如何確定這些 perl 進程是否是惡意的？

Question

我們的 Suse Linux Web 伺服器最近運行速度相當緩慢，重新啟動可以暫時緩解問題。

經過進一步檢查，我發現防火牆阻止了奇怪端口上的一些出站流量，這些流量似乎源自 perl 命令...

網路統計：

# netstat -nape | head -2; netstat -nape | grep 185.162.9.131
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name   
tcp        0      1 192.168.0.1:45781       185.162.9.131:147       SYN_SENT    30         65180      26829/fixit         
tcp        0      1 192.168.0.1:45777       185.162.9.131:147       SYN_SENT    30         65175      29159/epim          
tcp        0      1 192.168.0.1:45783       185.162.9.131:147       SYN_SENT    30         65182      26052/usel          
tcp        0      1 192.168.0.1:45773       185.162.9.131:147       SYN_SENT    30         65067      6265/usel           
tcp        0      1 192.168.0.1:45782       185.162.9.131:147       SYN_SENT    30         65181      5885/epim           
tcp        0      1 192.168.0.1:45771       185.162.9.131:147       SYN_SENT    30         65065      5529/epim           
tcp        0      1 192.168.0.1:45775       185.162.9.131:147       SYN_SENT    30         65161      26432/epim 

lsof：表示它是一個perl指令

# lsof -i :45775
COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
perl    26432 wwwrun    4u  IPv4  65161      0t0  TCP apache.home:45775->hosted-by.eurohoster.online:iso-ip (SYN_SENT)

我希望 pstree 可能會透露一些有用的信息，但我仍然沒有更接近：

# pstree -ap wwwrun
perl,5529 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,5530 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,5885 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,5886 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,6265 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,6266 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,26052 \040\040\040\040\040\040\040\040\040\040

perl,26053 \040\040\040\040\040\040\040\040\040\040

perl,26432 \040\040\040\040\040\040\040\040\040\040

perl,26433 \040\040\040\040\040\040\040\040\040\040

perl,26829 \040\040\040\040\040\040\040\040\040

perl,26830 \040\040\040\040\040\040\040\040\040

perl,28459 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

有誰對我如何準確地找出這些 perl 進程是什麼以及它們是如何啟動的有任何建議嗎？