| 123456789101112131415161718192021222324252627282930313233343536373839404142 |
- #!/bin/bash
- #########################################################################
- # Script for finding miners #
- # Created by Pavol Macko - DoIT #
- #########################################################################
- clear
- echo "------------------------------------------------------------------"
- echo -e "- \e[1;32mChecking\e[0m process with \e[1;33mhigh\e[0m CPU"
- echo "------------------------------------------------------------------"
- ps -eo pid,user,%cpu,%mem,cmd --sort=-%cpu | head -10
- echo "------------------------------------------------------------------"
- echo -e "- \e[1;32mFinding\e[0m running \e[1;33mminers\e[0m process"
- echo "------------------------------------------------------------------"
- ps aux | grep -Ei \
- 'xmrig|minerd|cpuminer|cgminer|bfgminer|nbminer|phoenixminer|trex|nanominer|lolminer|teamredminer' \
- | grep -v grep
- echo "------------------------------------------------------------------"
- echo -e "- \e[1;32mFinding\e[0m temporary \e[1;33mminers\e[0m process"
- echo "------------------------------------------------------------------"
- ps -eo pid,cmd | grep -E '/tmp|/dev/shm' | grep -v grep
- echo "------------------------------------------------------------------"
- echo -e "- \e[1;32mFinding\e[0m connection \e[1;33mminers\e[0m ports"
- echo "------------------------------------------------------------------"
- ss -tupn 2>/dev/null | grep -E ':1012|:3333|:4444|:5555|:6666|:7777|:8888|:9999|:14444|:14433'
- echo "------------------------------------------------------------------"
- echo -e "- \e[1;32mFinding\e[0m binary \e[1;33mminers\e[0m file"
- echo "------------------------------------------------------------------"
- find / -type f 2>/dev/null | grep -Ei \
- 'xmrig|minerd|cpuminer|cgminer|bfgminer|nbminer|phoenixminer|trex|nanominer|lolminer|teamredminer' | head -10
- echo "------------------------------------------------------------------"
- echo -e "- \e[1;32mFinding\e[0m cron \e[1;33mminers\e[0m schedulers"
- echo "------------------------------------------------------------------"
- for user in $(cut -f1 -d: /etc/passwd);
- do
- crontab -u "$user" -l 2>/dev/null
- done
- echo "------------------------------------------------------------------"
- echo -e "- \e[1;32mFinding\e[0m systemd \e[1;33mminers\e[0m services"
- echo "------------------------------------------------------------------"
- systemctl list-unit-files --type=service 2>/dev/null | \
- grep -Ei 'xmrig|miner|crypto|mining'
- echo "------------------------------------------------------------------"
|
