I don't do many Linux (Elf format) signatures, but below are some signatures for this malware which has been around for a while. It hides in Linux utlities that are downloaded from the web, and there is a rootkit involved also. I have signatures for several utilites, the rootkits, and an injector file.

Copy the HDB signature(s) to a Notepad file and save it in the ClamWin db program data folder, or add the signature to an existing HDB file if you already have one there. Do not save the file with a .txt or .text extension on the end of the name. Save the file as Sigfile.hdb. Select file type All Files to prevent .txt or .text from being used at the end of the filename. ClamWin is unable to recognize a text file as a signature and will give a corrupt database warning. After saving the file to the ClamWin db program folder, scan something with ClamWin to make sure the signature works--delete the signature file if it does not, or remove the signature from an existing HDB file if you put it there and save the file as it was.

HDB signatures are signatures for an entire malware file. These are for Linux malware, so they could last for a month or much longer (rootkits are not common--especially Linux, and rootkits take some time to prepare). I would delete these signatures about 3 months after they were prepared. The last section of each signature tells the month/date/time the signature was prepared (101021.1529 is October 10, 2021 at 3:29 pm).

82bf8e99391ec0cdc527f2fc94621899:1451148:Elf.Trojan.Rootkit-101021.1529
a4013790035fc3021546c09e9cf85df1:17641:Elf.Trojan.Rootkit-101021.1524
5808cc235f8d337366bfb7e13204c8de:215112:Elf.Trojan.Rootkit-101021.1518
45a74c7b4242c704c3562db0a07327ca:744192:Elf.Trojan.Rootkit-101021.1515
aa222a7a9b73f30ea162254643e1ae8f:20224:Elf.Trojan.Rootkit-101021.1512
59d25d31cbb1b3499e6387f2196b9073:2918992:Elf.Trojan.Rootkit-101021.1509
e683405e15ffa517e4759d8907d94295:887992:Elf.Trojan.Rootkit-101021.1506
115620dfb71e59b9dad47a7ab99c88cd:903000:Elf.Trojan.Rootkit-101021.1503

Regards,