How can I kill minerd malware on an AWS EC2 instance? (compromised server)

Question

I found malware on my ec2 instance which was continuously mining bitcoin and using my instance processing power. I successfully identified the process, but was unable to remove and kill it.

I ran this command watch "ps aux | sort -nrk 3,3 | head -n 5" It shows the top five process running on my instance, from which I found there is a process name 'bashd' which was consuming 30% of cpu. The process is

bashd -a cryptonight -o stratum+tcp://get.bi-chi.com:3333 -u 47EAoaBc5TWDZKVaAYvQ7Y4ZfoJMFathAR882gabJ43wHEfxEp81vfJ3J3j6FQGJxJNQTAwvmJYS2Ei8dbkKcwfPFst8FhG -p x

I killed this process by using the kill -9 process_id command. After 5 seconds, the process started again.

Answer 1

If you did not put the software there and/or if you think your cloud instance is compromised: Take it off-line, delete it, and rebuild it from scratch (but read the link below first). It does not belong to you anymore, you can not trust it any longer.

See "How to deal with a compromised server" on ServerFault for further information about what to do and how to behave when getting a machine compromised.

In addition to the things to do and think about in the list(s) linked to above, be aware that depending on who you are and where you are, you may have a legal obligation to report it to either a local/central IT security team/person within your organization and/or to authorities (possibly even within a certain time frame).

In Sweden (since December 2015), for example, any state agency (e.g. universities) are obliged to report IT-related incidents within 24 hours. Your organization will have documented procedures for how to go about doing this.

Answer 2

This command bashd is the same as ccminer from ccminer-cryptonight programm to mine Monero on your system (there is tuto : Monero - Ccminer-cryptonight GPU miner on Linux) , the bashd is obtained by aliasing or by modifying the source code of the program .

Cryptonight Malware : how to kill the process ? (information found on malware expert webpage)

This again new malware which we call cryptonight, what we haven’t seen before. It’s downloads executable Linux program and hides that http daemon in background, which is difficult find process list at first glance.

Manual remove process

You can search if there running process httpd, which start cryptonight parameter:

ps aux | grep cryptonight

Then just kill -9 process_id with root permissions.(you should kill the process of cryptonight not the bashd)

To be safe you should:

1. Reinstall your system
2. Patch your system to prevent the remote attack vulnerability :Linux Servers Hijacked to Mine Cryptocurrency via SambaCry Vulnerability
3. Restrict users to run limited commands