1

I have processes named bash64 which are using all my CPU.

If I kill them, it reappears. Their ancestor is a bash process which have systemd as own ancestor.

enter image description here

enter image description here

How to find which process/ systemd unit are running that ?

root@srv1:~# ls -al /proc/$(pidof bash64 | awk '{print $1}')/exe
lrwxrwxrwx 1 root root 0 juil. 29 18:44 /proc/11655/exe -> /root/.tmp00/bash64

root@srv1:~# ls .tmp00
27d96f548d2d99d032c4v1.2.0  bash  bash64  bash.pid  cfg  cfgi  uuid

If I remove the .tmp00 dir, it reappears immediatly.

My system is a baremetal Ubuntu 20.04 on ext4/ssd. I got some issues with DNS resolving recently but which came from my router configuration (but I may have broke something on my desktop).

Improve this question
4
  • Feel free to ask for more details, command outputs – Gaël Jul 29 '20 at 16:23
  • 1
    There is no bash64 in the official repository. So you have to determine its full path by which bash64 or ls -al /proc/$(pidof bash64 | awk '{print $1}')/exe and origin. – N0rbert Jul 29 '20 at 16:39
  • 1
    What operating system is it? Linux distro and version? What file system are you using for your root file system (standard ext4 or something else)? What kind of drive is it (SATA, NVMe or something else)? Is it running on metal or in a virtual machine? -- Can you remember what you did before this happened? What tool or task did you run? – sudodus Jul 29 '20 at 16:52
  • 1
    Your edits in the question does not give me any clue. Maybe someone else will find something. -- Have you tried to shutdown and wait a while? Will these processes appear again after you boot again after 60 seconds? – sudodus Jul 29 '20 at 18:34
2

Your system has been compromised by a cryptominer, probably a SSH worm. I suggest following these steps:

  1. Disconnect your computer from any network
  2. Copy the bash64 file and other files in the same folder to a USB drive, remove the execution attribute (chmod a-x file) from those files.
  3. Copy your personal data from the compromised machine to an appropriate backup device, do not use a network to do this, use USB.
  4. Do a clean re-install of the compromised computer.
  5. Upload the files from step 2 to VirustTotal
Improve this answer
2
  • 1
    You are right. I have found that: otx.alienvault.com/indicator/file/… – Gaël Jul 29 '20 at 18:44
  • 2
    I exposed a ssh port with a very simple password because it was normaly allowed only inside the local network. – Gaël Jul 29 '20 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.