This question already has an answer here:
- How do I deal with a compromised server? 6 answers
I have an AWS EC2 instance running RHEL 7.2 which seems to have been hacked by a BitCoin CPU Miner. When I run
ps -eo pcpu,args --sort=-%cpu | head, it shows that there is a CPU miner that's taking up more than 90% of CPU utilization.
%CPU COMMAND 99.8 /opt/minerd -B -a cryptonight -o stratum+tcp://xmr.crypto-pool.fr:8080 -u 47TS1NQvebb3Feq91MqKdSGCUq18dTEdmfTTrRSGFFC2fK85NRdABwUasUA8EUaiuLiGa6wYtv5aoR8BmjYsDmTx9DQbfRX -p x
It also shows up when I run
top -bn2 |sed -n '7,25'p -
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 21863 root 20 0 237844 3300 1012 S 42.0 0.1 3:49.55 minerd
I keep trying to remove
/opt/ but it keeps spinning itself up again. Previously I had
KHK75NEOiq33 and a
yam directory. I was able to delete them but not
How can I permanently remove this? I've also tried killing the
PID individually with
sudo kill -9 and
sudo kill -2. Is there any antivirus that I can use to get rid of it?
EDIT - The question was marked as a possible duplicate to another question. However, the difference is that I'm inquiring about a specific malware. I have found the solution to the question, which I will be posting below.