Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report
Read the full analysis on IntelFusions