The Linux.Ekocms.1 trojan includes special features that allows it to take screenshots and record audio.
It then saves them to a temporary folder in the JPEG format using the extension .sst.
It is not active in the Ekocms variant studied by Dr.
Web, even though the sound recording feature exists.
The malware is designed to periodically search its temporary folder for files with certain names and extensions.
If theres an error while saving the file, the trojan will use the BPM image format.
How this malware infects Linux computers have not been disclosed by Dr.
source: www.techworm.net
