لینکس میلویئر, کرون آر اے ٹی, غلط تاریخوں کے ساتھ کرون جاب میں چھپا ہوا ہے۔

ہیلگا اسمتھدسمبر 2, 2021آخری تازہ کاری: دسمبر 18, 2021
166 1 منٹ پڑھیں

Researchers from the Dutch company Sansec have discovered a new malware for Linux CronRAT. It is a Remote Access Trojan (RAT) that escapes detection by hiding in tasks scheduled to run on the nonexistent day of February 31st.

The malware is called کرون آر اے ٹی and mainly attacks online stores, allowing cybercriminals to steal bank card data and deploy web skimmers on Linux servers (that is, to carry out the so-called MageCart attacks). بدقسمتی سے, many security solutions simply do not “see” CronRAT due to a number of peculiarities in its operation.

CronRAT abuses Linux’s task scheduling system, cron, which allows tasks to be scheduled to run on non-existent calendar days such as February 31st. اس معاملے میں, the cron system accepts such dates if they have a valid format (even if the day does not exist in the calendar), but such a scheduled task will simply not be completed.

By taking advantage of this feature, CronRAT remains virtually invisible. In their report, Sansec experts say that the malware hides a “complex bash program” in the names of such scheduled tasks.

CronRAT adds a number of tasks to the crontab with an interesting date specification: 52 23 31 2 3. These lines are syntactically correct but will generate a run time error when executed. البتہ, this will never happen, since the launch of such tasks is generally scheduled for February 31st.

The actual payload is obfuscated with multiple compression levels and Base64. The researchers say the code includes commands for self-destruct, time modulation, and a custom protocol that allows it to communicate with a remote server.

CronRAT code

CronRAT decoder

The malware is known to communicate with the C&C server (47.115.46.167) using “an exotic Linux kernel function that provides TCP communication via a file.” اس کے علاوہ, the connection is made over TCP over port 443 using a fake banner for the Dropbear SSH service, which also helps the Trojan go unnoticed.

As mentioned above, CronRAT was found in many online stores around the world, where it was used to implement special skimmer scripts that steal payment card data. Sansec describes the malware as “a serious threat to Linux-based eCommerce servers.”

The problem is aggravated by the fact that CronRAT is almost invisible to security solutions. According to VirusTotal, 12 antivirus solutions failed to process the malicious file at all, اور 58 found no threat in it.

Let me remind you that we also talked about another لینکس میلویئر FontOnLake that is used in targeted attacks.

ٹیگز
ہیلگا اسمتھدسمبر 2, 2021آخری تازہ کاری: دسمبر 18, 2021
166 1 منٹ پڑھیں

ہیلگا اسمتھ

مجھے ہمیشہ کمپیوٹر سائنسز میں دلچسپی تھی۔, خاص طور پر ڈیٹا سیکیورٹی اور تھیم, جسے آج کل کہا جاتا ہے۔ "ڈیٹا سائنس", میری ابتدائی نوعمری سے. ایڈیٹر ان چیف کے طور پر وائرس ہٹانے والی ٹیم میں آنے سے پہلے, میں نے کئی کمپنیوں میں سائبر سیکیورٹی کے ماہر کے طور پر کام کیا۔, ایمیزون کے ٹھیکیداروں میں سے ایک سمیت. ایک اور تجربہ: مجھے آرڈن اور ریڈنگ یونیورسٹیوں میں پڑھانا ملا ہے۔.

جواب چھوڑیں

یہ سائٹ سپیم کو کم کرنے کے لیے Akismet کا استعمال کرتی ہے۔. جانیں کہ آپ کے تبصرے کے ڈیٹا پر کیسے کارروائی کی جاتی ہے۔.

واپس اوپر کے بٹن پر