Hi Andres,
thanks for the nice write-up.
I've attached a yara rule to detect the *.o droplet you attached in the
email (liblzma_la-crc64-fast.o.gz).
I'll look more into this as soon as I return from holidays. Again, nice
write-up. Thanks!
Matthias