In a VM on a cloud provider, I'm seeing a process with weird random name. It consumes significant network and CPU resources.
Here's how the process looks like from pstree
view:
systemd(1)───eyshcjdmzg(37775)─┬─{eyshcjdmzg}(37782)
├─{eyshcjdmzg}(37783)
└─{eyshcjdmzg}(37784)
I attached to the process using strace -p PID
. Here's the output I've got: https://gist.github.com/gmile/eb34d262012afeea82af1c21713b1be9.
Killing the process does not work. It is somehow (via systemd?) resurrected. Here's how it looks from systemd point of view (note the weird IP address at the bottom):
$ systemctl status 37775
● session-60.scope - Session 60 of user root
Loaded: loaded
Transient: yes
Drop-In: /run/systemd/system/session-60.scope.d
└─50-After-systemd-logind\x2eservice.conf, 50-After-systemd-user-sessions\x2eservice.conf, 50-Description.conf, 50-SendSIGHUP.conf, 50-Slice.conf, 50-TasksMax.conf
Active: active (abandoned) since Tue 2018-03-06 10:42:51 EET; 1 day 1h ago
Tasks: 14
Memory: 155.4M
CPU: 18h 56min 4.266s
CGroup: /user.slice/user-0.slice/session-60.scope
├─37775 cat resolv.conf
├─48798 cd /etc
├─48799 sh
├─48804 who
├─48806 ifconfig eth0
├─48807 netstat -an
├─48825 cd /etc
├─48828 id
├─48831 ps -ef
├─48833 grep "A"
└─48834 whoami
Mar 06 10:42:51 k8s-master systemd[1]: Started Session 60 of user root.
Mar 06 10:43:27 k8s-master sshd[37594]: Received disconnect from 23.27.74.92 port 59964:11:
Mar 06 10:43:27 k8s-master sshd[37594]: Disconnected from 23.27.74.92 port 59964
Mar 06 10:43:27 k8s-master sshd[37594]: pam_unix(sshd:session): session closed for user root
What is going on?!
Best Answer
eyshcjdmzg
is a Linux DDoS trojan (easily found through a Google search). You've likely been hacked.Take that server off-line now. It's not yours any longer.
Please read the following ServerFault Q/A carefully: How to deal with a compromised server.
Note that depending on who you are and where you are, you may additionally be legally obliged to report this incident to authorities. This is the case if you are working at a government agency in Sweden (e.g. a university), for example.
Related: