#!/bin/bash
#########################################################################
#                         Script for finding miners                     #
#                       Created by Pavol Macko - DoIT                   #
#########################################################################
clear
echo "------------------------------------------------------------------"
echo -e "- \e[1;32mChecking\e[0m process with \e[1;33mhigh\e[0m CPU"
echo "------------------------------------------------------------------"
ps -eo pid,user,%cpu,%mem,cmd --sort=-%cpu | head -10
echo "------------------------------------------------------------------"
echo -e "- \e[1;32mFinding\e[0m running \e[1;33mminers\e[0m process"
echo "------------------------------------------------------------------"
ps aux | grep -Ei \
'xmrig|minerd|cpuminer|cgminer|bfgminer|nbminer|phoenixminer|trex|nanominer|lolminer|teamredminer' \
| grep -v grep
echo "------------------------------------------------------------------"
echo -e "- \e[1;32mFinding\e[0m temporary \e[1;33mminers\e[0m process"
echo "------------------------------------------------------------------"
ps -eo pid,cmd | grep -E '/tmp|/dev/shm' | grep -v grep
echo "------------------------------------------------------------------"
echo -e "- \e[1;32mFinding\e[0m connection \e[1;33mminers\e[0m ports"
echo "------------------------------------------------------------------"
ss -tupn 2>/dev/null | grep -E ':1012|:3333|:4444|:5555|:6666|:7777|:8888|:9999|:14444|:14433'
echo "------------------------------------------------------------------"
echo -e "- \e[1;32mFinding\e[0m binary \e[1;33mminers\e[0m file"
echo "------------------------------------------------------------------"
find / -type f 2>/dev/null | grep -Ei \
'xmrig|minerd|cpuminer|cgminer|bfgminer|nbminer|phoenixminer|trex|nanominer|lolminer|teamredminer' | head -10
echo "------------------------------------------------------------------"
echo -e "- \e[1;32mFinding\e[0m cron \e[1;33mminers\e[0m schedulers"
echo "------------------------------------------------------------------"
for user in $(cut -f1 -d: /etc/passwd);
do
	crontab -u "$user" -l 2>/dev/null
done
echo "------------------------------------------------------------------"
echo -e "- \e[1;32mFinding\e[0m systemd \e[1;33mminers\e[0m services"
echo "------------------------------------------------------------------"
systemctl list-unit-files --type=service 2>/dev/null | \
grep -Ei 'xmrig|miner|crypto|mining'
echo "------------------------------------------------------------------"