HomeAboutMailing ListList Chatter /0/0 18.204.2.53

Anyone have experience removing a malicious Bitcoin miner?

2018-08-10 by: Adam Jimerson
From: Adam Jimerson 
------------------------------------------------------
Hello,

I friend of mine reached out for help removing a malicious Bitcoin miner
off one of his clients servers. If anyone has experience and time I can
pass on your contact information to him so you can hash out details
directly.
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KQ2h1Z2FsdWcg
bWFpbGluZyBsaXN0CkNodWdhbHVnQGNodWdhbHVnLm9yZwpodHRwOi8vY2h1Z2FsdWcub3JnL2Nn
aS1iaW4vbWFpbG1hbi9saXN0aW5mby9jaHVnYWx1Zwo=

=============================================================== From: David White ------------------------------------------------------ I don't have direct experience with this sort of thing, but certainly know my way around the guts of Linux well enough to probably be able to get rid of it. I'd be happy to talk about it and look at it, if your friend is interested. That said, in all reality, my normal recommendation is that, when a Linux server gets owned, it needs to be rebuilt from scratch, and backups restored. I'm not available during normal business hours, but could work on the project tomorrow (Friday) evening and Saturday.

=============================================================== From: Billy ------------------------------------------------------ I=E2=80=99ll agree with this. If it=E2=80=99s been compromised at all, then there is not a guarantee that t= here aren=E2=80=99t other backdoors that were left on the machine. 1) Either restore from a good backup - which good is left up to the definiti= on of the customer - would they bet their business on it? 2) reinstall from scratch, uploading the custom data after the fact. --b my way around the guts of Linux well enough to probably be able to get rid o= f it. I'd be happy to talk about it and look at it, if your friend is intere= sted. erver gets owned, it needs to be rebuilt from scratch, and backups restored.= ect tomorrow (Friday) evening and Saturday. ff one of his clients servers. If anyone has experience and time I can pass o= n your contact information to him so you can hash out details directly.

=============================================================== From: JustinMcAfee ------------------------------------------------------ SWYuYW55b25lIGlzIGludGVyZXN0ZWQsIG9uY2UgdGhlIHNlcnZlciBpcyByZXN0b3JlZCwgbWF5 YmUgd2UgY291bGQgZ2V0IGFuIGltYWdlIChzYW5zIFBJSSkgYW5kIGRvIGEgcm9vdCBjYXVzZSBh bmFseXNpcz8gSSdkIGxvdmUgdG8gZG8gc29tZSBmb3JlbnNpY3MgdGhhdCBkaWRuJ3QgY29tZSBv dXQgb2YgYSBjYW4hCgpBbHNvLCB0dXJuIGFuZCBidXJuIHRoYXQgc2VydmVyLiBObyByZWFzb24g b3IgZXhjdXNlIHRvIHJvbGwgYmFjay4gV2l0aG91dCBmb3JlbnNpY3MsIGl0cyBwb3NzaWJsZSB0 aGUgbWFjaGluZSB3YXMgY29tcHJvbWlzZWQgZm9yIGEgbG9uZyBwZXJpb2QgcHJpb3IgdG8gdGhl IGRpc2NvdmVyeSBvZiB0aGUgbWluZXIuCgpVbmxpa2VseSBhcyBtaW5lcnMgYXJlIHVzdWFsbHkg cHV0IGludG8gd29yayBzaG9ydGx5IGFmdGVyIGV4cGxvaXQsIGJ1dCB3ZSBkb24ndCBrbm93IHRo aXMgYXR0YWNrZXJzIE1PLCBBTkQgdGhpcyB3b3VsZG4ndCBiZSB0aGUgZmlyc3QgdGltZSBhIHJv Z3VlIGVtcGxveWVlIGhhZCBpbnRlbnRpb25hbGx5IGluZmVjdGVkIGEgc2VydmVyIHRvIG1pbmUu CgpKdXN0IG15IC4wMgoKU2VudCBmcm9tIFByb3Rvbk1haWwgbW9iaWxlCgotLS0tLS0tLSBPcmln aW5hbCBNZXNzYWdlIC0tLS0tLS0tCk9uIEF1ZyAxMCwgMjAxOCwgMDk6MjQsIEJpbGx5IHdyb3Rl OgoKPiBJ4oCZbGwgYWdyZWUgd2l0aCB0aGlzLgo+Cj4gSWYgaXTigJlzIGJlZW4gY29tcHJvbWlz ZWQgYXQgYWxsLCB0aGVuIHRoZXJlIGlzIG5vdCBhIGd1YXJhbnRlZSB0aGF0IHRoZXJlIGFyZW7i gJl0IG90aGVyIGJhY2tkb29ycyB0aGF0IHdlcmUgbGVmdCBvbiB0aGUgbWFjaGluZS4KPgo+IDEp IEVpdGhlciByZXN0b3JlIGZyb20gYSBnb29kIGJhY2t1cCAtIHdoaWNoIGdvb2QgaXMgbGVmdCB1 cCB0byB0aGUgZGVmaW5pdGlvbiBvZiB0aGUgY3VzdG9tZXIgLSB3b3VsZCB0aGV5IGJldCB0aGVp ciBidXNpbmVzcyBvbiBpdD8KPgo+IDIpIHJlaW5zdGFsbCBmcm9tIHNjcmF0Y2gsIHVwbG9hZGlu ZyB0aGUgY3VzdG9tIGRhdGEgYWZ0ZXIgdGhlIGZhY3QuCj4KPiAtLWIKPgo+IE9uIEF1ZyA5LCAy MDE4LCBhdCA5OjM5IFBNLCBEYXZpZCBXaGl0ZSA8ZG13aGl0ZTgyM0BnbWFpbC5jb20+IHdyb3Rl Ogo+Cj4+IEkgZG9uJ3QgaGF2ZSBkaXJlY3QgZXhwZXJpZW5jZSB3aXRoIHRoaXMgc29ydCBvZiB0 aGluZywgYnV0IGNlcnRhaW5seSBrbm93IG15IHdheSBhcm91bmQgdGhlIGd1dHMgb2YgTGludXgg d2VsbCBlbm91Z2ggdG8gcHJvYmFibHkgYmUgYWJsZSB0byBnZXQgcmlkIG9mIGl0LiBJJ2QgYmUg aGFwcHkgdG8gdGFsayBhYm91dCBpdCBhbmQgbG9vayBhdCBpdCwgaWYgeW91ciBmcmllbmQgaXMg aW50ZXJlc3RlZC4KPj4gVGhhdCBzYWlkLCBpbiBhbGwgcmVhbGl0eSwgbXkgbm9ybWFsIHJlY29t bWVuZGF0aW9uIGlzIHRoYXQsIHdoZW4gYSBMaW51eCBzZXJ2ZXIgZ2V0cyBvd25lZCwgaXQgbmVl ZHMgdG8gYmUgcmVidWlsdCBmcm9tIHNjcmF0Y2gsIGFuZCBiYWNrdXBzIHJlc3RvcmVkLgo+Pgo+ PiBJJ20gbm90IGF2YWlsYWJsZSBkdXJpbmcgbm9ybWFsIGJ1c2luZXNzIGhvdXJzLCBidXQgY291 bGQgd29yayBvbiB0aGUgcHJvamVjdCB0b21vcnJvdyAoRnJpZGF5KSBldmVuaW5nIGFuZCBTYXR1 cmRheS4KPj4KPj4gT24gVGh1LCBBdWcgOSwgMjAxOCBhdCA5OjEyIFBNIEFkYW0gSmltZXJzb24g PHZlbmRpb25AZ21haWwuY29tPiB3cm90ZToKPj4KPj4+IEhlbGxvLAo+Pj4KPj4+IEkgZnJpZW5k IG9mIG1pbmUgcmVhY2hlZCBvdXQgZm9yIGhlbHAgcmVtb3ZpbmcgYSBtYWxpY2lvdXMgQml0Y29p biBtaW5lciBvZmYgb25lIG9mIGhpcyBjbGllbnRzIHNlcnZlcnMuIElmIGFueW9uZSBoYXMgZXhw ZXJpZW5jZSBhbmQgdGltZSBJIGNhbiBwYXNzIG9uIHlvdXIgY29udGFjdCBpbmZvcm1hdGlvbiB0 byBoaW0gc28geW91IGNhbiBoYXNoIG91dCBkZXRhaWxzIGRpcmVjdGx5Lgo+Pj4gX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KPj4+IENodWdhbHVnIG1haWxp bmcgbGlzdAo+Pj4gQ2h1Z2FsdWdAY2h1Z2FsdWcub3JnCj4+PiBodHRwOi8vY2h1Z2FsdWcub3Jn L2NnaS1iaW4vbWFpbG1hbi9saXN0aW5mby9jaHVnYWx1Zwo+Pgo+PiAtLQo+Pgo+PiBEYXZpZCBX aGl0ZQo+Cj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Cj4+IENodWdhbHVnIG1haWxpbmcgbGlzdAo+PiBDaHVnYWx1Z0BjaHVnYWx1Zy5vcmcKPj4gaHR0 cDovL2NodWdhbHVnLm9yZy9jZ2ktYmluL21haWxtYW4vbGlzdGluZm8vY2h1Z2FsdWc= X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KQ2h1Z2FsdWcg bWFpbGluZyBsaXN0CkNodWdhbHVnQGNodWdhbHVnLm9yZwpodHRwOi8vY2h1Z2FsdWcub3JnL2Nn aS1iaW4vbWFpbG1hbi9saXN0aW5mby9jaHVnYWx1Zwo=

=============================================================== From: Stephen Kraus ------------------------------------------------------ Backup what you want and format. Never assume it's clean On Fri, Aug 10, 2018, 10:07 AM JustinMcAfee wrote: t or e at there w d

=============================================================== From: Adam Jimerson ------------------------------------------------------ Thanks everyone I'll make sure that your comments are passed on. On Fri, Aug 10, 2018 at 10:37 AM Stephen Kraus wrote: hat there get is x r