The 2nd screenshot on the bleedingcomputer article shows a bash function called "extract_payload_from_crontab" in the file decoder.sh Maybe the malware relies

The 2nd screenshot on the bleedingcomputer article shows a bash function called "extract_payload_from_crontab" in the file decoder.sh Maybe the malware relies on the scanner scanning executables (so sh files) for things like wget/curl, but since it ignores crontab, it will deem decoder.sh to be harmless.