cryptominer warning

[xenios]

I got the below warning today. Any idea?
---------------------
Programs or services that no package installed and that hide themselves as system processes: /etc/systemd/system/ntpd-manual.service(/usr/sbin/ntpd). This matches a known cryptominer. Stop and disable the service, keep a copy of the files for analysis, change the root password and check how they were installed (root shell history, SSH logins).
----------------------
CWPpro version: 1.30.3

[overseer]

Sounds like a very suspicious, illegitimate process. Kill it!

Code Select Expand

systemctl stop ntpd-manual.service
systemctl disable ntpd-manual.service
rm -f /etc/systemd/system/ntpd-manual.service
rm -f /usr/sbin/ntpdReboot.

[Watchdog]

I had this same unit on a CWP server, and here is what I found:

• /usr/sbin/ntpd wasn't owned by any package (rpm -qf). It was a packed Python backdoor with its dates forged, and ntpd-manual.service was its persistence.
• The same box also had three copies of one XMRig miner in /usr/bin under system-looking names (systemd-logind-helpers, polkitd-helpers, dbus-monitor-srv), all exactly the same size. Search for files of identical size in /usr/bin and check them with rpm -qf.
• Use stat's change time, not the modified time, because the modified times were forged.
• ClamAV and maldet found nothing on the full scans.

[overseer]

Definitely ClamAV / maldet are of little utility to search out this recent wave of new miner infections. (And maldet is just a wrapper for ClamAV, so I didn't find it worthwhile to install.)