user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:Linux/SAgnt.Q!MTB
Trojan:Linux/SAgnt.Q!MTB - Windows Defender threat signature analysis

Trojan:Linux/SAgnt.Q!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:Linux/SAgnt.Q!MTB
Classification:
Type:Trojan
Platform:Linux
Family:SAgnt
Detection Type:Concrete
Known malware family with identified signatures
Variant:Q
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for Linux platform, family SAgnt

Summary:

This threat is a Trojan designed for Linux systems, identified as a variant of the SAgnt malware family. It likely functions as a backdoor or remote access agent, enabling attackers to execute commands, steal data, or deploy additional malware. The detection was made by a machine learning model based on the file's suspicious behavior.

Severity:
Medium
VDM Static Detection:
No specific strings found for this threat
YARA Rule:
rule Trojan_Linux_SAgnt_Q_2147928566_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Trojan:Linux/SAgnt.Q!MTB"
        threat_id = "2147928566"
        type = "Trojan"
        platform = "Linux: Linux platform"
        family = "SAgnt"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "2"
        strings_accuracy = "High"
    strings:
        $x_1_1 = {be a8 12 60 00 55 48 81 ee a8 12 60 00 48 c1 fe 03 48 89 e5 48 89 f0 48 c1 e8 3f 48 01 c6 48 d1 fe 74 15 b8 00 00 00 00 48 85 c0 74 0b 5d bf a8 12 60 00 ff e0 0f 1f 00 5d c3 66 0f 1f 44 00 00 80 3d a9 06 20 00 00 75 11 55 48 89 e5 e8 6e ff ff ff 5d c6 05 96 06 20 00 01 f3 c3 0f 1f 40 00 bf 10 10 60 00 48 83 3f 00 75 05 eb 93 0f 1f 00 b8 00 00 00 00 48 85 c0 74 f1 55 48 89 e5 ff d0 5d e9 7a ff ff ff}  //weight: 1, accuracy: High
        $x_1_2 = {e8 00 ff ff ff ff c0 75 0c bf 0a 00 00 00 e8 02 ff ff ff eb df 31 c9 ba 06 00 00 00 be e4 0c 40 00 89 df e8 2d fe ff ff 66 8b 44 24 1e 48 8d 74 24 02 31 c9 ba 02 00 00 00 89 df 88 44 24 02 66 c1 e8 08 88 44 24 03 e8 09 fe ff ff 48 8d 74 24 2f 31 c9 ba 20 00 00 00 89 df e8 f6 fd ff ff 31 d2 31 c0 be eb 0c 40 00 bf 3f 01 00 00 e8 43 fe ff ff 85 c0 41 89 c4}  //weight: 1, accuracy: High
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
Filename: tcp_linux_amd64
32bb87fd237a963945bd848a9985fe4c3fb3ec86d38136355ee997becf258d1a
07/12/2025
→VirusTotal↓Download Sample
Filename: linux_amd64
62e9a01307bcf85cdaeecafd6efb5be72a622c43a10f06d6d6d3b566b072228d
06/12/2025
→VirusTotal↓Download Sample
Filename: update
cfe5c46e00babe4c91135cb2ec89852b764b1c255f3c6a220bf90f35aac3dff8
18/11/2025
→VirusTotal↓Download Sample
8ad5ab76715dc232abb93983a295713872af9488037383c73a2f96f9fe6b63b2
07/11/2025
→VirusTotal↓Download Sample
344c391cfd4fd30407bf55872d05d44b679a117e407114c0e113b3c6c4cbbb29
07/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the affected system or environment (e.g., WSL, container). Use the security tool to remove the threat, then scan for any related malicious activity or persistence. Investigate the source of the file to prevent re-infection.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 08/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊