Unwanted process is running on VM and consuming 98% CPU consistently

Asked Jul 13 '18 at 11:57

Active Jul 13 '18 at 14:48

Viewed 26 times

I could see one of the process running on VM and consuming 98% CPU consistently, it auto starts if i kill the same.
Process details is as below:

root      3740     1 98 11:00 ?        00:49:34 /var/tmp/sustes -c /var/tmp/wm.conf

and the conf file is something as below,

some other details +

"api": {
    "port": 123,                             // port for the miner API https://github.com/xmrig/xmrig/wiki/API
    "access-token": 111,                  // access token for API
    "worker-id": 111                      // custom worker-id for API
}

Please help me out to identify about the same and how to remove that from server.

edited Jul 13 '18 at 14:48

alexander.polomodov

1,060
3
10
14

asked Jul 13 '18 at 11:57

Ranjit

You have a Monero miner running on your server that you don't know about...? Hmm. – Halfgaar Jul 13 '18 at 13:03
How I can remove that ? – Ranjit Jul 13 '18 at 13:06
You've been hacked. Hacking triage is reinstall if you're not 100% sure what the attack vector was, and what was done. – Halfgaar Jul 13 '18 at 13:08
Nuke the whole site from orbit. It's the only way to be sure. – Michael Hampton Jul 13 '18 at 16:55

Unwanted process is running on VM and consuming 98% CPU consistently

0 Answers0