value:  Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.
name: Modify Authentication Process: Pluggable Authentication Modules