Nov 25, 2021
0 0

New Linux malware hides in cron jobs with invalid dates

Written by

Apple sues spyware-maker NSO Group, notifies iOS exploit targets
Mediatek eavesdropping bug impacts 30% of all Android smartphones
Stealthy new JavaScript malware infects Windows PCs with RATs
Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds
Read, edit, and write PDFs with Apple’s App of the year
New Linux malware hides in cron jobs with invalid dates
Discord malware campaign targets crypto and NFT communities
Learn how to automate Windows with this $20 PowerShell bundle
Qualys BrowserCheck
Junkware Removal Tool
How to remove the PBlock+ adware browser extension
Remove the Search Redirect
Remove the Search Redirect
Remove the Search Redirect
Remove Security Tool and SecurityTool (Uninstall Guide)
How to remove Antivirus 2009 (Uninstall Instructions)
How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller
Locky Ransomware Information, Help Guide, and FAQ
CryptoLocker Ransomware Information Guide and FAQ
CryptorBit and HowDecrypt Information Guide and FAQ
CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
How to make the Start menu full screen in Windows 10
How to install the Microsoft Visual C++ 2015 Runtime
How to open an elevated PowerShell Admin prompt in Windows 10
How to Translate a Web Page in Google Chrome
How to start Windows in Safe Mode
How to remove a Trojan, Virus, Worm, or other Malware
How to show hidden files in Windows 7
How to see hidden files in Windows
IT Certification Courses
Gear + Gadgets
New CronRAT Linux malware hides payloads in cron jobs for inexistent day
Security researchers have discovered a new remote access trojan (RAT) for Linux that keeps an almost invisible profile by hiding in tasks scheduled for execution on a non-existent day, February 31st.
Dubbed CronRAT, the malware is currently targeting web stores and enables attackers to steal credit card data by deploying online payment skimmers on Linux servers.
Characterized by both ingenuity and sophistication, as far as malware for online stores is concerned, CronRAT is undetected by many antivirus engines.
CronRAT abuses the Linux task scheduling system, cron, which allows scheduling tasks to run on non-existent days of the calendar, such as February 31st.
The Linux cron system accepts date specifications as long as they have a valid format, even if the day does not exist in the calendar – which means that the scheduled task won’t execute.
This is what CronRAT relies on to achieve its stealth. A report today from Dutch cyber-security company Sansec explains that it hides a “sophisticated Bash program” in the names of the scheduled tasks.
“The CronRAT adds a number of tasks to crontab with a curious date specification: 52 23 31 2 3. These lines are syntactically valid, but would generate a run time error when executed. However, this will never happen as they are scheduled to run on February 31st,” Sansec Researchers explain.
CronRAT payload hidden in cron task for non-existent  day
The payloads are obfuscated via multiple layers of compression and Base64 encoding. Cleaned up, the code includes commands for self-destruction, timing modulation, and a custom protocol that allows communication with a remote server.
The researchers note that the malware contacts a command and control (C2) server ( using an “exotic feature of the Linux kernel that enables TCP communication via a file.”
Furthermore, the connection is done over TCP via port 443 using a fake banner for the Dropbear SSH service, which also helps the malware stay under the radar.
After contacting the C2 server, the disguise falls, sends and receives several commands, and gets a malicious dynamic library. At the end of these exchanges, the attackers behind CronRAT can run any command on the compromised system.
CronRAT has been found on multiple stores across the world, where it was used to inject on the server scripts that steal payment card data – the so-called Magecart attacks.
Sansec describes the new malware as “a serious threat to Linux eCommerce servers,” due to its capabilities:
All these features make CronRAT virtually undetectable. On VirusTotal scanning service, 12 antivirus engines were unable to process the malicious file and 58 of them did not detect it as a threat.
CronRAT undetected on VirusTotal
Sansec notes that CronRAT’s novel execution technique also bypassed its detection algorithm, eComscan, and the researchers had to rewrite it in order to catch the new threat.
Hackers deploy Linux malware, web skimmer on e-commerce servers
Costco discloses data breach after finding credit card skimmer
Stealthy new JavaScript malware infects Windows PCs with RATs
UK govt warns thousands of SMBs their online stores were hacked
7 million Robinhood user email addresses for sale on hacker forum
Not a member yet? Register Now
Over nine million Android devices infected by info-stealing trojan
Malware now trying to exploit new Windows Installer zero-day
To receive periodic updates and news from BleepingComputer, please use the form below.
Terms of Use Privacy PolicyEthics Statement
Copyright @ 2003 – 2021 Bleeping Computer® LLC – All Rights Reserved
Not a member yet? Register Now
Read our posting guidelinese to learn what content is prohibited.


Article Categories:
Cybersecurity News

Comments are closed.