CentOS – Process with Random Name Consuming Network and CPU Resources

centosprocesssystemd

In a VM on a cloud provider, I'm seeing a process with weird random name. It consumes significant network and CPU resources.

Here's how the process looks like from pstree view:

systemd(1)───eyshcjdmzg(37775)─┬─{eyshcjdmzg}(37782)
                               ├─{eyshcjdmzg}(37783)
                               └─{eyshcjdmzg}(37784)

I attached to the process using strace -p PID. Here's the output I've got: https://gist.github.com/gmile/eb34d262012afeea82af1c21713b1be9.

Killing the process does not work. It is somehow (via systemd?) resurrected. Here's how it looks from systemd point of view (note the weird IP address at the bottom):

$ systemctl status 37775
● session-60.scope - Session 60 of user root
   Loaded: loaded
Transient: yes
  Drop-In: /run/systemd/system/session-60.scope.d
           └─50-After-systemd-logind\x2eservice.conf, 50-After-systemd-user-sessions\x2eservice.conf, 50-Description.conf, 50-SendSIGHUP.conf, 50-Slice.conf, 50-TasksMax.conf
   Active: active (abandoned) since Tue 2018-03-06 10:42:51 EET; 1 day 1h ago
    Tasks: 14
   Memory: 155.4M
      CPU: 18h 56min 4.266s
   CGroup: /user.slice/user-0.slice/session-60.scope
           ├─37775 cat resolv.conf
           ├─48798 cd /etc
           ├─48799 sh
           ├─48804 who
           ├─48806 ifconfig eth0
           ├─48807 netstat -an
           ├─48825 cd /etc
           ├─48828 id
           ├─48831 ps -ef
           ├─48833 grep "A"
           └─48834 whoami

Mar 06 10:42:51 k8s-master systemd[1]: Started Session 60 of user root.
Mar 06 10:43:27 k8s-master sshd[37594]: Received disconnect from 23.27.74.92 port 59964:11:
Mar 06 10:43:27 k8s-master sshd[37594]: Disconnected from 23.27.74.92 port 59964
Mar 06 10:43:27 k8s-master sshd[37594]: pam_unix(sshd:session): session closed for user root

What is going on?!

Best Answer

eyshcjdmzg is a Linux DDoS trojan (easily found through a Google search). You've likely been hacked.

Take that server off-line now. It's not yours any longer.

Please read the following ServerFault Q/A carefully: How to deal with a compromised server.

Note that depending on who you are and where you are, you may additionally be legally obliged to report this incident to authorities. This is the case if you are working at a government agency in Sweden (e.g. a university), for example.

Related:

Related Question