http://www.malware.lu/Pro/RAP002_APT1_Technical_backstage.1.0.pdf

SANS Digital Forensics and Incident Response Blog | Getting Started with Linux Memory Forensics | SANS Institute