46刀瓦工被植入门罗币挖矿程序

起因

最近发现连接使用的时候很不流畅，重启也是一样的卡，下载速度只有1M,然后就登录ssh看到里面有一个名为swapd的进程，看起来像交换内存的玩意

排查过程

用top -c命令看了一下进程

top - 02:19:13 up 29 min,  2 users,  load average: 2.59, 2.29, 2.11

Tasks: 111 total,   2 running, 109 sleeping,   0 stopped,   0 zombie

%Cpu(s):  8.7 us, 22.6 sy, 67.0 ni,  0.0 id,  0.0 wa,  0.0 hi,  1.7 si,  0.0 st 

MiB Mem :    520.7 total,     12.2 free,    429.8 used,     92.8 buff/cache     

MiB Swap:   2337.0 total,   2099.2 free,    237.8 used.     90.9 avail Mem 



    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND                                                 

    492 root      39  19  527256 264148   1920 S  69.7  49.5  20:46.35 /root/.swapd/swapd -c /root/.swapd/swapfile             

    696 root      20   0   18788   5980   5272 S   5.0   1.1   0:36.88 sshd: root@pts/0,pts/1                                  

    857 root      20   0   12984   4236   2740 S   2.6   0.8   0:21.43 top                                                     

     28 root      20   0       0      0      0 S   2.4   0.0   0:01.68 [kcompactd0]                                            

  13179 root      20   0   11928   5096   3156 R   2.4   1.0   0:00.67 top -c                                                  

  13370 root      20   0   11396   4444   2920 S   2.1   0.8   0:00.07 ps -HewO lstart ex                                      

     14 root      20   0       0      0      0 S   0.3   0.0   0:07.90 [ksoftirqd/0]                                           

     15 root      20   0       0      0      0 I   0.3   0.0   0:03.25 [rcu_preempt]                                           

      1 root      20   0  102220   3104   2520 S   0.0   0.6   0:05.91 /sbin/init                                              

      2 root      20   0       0      0      0 S   0.0   0.0   0:00.00 [kthreadd]                                              

      3 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 [rcu_gp]                                                

      4 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 [rcu_par_gp]                                            

      5 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 [slub_flushwq]                                          

      6 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 [netns]                                                 

      8 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 [kworker/0:0H-events_highpri]                           

      9 root      20   0       0      0      0 I   0.0   0.0   0:02.98 [kworker/u2:0-flush-8:0]                                

     10 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 [mm_percpu_wq]                                          

     11 root      20   0       0      0      0 I   0.0   0.0   0:00.00 [rcu_tasks_kthread]                                     

     12 root      20   0       0      0      0 I   0.0   0.0   0:00.00 [rcu_tasks_rude_kthread]                                

     13 root      20   0       0      0      0 I   0.0   0.0   0:00.00 [rcu_tasks_trace_kthread]                               

     16 root      rt   0       0      0      0 S   0.0   0.0   0:00.00 [migration/0]                                           

     18 root      20   0       0      0      0 S   0.0   0.0   0:00.00 [cpuhp/0]         



    

  

找到了/root/.swapd/swapd -c /root/.swapd/swapfile

进去一看直接就是挖矿的地址以及钱包的地址

{

    "autosave": false,

    "donate-level": 0,

    "cpu": true,

    "opencl": false,

    "cuda": false,

    "pools": [

        {

            "coin": "monero",

            "algo": "rx/0",

            "url": "212.227.165.247:80",

            "user": "49KnuVqYWbZ5AVtWeCZpfna8dtxdF9VxPcoFjbDJz52Eboy7gMfxpbR2V5HJ1PWsq566vznLMha7k38mmrVFtwog6kugWso",

            "pass": "我瓦工的IP",

            "keepalive": true,

            "tls": false

        }

    ]

}



    

  

发现是一个星期前被植入的

root@SoftBank:~# stat /root/.swapd/swapfile

  File: /root/.swapd/swapfile

  Size: 460             Blocks: 8          IO Block: 4096   regular file

Device: 8,2     Inode: 537         Links: 1

Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)

Access: 2026-07-11 10:05:34.703991430 -0700

Modify: 2026-07-11 10:05:34.703991430 -0700

Change: 2026-07-11 10:05:34.707991529 -0700

 Birth: 2026-07-11 10:05:34.703991430 -0700



    

  

登录我VPS的IP为93.244.129.192