for context: my machine was hacked by junglesec today, so all user files are encrypted.
I looked at htop and saw this. How can one hide process activity from htop (and top) and how can I find out which process is causing it?
-
This basically screams malware infection– user163495Jul 8, 2021 at 15:11
-
so more than only ransomware you say. my question is: how specifically is this done– nnolteJul 8, 2021 at 15:13
-
Not ransomware - that doesn't need a lot of CPU. Crypro-miners are much more likely.– user163495Jul 8, 2021 at 15:16
-
1sure, im saying its definitly ALSO ransomware, as my stuff was encrypted. ofc, there might be more than just ransomware going on– nnolteJul 8, 2021 at 15:41
-
2I guess that if you don't have a PID it doesn't get listed. That would mean system level "processes" would not be shown, i.e. kernel routines and drivers.– Maarten BodewesJul 9, 2021 at 13:53
Add a comment
|
1 Answer
At this point, you can't and musn't trust your machine anymore.
The attacker could have:
- Backdoored your userland (
ps,lsof,top,libprocps,md5sum, etc...) to hide his software and tracks. - More unlikely, but risk exists, backdoored your kernel so that syscall do not report their open files, etc....
A first step could be to compute the MD5sum of the software you used to analyse your system (top, htop, etc... ) and compare it to the MD5 sum of binaries from your distro upstream.
If the sums differs, then attacker backdoored your userland.
If sums doesn't differs, then it doesn't prove anything: attacker could have backdoored md5sum and similar programs.
A second step would be to get a statically built busybox (aka a fully portable and standalone binary that do not rely on any librarie on your system) and use it to inspect your system.
For your information, busybox is a minimalist implementation of every basic linux commands in a single binary.
This is mostly used on the embedded linux world to save space.
If attacker's stuff (process, files, ...) remain hidden, it's probably that your kernel land was backdoored too... At this point, the better thing to do is a full reinstallation.
-
1Skip all of this and do a full reinstallation– user163495Aug 17, 2021 at 15:48
-
Your system was compromised, don't waste time, save what you need, format and reinstall. Aug 17, 2021 at 23:15