Mirai dropper cron persistence and /mnt/mtd/Config/.m copy of /var/.m

Subhankar H@Andrewsec57

•updated 5 days ago•0•0•4

Detects Linux process command lines associated with the Mirai l.sh dropper that establish persistence by appending a cron job running /var/.m to /var/spool/cron/root, or by copying and changing permissions of /var/.m within the MTD configuration partition (/mnt/mtd/Config/.m).