Very nasty Linux backdoor with multiple components virustotal.com/gui/file/c69ee
- Kills & uninstalls AV: clamav, avast, avg, drweb, esets
- Very persistent
- Uses Gates malware
- Uses Brootkit
- Uses CVE-2016-5195 to get root
- Infects other systems from known_hosts, .bash_history
16
420
837

