t0rn_rootkit: Artifacts used by this malware
Query:
select * from file where path in ('/usr/src/.puta', '/usr/info/.t0rn', '/lib/ldlib.tk', '/etc/ttyhash', '/sbin/xlogin');Additional Query Info:
Platform: linux
Interval: 3600
JSON:
{ "queries": { "t0rn_rootkit": { "query" : "select * from file where path in ('/usr/src/.puta', '/usr/info/.t0rn', '/lib/ldlib.tk', '/etc/ttyhash', '/sbin/xlogin');", "interval" : "3600", "platform" : "linux", "version": "", "description" : "t0rn_rootkit", "value" : "Artifacts used by this malware" } } }