user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat TrojanDownloader:Linux/SAgnt!MTB
TrojanDownloader:Linux/SAgnt!MTB - Windows Defender threat signature analysis

TrojanDownloader:Linux/SAgnt!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: TrojanDownloader:Linux/SAgnt!MTB
Classification:
Type:TrojanDownloader
Platform:Linux
Family:SAgnt
Detection Type:Concrete
Known malware family with identified signatures
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan Downloader - Downloads additional malware for Linux platform, family SAgnt

Summary:

This detection identifies TrojanDownloader:Linux/SAgnt!MTB, a Linux-targeting trojan downloader leveraging machine learning behavioral analysis. It is designed to fetch and execute additional malicious payloads, establish persistence mechanisms, and potentially employ sophisticated evasion techniques such as process injection and data encoding. The threat utilizes common system utilities and techniques for file operations, task scheduling, and network interactions.

Severity:
Medium
VDM Static Detection:
Relevant strings associated with this threat:
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: setup_runnv_miner.txt
7029b7bf7611129f442d3243fbe467bc4df7f13db452ed4a5624ed2784e80bc6
16/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the affected Linux system, perform a comprehensive scan with a reputable Linux antivirus, and remove all detected malicious components. Investigate for persistence mechanisms (e.g., cron jobs, systemd units) and any downloaded secondary payloads, then harden the system against similar future attacks.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 16/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊