Not entirely sure about detection, but it seems like you could just add some "fake" indicators to your distro to make it look like it's a VM instance and the tr

Not entirely sure about detection, but it seems like you could just add some "fake" indicators to your distro to make it look like it's a VM instance and the trojan will helpfully delete itself.