3 ms·
I don't get it. If they are hidden within valid but never occurring crontab dates then they don't get executed. What am I missing?
by sys_64738 5y ago
I don't get it. If they are hidden within valid but never occurring crontab dates then they don't get executed. What am I missing?
- rzzzt 5y agoanacron can run entries that are past their due date. ...after reading: but also because one entry has a valid "every 30 minutes" specification :) and the rest are only used for storage.
- 4llan 5y ago> The CronRAT adds a number of tasks to crontab with a curious date specification: 52 23 31 2 3. These lines are syntactically valid, but would generate a run time error when executed. However, this will never happen as they are scheduled to run on February 31st. Instead, the actual malware code is hidden in the task names and is constructed using several layers of compression and base64 decoding. The actual malware uses the task name from these "never occurring crontab". The invalid date is just a kind of signature.