Canonical has provided a system image containing the Ubuntu versions of the various command-line tools that are typically found in a Linux distribution.

Although researchers found samples only for Linux, the malware is able to determine the operating system the vulnerable service is running on, and deliver the appropriate payload.