Based on a bashtemp directory of the latest sample we found, there are other compiled ELF scripts, named init and init2, that loops the kit to keep running: 0c458dfe0a2a01ab300c857fdc3373b75fbb8ccfa23d16eff0d6ab888a1a28f6  init  Figure 3. Running the init ELF script 93ce211a71867017723cd78969aa4cac9d21c3d8f72c96ee3e1b2712c0eea494  init2  Figure 4.