bd
31/01/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the affected Linux system, remove the detected malware, and thoroughly scan for any persistence mechanisms (e.g., cron jobs, systemd units) or additional compromised files. Investigate for lateral movement, revoke and reset any compromised credentials, and enhance endpoint detection and network monitoring to prevent re-infection.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 31/01/2026. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊