researchers have discovered a cryptomining malware thatuses a cron job to infect Linux computers that were already infected but had the malicious files removed. It essentially re-infects the systems.
The malware was initially detected on a web server. The cryptomining software was designed to use all available resources of the infected Linux system.
Researcher Luke Leal discovered that hackers download the cryptominer using a Bash script that is installed on the server. The method by which the installation. It is likely that a vulnerability or administrator credentials are stolen.
The malicious Bash script, named cr2.sh, downloads the cryptominer payload by sending a request to a server controlled by the hackers.
The malicious miner, which is loaded into the Linux host's memory, then deletes the payload and configuration file in order to cloak itself and hide its presence.
The malware can re-infect the system by creating a cron job, which runs every minute, checking for the cr2.sh Bash script, which was used in the initial stage of infection. If it does not find it, it automatically reloads it and executes it.
By adding the cron job, the malware will be able to automatically re-infect the Linux host , even if the administrator tries to stop the process and remove all malicious files from the hard drive.
The researchers reportedthat it is not just web servers that are targeted. The malware can also infect desktop installations of 32/64bit Linux systems.
Recently, the platform has become an increasingly common target for hackers using cryptomining malware to steal cryptocurrency. Recently, a Backdoor Trojanknown as SpeakUp was detected, which targets servers running six different Linux distributions and installs XMRig miners.
