Moreover it also seems to target a specific kernel version [which is used by the latest debian 4bit] , from the securelist [1] article: 'The malware module was

Moreover it also seems to target a specific kernel version [which is used by the latest debian 4bit] , from the securelist [1] article: 'The malware module was specially designed for the kernel version 2.6.32-5-amd64, which happens to be the latest kernel used in 64-bit Debian Squeezy. The binary is more than 500k, but its size is due to the fact that it hasn't been stripped (i.e. it was compiled with the debugging information). Perhaps it's still in the development stage, because some of the functions don’t seem to be fully working or they are not fully implemented yet.' 1. https://www.securelist.com/en/blog/208193935/New_64_bit_Linux_Rootkit_Doing_iFrame_Injections https://www.securelist.com/en/blog/208193935/New_64_bit_Linu...