Linux Loadable Kernel Module (LKM) based rootkit (ring-0), capable of hiding itself, processes/implants, rmmod proof, has ability to bypass infamous rkhunter antirootkit.

A collection of memory forensics case studies performed using Volatility. This repository contains malware investigations, rootkit analysis, process analysis, network artifact analysis and findings from different memory samples.