In the most recent variants of Linux/Ebury, strings are obfuscated with a simple XOR encryption with a static key. After unpacking, the malware loads various functions it requires using multiple calls to the dlsym function. Linux/Ebury then discovers the original executable address space by calling dlopen(NULL, RTLD_NOW) and passing the returned handle to dlinfo(handle, RTLD_DI_LINKMAP, …). This will work even if ASLR is enabled on a system. This behaviour gives Linux/Ebury the ability to walk the import table of an ELF executable and replace the original imported function address in memory. The result is that when the programsssh, sshd or ssh-add call one of the hooked function, it will be redirected to the malicious libkeyutils.so implementation that can replace the original behaviour