I am fairly confident that this rootkit would be detected by rkhunter, but possibly only when the adversary is logged into the machine, as the malware hides the pids and network ports associated with their ssh connection.