4

I noticed that my server CPU is super high and the reason is grep "A" command

Server Tasks

After a deep look, that what I've found in my active internet connections list (netstat -tupn)

   tcp        0      0 138.xxx.140.xxx:60752    198.1.158.134:80        ESTABLISHED 1583/grep "A"

I've killed the task by calling sudo kill -9 1583 then the same IP address made the following connection with a different command

tcp 0 0 138.xxx.140.xxx:32956 198.1.158.134:8000 ESTABLISHED 13139/id

by calling lsof I found the process name is bkhcdgfdv with these lines

bkhcdgfdv 14771 14825             root    5r      REG              253,1  4516064      57220 /usr/sbin/php-fpm7.1
bkhcdgfdv 14771 14826             root  cwd       DIR              253,1     4096          2 /
bkhcdgfdv 14771 14826             root  rtd       DIR              253,1     4096          2 /
bkhcdgfdv 14771 14826             root  txt       REG              253,1   625878       2100 /usr/bin/bkhcdgfdva
bkhcdgfdv 14771 14826             root    0u      CHR                1,3      0t0          6 /dev/null
bkhcdgfdv 14771 14826             root    1u      CHR                1,3      0t0          6 /dev/null
bkhcdgfdv 14771 14826             root    2u      CHR                1,3      0t0          6 /dev/null
bkhcdgfdv 14771 14826             root    3u     IPv4             309207      0t0        TCP MY_HOSTNAME:32982->198.1.158.134:8000 (ESTABLISHED)

Question: What kind of attack is this and how do I stop it?

Improve this question
  • Looks like an attacker who has no idea how to stay undetected or how basic linux operations work (unless grep maps to a monero miner on your system). Try to record the network traffic, and isolate the binary with the weird name before nuking the server, that might be enough to attribute it. – J.A.K. Jul 30 '18 at 7:17
  • How cloud he send those commands? I'm using SSH key to login to my server and password authentication is disabled. Nothing special is installed on the server and I use it just for development purposes. – Adam Jul 30 '18 at 7:35
  • Without being able to look at the server that is very hard to say for sure :) – J.A.K. Jul 30 '18 at 9:47
  • Something very useful and very simple is to do a string command to the binary, on the other hand tcpdump that traffic will be helpful also to understand whats going on. – camp0 Jul 30 '18 at 11:05
  • 1
    You can use ps -fax bkhcdgfdv to see where is the file that trigger the process. Nuke you server and redeploy after you have enough of the research. – mootmoot Jun 5 '19 at 9:11
2

Just based on the limited details This looks like it could've be a bitcoin miner disguised as the grep command. Deleting or killing it won't help because that is just the payload.

You need to look at your Apache access logs , ssh logs, etc and figure out how the attacker got onto your system (eg unpatched vulnerability? Default password ?) then close that gap. Also what backdoors or webshells or reverse shells has the attacker left behind already ? If you can't find them the attacker will likely just return and do it all over again.

Safest bet if you have poor logging or no clue how or when this happened is to rebuild the system and ensure everything is patched and all default password changed.

Improve this answer
  • The mention of PHP above is a smoking gun for entry via the web server. Also it is trivial for any Unix process to modify what shows up in ps - you just set argv[0] to whatever – Gaius Jun 5 '19 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.