user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat TrojanDownloader:Linux/SAgnt.G!MTB
TrojanDownloader:Linux/SAgnt.G!MTB - Windows Defender threat signature analysis

TrojanDownloader:Linux/SAgnt.G!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: TrojanDownloader:Linux/SAgnt.G!MTB
Classification:
Type:TrojanDownloader
Platform:Linux
Family:SAgnt
Detection Type:Concrete
Known malware family with identified signatures
Variant:G
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan Downloader - Downloads additional malware for Linux platform, family SAgnt

Summary:

TrojanDownloader:Linux/SAgnt.G!MTB is a downloader detected on a Linux system. Despite its platform, the associated technical indicators suggest its primary function is to download and execute malicious payloads on Windows systems, utilizing native tools like PowerShell, Rundll32, and Scheduled Tasks for execution and persistence.

Severity:
Medium
VDM Static Detection:
Relevant strings associated with this threat:
 - gq|#TEL (NID)
 - gq}#TEL (NID)
 - ToBase64String (PEHSTR_EXT)
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - WH_DEBUG (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - regsvr32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - ENIGMA (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: bwwg
cd0d6a6646e3d1b9192d4362cfc014e30f225e8a679f4da548a8f5ee6aff6cce
21/11/2025
→VirusTotal↓Download Sample
Filename: wwg
df4fe36ee361e1507c096e54d46ecea644c962ae3aaad9b03cb5aa4f5eb7785e
21/11/2025
→VirusTotal↓Download Sample
Filename: ccl
9a0e2a443cc6e7ef86280342bea30543bf40a44df83f97400c28f3b4f1c0fb62
21/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the compromised Linux system from the network. Identify and remove the malicious file and any associated persistence mechanisms (e.g., cron jobs, systemd services). Scan all Windows endpoints on the network for malicious payloads that may have been deployed from this host and investigate for signs of lateral movement.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 21/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊