2 ms·
That github link refers to a better write-up https://sansec.io/research/cronrat https://sansec.io/research/cronrat (which the bleepingcomputer article rehashes,
by bellyfullofbac 5y ago
That github link refers to a better write-up https://sansec.io/research/cronrat https://sansec.io/research/cronrat (which the bleepingcomputer article rehashes, because hey, this is 2021 and ad views is the goal...).
> CronRAT’s main feat is hiding in the calendar subsystem of Linux servers (“cron”) on a nonexistant day. This way, it will not attract attention from server administrators. And many security products do not scan the Linux cron system.
It also seems to be trying to sell their "eComscan" product, which is a vulnerability scanner dedicated to eCommerce... what a weird specialization.
- rascul 5y ago> That github link refers to a better write-up https://sansec.io/research/cronrat https://sansec.io/research/cronrat (which the bleepingcomputer article rehashes, because hey, this is 2021 and ad views is the goal...). I looked through that one also, no mention about how the bash script is executed.
- bellyfullofbac 5y agoThe 2nd screenshot on the bleedingcomputer article shows a bash function called "extract_payload_from_crontab" in the file decoder.sh Maybe the malware relies on the scanner scanning executables (so sh files) for things like wget/curl, but since it ignores crontab, it will deem decoder.sh to be harmless.
- chmod775 5y ago> what a weird specialization. I don't think it's weird at all. It's a large and at risk customer base that will be willing to pay for added protection, because the cost of some software is negligible compared to the damage that might be prevented.