I found malware on my ec2 instance which was continuously mining bitcoin and using my instance processing power. I successfully identified the process, but was unable to remove and kill it.
I ran this command
watch "ps aux | sort -nrk 3,3 | head -n 5"
It shows the top five process running on my instance, from which I found there is a process name 'bashd' which was consuming 30% of cpu. The process is
bashd -a cryptonight -o stratum+tcp://get.bi-chi.com:3333 -u 47EAoaBc5TWDZKVaAYvQ7Y4ZfoJMFathAR882gabJ43wHEfxEp81vfJ3J3j6FQGJxJNQTAwvmJYS2Ei8dbkKcwfPFst8FhG -p x
I killed this process by using the
kill -9 process_id command. After 5 seconds, the process started again.