SHARE
TWEET

Untitled

ElectronicWizard May 26th, 2019 (edited) 97 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. My DigitalOcean server was infected on 5/25 with a Crypto-Miner botnet malware.
  2. It comprised 3 parts:
  3. A) The Crypto-Miner: maxed out my CPU to mine monero. That's what made me notice something was off.
  4. B) Backdoor/persistence/rootkit module. Killed logs, made itself restart when killed.
  5. C) Unsure as of currently.
  6.  
  7. From reversing the (B) module, it connects to a Command and Control Server, with the IP of 146.185.171.227. This IP is hosted on DigitalOcean's servers, and is currently programmed to crawl through DigitalOcean's network, infecting as it goes.
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top