31

For last few weeks, there has been weird activity in my Ubuntu test server. Please check the below screenshot from htop. Everyday this weird service (which seems like a cryptocurrency mining service) is running and taking 100% of CPU. screenshot from htop

My server is only accessible through ssh key and password login has been disabled. I have tried to find any file with this name, but couldn't find any.

Can you please help me with the below issues

  • How to find the process location from process ID?
  • How do I completely remove this?
  • Any idea how this may got into my server? The server runs mainly test version of few Django deployments.
8
  • 17
    Your system has been infected with what we call a Coin Miner.
    – Vlastimil Burián
    Dec 28, 2017 at 5:49
  • 3
    This doesn't answer all of your questions, but may be relevant: serverfault.com/questions/218005/…
    – dhag
    Dec 28, 2017 at 5:49
  • 1
    Here is a link that describes how this fileless malware works. Based on that website, i think your server has to be formatted : csoonline.com/article/3227046/malware/…
    – F.Jawad
    Dec 28, 2017 at 15:24
  • 3
    Note that in addition to cleaning this up, which usually means reinstalling, you also need to patch the vulnerability. Otherwise it'll come back.
    – Gilles 'SO- stop being evil'
    Dec 28, 2017 at 21:48
  • This process is a renamed version of a popular mining program. It's mining Monero to the pool xmr.crypto-pool.fr. Look up the long string starting with 4 on that website, it should give a hint of the scale of the attacker's mining.
    – anna328p
    Dec 28, 2017 at 22:28

3 Answers 3

Reset to default
31

As explained by other answers it's a malware that uses your computer to mine cryptocoins. Good news is that it's unlikely to be doing anything else than using your CPU and electricity.

Here is a bit more information and what you can do to fight back once you've got rid of it.

The malware is mining an altcoin called monero to one of the largest monero pools, crypto-pool.fr. That pool is legitimate and they are unlikely to be the source of the malware, that's not how they make money.

If you want to annoy whoever wrote that malware, you could contact the administrator of the pool (there is an email on the support page of their site). They don't like botnets so if you report to them the address used by the malware (the long string that starts with 42Hr...), they will probably decide to suspend the payments to that address which will make the life of the hacker who wrote that piece of sh.. a bit more difficult.

This may help too: How can I kill minerd malware on an AWS EC2 instance? (compromised server)

1
  • 6
    As much as I like the idea of penalizing the hacker, I am not sure I would recommend doing so when said hacker obviously has access to the computer, as there may be retaliation. I would advise securing assets first (backups!), at the very least.
    – Matthieu M.
    Dec 29, 2017 at 14:52
18

It depends on how much trouble the program goes to to hide where it is run from. If it is not too much then

  1. Start with the process ID, 12583 in the screenshot
  2. use ls -l /proc/12583/exe and it should give you a symbolic link to an absolute pathname, which may be annotated with (deleted)
  3. examine the file at the pathname if it has not been deleted. Note in particular if the link count is 1. If it isn't then you will need to find the other names for the file.

Since you describe this as a test server, you are probably better off by saving any data and reinstalling. The fact that the program is running as root means you really can't trust the machine now.

update: We now know the file is in /tmp. Since this is a binary, there are a couple of choices, the file is being compiled on the system or it is being compiled on another system. A look at the last use time of the compiler driver ls -lu /usr/bin/gcc might give you a clue.

As a stopgap, if the file has a constant name, you could create a file with this name but is write protected. I would suggest a small shell script which logs all the current processes and then sleeps for a long time just in case whatever is running the command respawns the job. I would use chattr +i /tmp/Carbon if your filesystem allows it as few scripts will know how to deal with immutable files.

4
  • 3
    I could find the absolute path inside /tmp folder. So it seems it gets created by something else.
    – Habib Ullah Bahar
    Dec 28, 2017 at 8:54
  • The first few steps are not very useful. You're relying on the malware author being incompetent. Some are, but this one is a money-maker, they can hire competent programmers. Mind you, this malware isn't hiding very well.
    – Gilles 'SO- stop being evil'
    Dec 28, 2017 at 21:48
  • 1
    @Gilles I agree that I am relying on the author not trying very hard as I said in my first sentence . I am answering the question as written, not a generic how do I remove malware from my server.
    – icarus
    Dec 28, 2017 at 22:48
  • @icarus the stop gap measure worked alright, thank you. But as recommended by everyone, already started rebuilding another server from scratch.
    – Habib Ullah Bahar
    Jan 8, 2018 at 5:21
7

Your server appears to have been compromised by BitCoin miner malware. See the ServerFault thread @dhag posted. Also, this page has a lot of information about it.

It appears to be what's called "fileless malware" - you can't find the running executable because you're not supposed to. It's using up all of your CPU capacity, because it's using it to mine cryptocurrency.

3
  • 2
    I'd assume that it mines some alt-coin, not bitcoin itself.
    – CodesInChaos
    Dec 28, 2017 at 11:49
  • The linked page about fileless malware appears to be about a windows program, but this server is running ubuntu.
    – icarus
    Dec 28, 2017 at 13:50
  • 3
    This mines Monero.
    – anna328p
    Dec 28, 2017 at 22:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .