halfgaar wrote:teofiloh wrote:The malware is getting worse. Now if you delete if from /tmp it starts downloading in /var/tmp and there are no l.sh nor s.sh files around.
It's using wget to download the zmcat to the server if you delete it every 10-15 seconds.
Looked for jsp files and didn't find anything suspicious around.
Is there a way to prevent linux from creating the zmcat file for example? so that if deletes it immediately?
for the time being I removed the wget program to avoid the automatic download of the zmcat file to the server.
Why did you not do anything I suggested? Do you see suspecious entries with shell commands in the logs? Do you have suspicous keys in /opt/zimbra/.ssh/authorized_keys? Did you regenerate the keys?
I also think you're missing the point of the hack. You're asking to block the zmcat, but using your CPU for mining is one thing. Still having access is the real problem. Who knows what they will do next.
I know the zmcat is just the surface of the problem and that the real problem is the access to the server.
I checked the log files and found this in access log:
188.8.131.52 - - [25/Apr/2019:02:29:43 +0000] "GET //a2billing/customer/templates/default/footer.tpl HTTP/1.1" 404 - "-" "python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-957.10.1.el7.x86_64" 97
There are no modifications to user access/login information for the time being.