Port 22

Anatomy of native IIS malware