rootkit_lin_winnti [yara_rules]

uint32(0)==0x464c457f 
        and 6 of them
        and for any i in (0..elf.number_of_sections-1) : (
            hash.md5(elf.sections[i].offset, elf.sections[i].size) == "7dea362b3fac8e00956a4952a3d4f474"
        )