# xway_ir 已知恶意 LKM (Loadable Kernel Module) 黑名单
# 来源:grayddq/GScan lib/plugins/Rootkit_Analysis.py + 公开威胁情报
# 用法:find /lib/modules -name '*.ko' -o -name '*.ko.xz' | grep -F -f lib/bad_lkm.txt
# 备注:这些模块名若出现在 /lib/modules 下 100% 是 Rootkit

# --- 公开 LKM Rootkit 模块名 ---
diamorphine
suterusu
reptile
rekoobe
daxin
xkey
logfs
joys
vlany
rooty
kovid
mod_rootme
lib_rootkit
sneaky
umproxy
hook
phide
msm-3.0
penguin
usbdev
ratel
maK_it
iam
hp
niger
override
nump
crashme
demo
test
sneaky_mod
reversed
kbeast
modhide
hidepid
rootk
cov
jynx
adore
modp
cleaner
mod_unhide
fake
shv
sin
slapper
modsneak
apache_mod
phalanx
modp_hide
redir
portacelo
modrdts
modrdts2
hacked
vampire
sunrknt
weapnx
oxurat
torn
tuxkit
mod_redir
pmodule
modsneakin
invisible
iamrootkit
r00tkit
rkit
r00t_me
rootme
phalanx_mod
rmod
mod4
mod6
mod7
mod8
mod9
mrec
spy_kmod
myspy
hideproc
proc_hide
hidemod
sneak2
klaxon
nux
broot
mod_pid
hide_tcp4
hide_tcp6
logger
cln
ipt
intercept
keylog