Mirai dropper boot persistence via /var/.m in rc scripts and S99bot symlinks

Subhankar H@Andrewsec57

•updated 5 days ago•1•0•2

Detects Linux shell command lines that tie the /var/.m re-infection script to boot persistence by appending it to rc.local, rcS, or JAWS mtd startup scripts, or by copying it to /etc/init.d/bot and symlinking it as S99bot in runlevel directories.