value: The malware replaces the system’s pam_unix.so file (the module responsible for standard Unix authentication) with its own malicious version (detected as Backdoor.Linux.PAMDOR.A). As shown in Figure 2, this malicious pam_unix.so file accepts a specific password for any users, thus allowing the attackers to log in as any user in the machine.
  
name: Modify Authentication Process: Pluggable Authentication Modules