[Intel]: https://sansec.io/research/cronrat

[timb-machine]

Area

Malware reports

Parent threat

Defense Evasion, Command and Control

Finding

https://sansec.io/research/cronrat

Industry reference

uses:Non-persistentStorage
attack:T1053.003:Cron
attack:T1027:Obfuscated Files or Information
attack:T1001.003:Protocol Impersonation
attack:T1036.005:Match Legitimate Name or Location
vertical:Retail

Malware reference

CronRAT
wltm

Actor reference

No response

Component

Linux

Scenario

No response