user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:Linux/StealthWorker.A!MTB
Trojan:Linux/StealthWorker.A!MTB - Windows Defender threat signature analysis

Trojan:Linux/StealthWorker.A!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:Linux/StealthWorker.A!MTB
Classification:
Type:Trojan
Platform:Linux
Family:StealthWorker
Detection Type:Concrete
Known malware family with identified signatures
Variant:A
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for Linux platform, family StealthWorker

Summary:

This detection identifies a Linux trojan from the StealthWorker family, designed to perform brute-force attacks against services like SSH, FTP, and web hosting panels. Its presence on a Windows system suggests the file is likely dormant but poses a significant risk if transferred to or executed within a Linux environment, such as WSL.

Severity:
Medium
VDM Static Detection:
No specific strings found for this threat
YARA Rule:
rule Trojan_Linux_StealthWorker_A_2147832679_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Trojan:Linux/StealthWorker.A!MTB"
        threat_id = "2147832679"
        type = "Trojan"
        platform = "Linux: Linux platform"
        family = "StealthWorker"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_ELFHSTR_EXT"
        threshold = "4"
        strings_accuracy = "High"
    strings:
        $x_1_1 = "WorkerSSH_brut.check_honeypot" ascii //weight: 1
        $x_1_2 = "WorkerSSH_brut.SaveGood" ascii //weight: 1
        $x_1_3 = "WorkerHtpasswd_check" ascii //weight: 1
        $x_1_4 = "WorkerWHM_brut" ascii //weight: 1
        $x_1_5 = "WorkerFTP_check" ascii //weight: 1
        $x_1_6 = "WorkerHtpasswd_brut" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (4 of ($x*))
}
Known malware which is associated with this threat:
Filename: 3.47_Stub_Linux_x86
e9523148ccdda530ca539f31bc3b0a317f9dfba41c749c44b4d6e6e754f1f2a1
06/12/2025
→VirusTotal↓Download Sample
Filename: 3.47_Stub_Arm_x86
73fb46792fa9370eb9b26ff95a940cfd4176f4a0d7437801e344da65f2e02c1d
06/12/2025
→VirusTotal↓Download Sample
Remediation Steps:
1. Use your security software to quarantine and delete the detected file. 2. Investigate the file's origin (e.g., download, email, WSL instance) to understand the initial vector. 3. Perform a full system scan to check for any other related malicious components. 4. If the file was found on a network share or in WSL, investigate those environments for further signs of compromise.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 06/12/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊