내 VM이 암호화폐 채굴 악성코드에 감염되었습니다. 죽일 수는 있지만 부팅할 때마다 분명히 다시 시작됩니다. 실행 파일을 찾으려고 노력했지만 손에 넣을 수 없습니다. 프로세스 경로( htop, ls -l, lsof -p, ect)가 존재하지 않습니다. 이것이 어떻게 가능하며 실행 파일을 찾아 삭제하려면 어떻게 해야 합니까?
내가 말하는 것을 증명할 몇 가지 결과는 다음과 같습니다.
root@mediaserver:/home/tech# ls -l /proc/3648/exe
lrwxrwxrwx 1 media media 0 juin 23 00:48 /proc/3648/exe -> /config/c3pool/xmrig
root@mediaserver:/home/tech# readlink /proc/3648/exe
/config/c3pool/xmrig
root@mediaserver:/home/tech# lsof -p 3648
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
xmrig 3648 media cwd DIR 0,82 4096 20054344 /
xmrig 3648 media rtd DIR 0,82 4096 20054344 /
xmrig 3648 media txt REG 254,2 2364488 22675798 /config/c3pool/xmrig
xmrig 3648 media mem REG 254,2 13503512 /usr/share/zoneinfo/Europe/Paris (path inode=31594143)
xmrig 3648 media 0r CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 1w CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 2w CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 3r CHR 1,9 0t0 101097 /dev/urandom
xmrig 3648 media 4u a_inode 0,13 0 10340 [eventpoll]
xmrig 3648 media 5r FIFO 0,12 0t0 231408 pipe
xmrig 3648 media 6w FIFO 0,12 0t0 231408 pipe
xmrig 3648 media 7r FIFO 0,12 0t0 238200 pipe
xmrig 3648 media 8w FIFO 0,12 0t0 238200 pipe
xmrig 3648 media 9u a_inode 0,13 0 10340 [eventfd]
xmrig 3648 media 10w REG 254,2 87499703 22675799 /config/c3pool/xmrig.log
xmrig 3648 media 11u a_inode 0,13 0 10340 [eventfd]
xmrig 3648 media 12u sock 0,9 0t0 231410 protocol: UNIX
xmrig 3648 media 13u a_inode 0,13 0 10340 [eventfd]
xmrig 3648 media 14r a_inode 0,13 0 10340 inotify
xmrig 3648 media 15r CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 16u sock 0,9 0t0 243829 protocol: TCP
root@mediaserver:/home/tech# cd /config
bash: cd: /config: Aucun fichier ou dossier de ce type
편집 : 도움으로https://askubuntu.com/questions/1005437/greping-all-files-for-a-string-takes-a-long-time유래를 찾아냈습니다. 그는 여러 곳에 악성코드를 설치했고, 이를 실행할 때 여기에서 이미 존재하는 프로세스가 아닌지 확인합니다. grep을 종료하고 모든 사본을 삭제하겠습니다. 하지만 스크립트가 어떻게 실행되는지 여전히 궁금합니다. 누군가 아이디어가 있습니까? 다음은 상황을 더 잘 이해하기 위한 몇 가지 로그입니다.
root@mediaserver:/home/tech# sudo time grep -rnw --exclude-dir={boot,dev,lib,media,mnt,proc,root,run,sys,/tmp,tmpfs,var,/shares} '/' -e 'xmrig'
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/config.json:63: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/config_background.json:90: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/miner.sh:2:if ! pidof xmrig >/dev/null; then
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/miner.sh:3: nice /config/c3pool/xmrig $*
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/miner.sh:6: echo "Run \"killall xmrig\" or \"sudo killall xmrig\" if you want to remove background miner first."
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/config.json:65: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/config_background.json:112: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:2:if ! pidof xmrig >/dev/null; then
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:3: nice /config/c3pool/xmrig $*
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:6: echo "Run \"killall xmrig\" or \"sudo killall xmrig\" if you want to remove background miner first."
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:8: echo "如果要先删除后台矿工，请运行 \"killall xmrig\" 或 \"sudo killall xmrig\"."
media@mediaserver:~$ ls -al /appdata/config/code-server/c3pool/
total 87800
drwxr-xr-x 2 media media 4096 déc. 31 2020 .
drwxr-xr-x 12 media media 4096 janv. 6 12:38 ..
-rw-r--r-- 1 media media 4172 déc. 31 2020 config_background.json
-rw-r--r-- 1 media media 2441 déc. 31 2020 config.json
-rwxr-xr-x 1 media media 277 déc. 31 2020 miner.sh
-rwxr-xr-x 1 media media 2364488 déc. 23 2020 xmrig
-rw-r--r-- 1 media media 87510988 juin 23 02:46 xmrig.log
media@mediaserver:~$ cat /appdata/config/code-server/c3pool/miner.sh
#!/bin/bash
if ! pidof xmrig >/dev/null; then
nice /config/c3pool/xmrig $*
else
echo "Monero miner is already running in the background. Refusing to run another one."
echo "Run \"killall xmrig\" or \"sudo killall xmrig\" if you want to remove background miner first."
fi