I saw a link about CrossRat Malware on Quora, is this Malware a problem on Ubuntu 14.04?
I have not been able to find the location listed for linux on my Ubuntu. Also I generally have Java shut off in my browser(Which should be safe?) but on occasion I turn it on(Not safe?), I played a java game a while back but I'm not sure if it was before the crashes or after.

I'm asking because I have been having fairly regular random crash problems on Firefox and very very very occasionally on gThumb, no other APP's/packages seem to have the crashing problem.

I have replaced Firefox with a Mobile Firefox version but no change what so ever in Firefox crashes. Addins make no difference, none or my usual zillion addins still same, Random Firefox crashes, sometimes long periods it works fine, other times crash after crash after crash.

I have used synaptic package managers fix broken packages, I have also updated.... and any other things I have read about in search that listed app/package crashes, no change on anything.

I did get ubuntu to break on a Nvidia driver install(Shoulda stayed with Nouveau driver.), got her back all on my own, I'm pretty proud of that. :)

By the way, before you answer "CrossRAT is a cross-platform remote access Trojan that can target four popular desktop operating systems, Windows, Solaris, Linux, and macOS..." So please don't give me the standard Linux does things different than windows virus bit, as this is one case where that does not apply, as this blipin POS works in Linux.

Also Denebian was mentioned in the article but not Ubuntu. Also the majority of virus detectors will not find this POS according to the article.

  • Yep, it is a threat to Ubuntu. – mikewhatever Jan 26 '18 at 6:06

Yes it is but the same rule still apply: it is a threat but only if you let it. -You- need to activate the installation. For me that's enough to never have this activated onto my system.

Regarding this malware:

There are 2 places this malware pops up.

  • file mediamgrs.jar, in /usr/var/
  • file in ~/.config/autostart likely named mediamgrs.desktop.

    1. the 1st is impossible to be there unless you provide the admin password. /usr/ is owned by "root" so it requires your admin password to store any program.
    2. the 2nd is impossible unless you download it yourself.

So please don't give me the standard Linux does things different

Sorry but that is STILL true: Linux DOES things different than windows. Keep your admin password safe and you have nothing to fear.

Besides that: removing the 2 files when they are present is enough to delete it from your system.

Regarding comments:

The malware puts in in a new dir var in usr. "Second problem is how can a web page install the critter unknown to the user, if an admin password needs to be put in or "you download it yourself" as you mention?" It can't under linux: the download always goes to the default download from the browser. So... you need to download it. you need to execute the download. you need to provide the admin password when asked. See the problem there for any malware that wants to settle outside your /home? Even inside your /home you need to execute the download.

"wine' is windows. So yes, wine is always an issue but again: do not insert your admin unless you know it should be asked = 99.8% safe (that is never going to be 100%) and any problem related from the other 0.2% can be fixed since you are still the admin or with a backup :) " I don't have any "mediamgrs" files but changing a name only takes a second, so that one is not comforting." well it is not really possible for malware to use random filenames so yes it is safe.

They might use different names but then someone would list those names too. This one uses 2 locations (1 in /usr/var/ one 1 .config as a desktop file. Easy to spot. Easy to delete. Not really a problem for a user comfortable with command line or someone careful with the admin password ;) ) Mind also what malware creators want: they want to make money. Often by harvesting emailaddresses, creditcard info etc. And preferably as quick as possible.... Windows is still a far easier target.

General tips:

  • do NOT use shared directories. Samba and wine are entry points though malware/virus needs to be created to abuse this kind of method.
  • do not automate processes that require a password.
  • Keep your admin password safe
  • Create (and verify you can restore) backups; if all else fails a backup of your personal data is enough to remove loads of problem.
  • Thanks. I have a couple of problems in checking on this. One I have no /usr/var/ . I did a search to make sure I wasn't brain damaged. I do have a separate \usr\ and a separate \var\ but not a \var\ under \usr\ . Second problem is how can a web page install the critter unknown to the user, if an admin password needs to be put in or "you download it yourself" as you mention? Somewhere here I'm missing something. I also wonder if it could effect "wine" or "Play on Linux"? I don't have any "mediamgrs" files but changing a name only takes a second, so that one is not comforting. – DEH Jan 27 '18 at 11:48
  • Thanks again. There are several windows malware that use random file names. Sadly I'm not familiar with Ubuntu and have to learn things as I go. I would say I'm pretty close to your tips, I don't like sharing my computer, if I need to share a file I use password and a file host, zip email if less than 2MB. Terminal windows don't scare me but I prefer GUI as I don't know Linux terminal commands much at all. Backup has been a problem as far as I still haven't got a full restore to work right on any Linux backup utility. I do backup stuff I want to save. Any Ideas on a good GUI backup app? – DEH Jan 28 '18 at 3:06
  • I'm wondering why someone would give this question a negative vote? Since there are no positives and I'm not a big contributor to the forum I'm getting the "Wait! Some of your past questions have not been well-received, and you're in danger of being blocked from asking any more.". This just seems wrong to me that one down vote can cause someone not to be able to ask questions. – DEH Feb 11 '18 at 2:07
  • @DEH (I am not the downvoterd ;) ): the question has a bias: It is opinionated and it shows it by assuming normal Linux security is flawed. Just guessing though. ". Any Ideas on a good GUI backup app?" The best ones are manually crafted with rsync creating a date-based directory to a remote server. Nothing beats a bash one-liner. – Rinzwind Feb 11 '18 at 2:15
  • Thanks Rinzwind, I didn't want to say "assuming normal Linux security is flawed". I was/am having a problem and thought this critter mite have been it. The original article I read was incomplete. Sadly I never have been the greatest at saying things in the best way. PS. love the "downvoterd", lol. – DEH Feb 11 '18 at 3:29

Regarding the need to write into /usr/var, be aware that crossRAT will fall back to ~/Library if it can't write to /usr/var. As other commentators have pointed out, the only real way to prevent infection is never to allow your browser (or email client) to execute a .jar file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.