"The known version of Hanthie is starting processes using a fake Kernel process in user-space called [flush-8:0] and starting from the init process instead of t

"The known version of Hanthie is starting processes using a fake Kernel process in user-space called [flush-8:0] and starting from the init process instead of the kernel process. So the current detection can be performed from user-space with the following script: if [[ $(ps -eaf|grep "\[flush" | tr -s " " |cut -d" " -f 3|grep ^1$) ]]; then echo "Infection suspected"; else echo "No infection suspected"; fi " from https://www.circl.lu/pub/tr-15/ https://www.circl.lu/pub/tr-15/