== /tmp/ir_out/10.191.5.223.log ============================================================ host_ir_tool CLEAN frontend05 2026-10-29 05:39:32 ============================================================ === IDENTITY === TIME|2026-10-29 05:39:32 +0800 HOST|frontend05 MODE|CLEAN EVIDENCE|/root/ir_evidence_frontend05__20261029_053932 uid=0(root) gid=0(root) groups=0(root) === ROOTKIT_AND_C2 === FILE|/usr/lib64/libnuma_hint.so|type=regular file|size=139328|mode=755|uid=0|gid=0|mtime=2022-06-12 19:52:42.000000000 +0800 ca90137ec7f88f9426e2a0b591d125b6ee20f75b30e4fd9445cdbbf402594a57 /usr/lib64/libnuma_hint.so FINDING|1|HIGH|发现 hpgoc2 恶意库|/usr/lib64/libnuma_hint.so file /usr/lib64/libnuma_hint.so is not owned by any package libhpgoc2_oss_v2_core.so hpgoc2.oss.v2.core hpgoc2.oss.v2.core FINDING|2|HIGH|进程仍加载恶意库|/proc/23807/maps:7f5e3af2a000-7f5e3af36000 r--p 00000000 fd:00 44686 /usr/lib64/libnuma_hint.so /proc/23807/maps:7f5e3af36000-7f5e3af45000 r-xp 0000c000 fd:00 44686 /usr/lib64/libnuma_hint.so /proc/23807/maps:7f5e3af45000-7f5e3af4b000 r--p 0001b000 fd:00 44686 /usr/lib64/libnuma_hint.so /proc/23807/maps:7f5e3af4b000-7f5e3af4c000 r--p 00020000 fd:00 44686 /usr/lib64/libnuma_hint.so /proc/23807/maps:7f5e3af4c000-7f5e3af4d000 rw-p 00021000 fd:00 44686 /usr/lib64/libnuma_hint.so /proc/23808/maps:7f5e3af2a000-7f5e3af36000 r--p 00000000 fd:00 44686 /usr/lib64/libnuma_hint.so /proc/23808/maps:7f5e3af36000-7f5e3af45000 r-xp 0000c000 fd:00 44686 /usr/lib64/libnuma_hint.so /proc/23808/maps:7f5e3af45000-7f5e3af4b000 r--p 0001b000 fd:00 44686 /usr/lib64/libnuma_hint.so /proc/23808/maps:7f5e3af4b000-7f5e3af4c000 r--p 00020000 fd:00 44686 /usr/lib64/libnuma_hint.so /proc/23808/maps:7f5e3af4c000-7f5e3af4d000 rw-p 00021000 fd:00 44686 /usr/lib64/libnuma_hint.so FINDING|3|HIGH|发现 hpgoc2 socket|u_str LISTEN 0 8 @hpgoc2.oss.v2.core -727395380 * 0 users:(("irqbalance",pid=23808,fd=3)) FINDING|4|HIGH|irqbalance 二进制被修改|S.5....T. /usr/sbin/irqbalance === KNOWN_FILES_AND_PERSISTENCE === 3072 SHA256:Dc2gzltOpDCuzch/HeuvGej93lU7F/89Y9nWEN3okJ4 root@meitiyun-backed01 (RSA) 2048 SHA256:ElXDvXQkoGKvCQ8IEvkY23PwWAd8Wet+2kYmW/gQ9GA root@localhost.domain.com (RSA) 2048 SHA256:4ZVM1Kdf2hmT74WWDh928pKVLAo1U0QQdOMaUTWr5g8 root@meitiyun-publish (RSA) 3072 SHA256:Dc2gzltOpDCuzch/HeuvGej93lU7F/89Y9nWEN3okJ4 root@meitiyun-backed01 (RSA) 3072 SHA256:XIozaNjagS3mqlblvtGNuYWrV0iqZSz30iBVMjxJ6mo ops@meitiyun-backed01 (RSA) === PHP_AND_WEBSHELL === === UPLOAD_RANDOM_PHP_DISCOVERY === === MEMFD_AND_ALIYUN_DISGUISE === === ATTACK_TOOLS === FILE|/tmp/run.sh|type=regular file|size=58|mode=644|uid=10000|gid=10000|mtime=2026-10-23 09:09:29.373473432 +0800 7372a4845433278caac29ce7c9accca825302c1f59453fdb2ed1e888e7452150 /tmp/run.sh FINDING|5|HIGH|发现攻击工具或攻击痕迹|/tmp/run.sh === ACCOUNTS_AND_SUID === === CLEAN_ACTIONS === CLEAN|1|已备份 /usr/sbin/irqbalance -> /root/ir_evidence_frontend05__20261029_053932/_usr_sbin_irqbalance CLEAN|2|已停止 irqbalance，恶意 socket 和内存加载进程应随之退出 http://10.191.17.210/UYi/7/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://10.191.17.210/UYi/7/x86_64/repodata/repomd.xml: (28, 'Connection timed out after 10001 milliseconds') Trying other mirror. One of the configured repositories failed (uyi0), and yum doesn't have enough cached data to continue. At this point the only safe thing yum can do is fail. There are a few ways to work "fix" this: 1. Contact the upstream for the repository and get them to fix the problem. 2. Reconfigure the baseurl/etc. for the repository, to point to a working upstream. This is most often useful if you are using a newer distribution release than is supported by the repository (and the packages for the previous distribution release still work). 3. Run the command with the repository temporarily disabled yum --disablerepo=uyi0 ... 4. Disable the repository permanently, so yum won't use it by default. Yum will then just ignore the repository until you permanently enable it again or use --enablerepo for temporary usage: yum-config-manager --disable uyi0 or subscription-manager repos --disable=uyi0 5. Configure the failing repository to be skipped, if it is unavailable. Note that yum will try to contact the repo. when it runs most commands, so will have to try and fail each time (and thus. yum will be be much slower). If it is a very temporary problem though, this is often a nice compromise: yum-config-manager --save --setopt=uyi0.skip_if_unavailable=true failure: repodata/repomd.xml from uyi0: [Errno 256] No more mirrors to try. http://10.191.17.210/UYi/7/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://10.191.17.210/UYi/7/x86_64/repodata/repomd.xml: (28, 'Connection timed out after 10001 milliseconds') NOTE|Yum 重装失败或超时，尝试限时升级恢复 http://10.191.17.210/UYi/7/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://10.191.17.210/UYi/7/x86_64/repodata/repomd.xml: (28, 'Connection timed out after 10001 milliseconds') Trying other mirror. One of the configured repositories failed (uyi0), and yum doesn't have enough cached data to continue. At this point the only safe thing yum can do is fail. There are a few ways to work "fix" this: 1. Contact the upstream for the repository and get them to fix the problem. 2. Reconfigure the baseurl/etc. for the repository, to point to a working upstream. This is most often useful if you are using a newer distribution release than is supported by the repository (and the packages for the previous distribution release still work). 3. Run the command with the repository temporarily disabled yum --disablerepo=uyi0 ... 4. Disable the repository permanently, so yum won't use it by default. Yum will then just ignore the repository until you permanently enable it again or use --enablerepo for temporary usage: yum-config-manager --disable uyi0 or subscription-manager repos --disable=uyi0 5. Configure the failing repository to be skipped, if it is unavailable. Note that yum will try to contact the repo. when it runs most commands, so will have to try and fail each time (and thus. yum will be be much slower). If it is a very temporary problem though, this is often a nice compromise: yum-config-manager --save --setopt=uyi0.skip_if_unavailable=true failure: repodata/repomd.xml from uyi0: [Errno 256] No more mirrors to try. http://10.191.17.210/UYi/7/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://10.191.17.210/UYi/7/x86_64/repodata/repomd.xml: (28, 'Connection timed out after 10001 milliseconds') NOTE|包管理恢复失败，尝试从应急服务器下载：http://124.222.99.37:5566/irqbalance-1.7.0-1.1.an7.x86_64.rpm CLEAN|3|回退 RPM 已通过官方镜像 SHA256 固定值校验 warning: /root/ir_evidence_frontend05__20261029_053932/irqbalance-1.7.0-1.1.an7.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 4873f7c5: NOKEY Preparing... ######################################## warning: /root/ir_evidence_frontend05__20261029_053932/irqbalance-1.7.0-1.1.an7.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 4873f7c5: NOKEY Preparing... ######################################## Updating / installing... irqbalance-3:1.7.0-1.1.an7 ######################################## Cleaning up / removing... irqbalance-3:1.7.0-1.1.uelc20 ######################################## CLEAN|4|已通过 5566 回退 RPM 恢复 irqbalance CLEAN|5|irqbalance 二进制已通过 RPM 校验 CLEAN|6|已备份 /usr/lib64/libnuma_hint.so -> /root/ir_evidence_frontend05__20261029_053932/_usr_lib64_libnuma_hint.so CLEAN|7|已删除文件 /usr/lib64/libnuma_hint.so CLEAN|8|已启动恢复后的 irqbalance CLEAN|9|irqbalance 验收通过：RPM 正常、服务 active、无恶意 maps/socket MANUAL|1|恶意 systemd 服务禁用失败或服务已不存在，需复核 MANUAL|2|恶意 systemd 服务停止失败或服务已不存在，需复核 NOTE|未发现按 EXE 匹配的 C2 进程 CLEAN|10|已备份 /tmp/pk -> /root/ir_evidence_frontend05__20261029_053932/_tmp_pk CLEAN|11|已删除目录 /tmp/pk === POST_CLEAN_VERIFY === VERIFY|PASS|未发现已知恶意进程 VERIFY|PASS|未发现 122.10.49.214:50051 当前连接 VERIFY|PASS|恶意服务非运行状态：unknown VERIFY|PASS|文件不存在：/usr/lib/systemd/systemd-journal-37897c VERIFY|PASS|文件不存在：/etc/systemd/system/systemd-journal-37897c.service VERIFY|PASS|文件不存在：/etc/systemd/system/multi-user.target.wants/systemd-journal-37897c.service VERIFY|PASS|文件不存在：/etc/cron.d/vmsprobe VERIFY|PASS|文件不存在：/etc/cron.d/tvcanary2 VERIFY|PASS|文件不存在：/etc/cron.d/tvcron1 VERIFY|PASS|文件不存在：/data/go-vms/upload/20261027/a6e/aa2234010a6e.php VERIFY|PASS|文件不存在：/data/go-vms/upload/20261028/pwnout.txt VERIFY|PASS|文件不存在：/data/go-vms/upload/20261028/pwn12.txt VERIFY|PASS|文件不存在：/usr/lib64/libnuma_hint.so VERIFY|PASS|root crontab 无恶意引用 VERIFY|PASS|systemd/cron 未发现恶意引用 VERIFY|PASS|恶意 SSH 公钥不存在：/root/.ssh/authorized_keys VERIFY|PASS|恶意 SSH 公钥不存在：/home/ops/.ssh/authorized_keys VERIFY|PASS|未发现进程加载 libnuma_hint VERIFY|PASS|ld.so.preload 未发现目标恶意库 NOTE|本次验收为当前时点检查，仍需观察文件、进程和 C2 是否后续重生 === BUSINESS_HEALTH === BUSINESS|PASS|进程存在：nginx MANUAL|3|业务进程未找到：coco-tms BUSINESS|PASS|进程存在：uos-license-agent MANUAL|4|业务端口未监听：13350 MANUAL|5|业务端口未监听：13355 === SUMMARY === FINDINGS=5 HIGH=5 MEDIUM=0 CLEAN_ACTIONS=11 MANUAL_REVIEW=5 RESULT=CONFIRMED_COMPROMISE EVIDENCE_DIR=/root/ir_evidence_frontend05__20261029_053932 POST_CLEAN_CHECK=复核 libnuma_hint maps、hpgoc2 socket、irqbalance RPM 校验、hc2 是否重生、memfd/.ov2 是否重生，以及 PHP data:// 计数是否继续增加。 ### TMPTXT_TAIL 2129:hpgoc2.oss.v2.core 2130:hpgoc2.oss.v2.core 2131:FINDING|2|HIGH|进程仍加载恶意库|/proc/23807/maps:7f5e3af2a000-7f5e3af36000 r--p 00000000 fd:00 44686 /usr/lib64/libnuma_hint.so 2132:/proc/23807/maps:7f5e3af36000-7f5e3af45000 r-xp 0000c000 fd:00 44686 /usr/lib64/libnuma_hint.so 2133:/proc/23807/maps:7f5e3af45000-7f5e3af4b000 r--p 0001b000 fd:00 44686 /usr/lib64/libnuma_hint.so 2134:/proc/23807/maps:7f5e3af4b000-7f5e3af4c000 r--p 00020000 fd:00 44686 /usr/lib64/libnuma_hint.so 2135:/proc/23807/maps:7f5e3af4c000-7f5e3af4d000 rw-p 00021000 fd:00 44686 /usr/lib64/libnuma_hint.so 2136:/proc/23808/maps:7f5e3af2a000-7f5e3af36000 r--p 00000000 fd:00 44686 /usr/lib64/libnuma_hint.so 2137:/proc/23808/maps:7f5e3af36000-7f5e3af45000 r-xp 0000c000 fd:00 44686 /usr/lib64/libnuma_hint.so 2138:/proc/23808/maps:7f5e3af45000-7f5e3af4b000 r--p 0001b000 fd:00 44686 /usr/lib64/libnuma_hint.so 2139:/proc/23808/maps:7f5e3af4b000-7f5e3af4c000 r--p 00020000 fd:00 44686 /usr/lib64/libnuma_hint.so 2140:/proc/23808/maps:7f5e3af4c000-7f5e3af4d000 rw-p 00021000 fd:00 44686 /usr/lib64/libnuma_hint.so 2141:FINDING|3|HIGH|发现 hpgoc2 socket|u_str LISTEN 0 8 @hpgoc2.oss.v2.core -727395380 * 0 users:(("irqbalance",pid=23808,fd=3)) 2166:CLEAN|2|已停止 irqbalance，恶意 socket 和内存加载进程应随之退出 2252:CLEAN|6|已备份 /usr/lib64/libnuma_hint.so -> /root/ir_evidence_frontend05__20261029_053932/_usr_lib64_libnuma_hint.so 2253:CLEAN|7|已删除文件 /usr/lib64/libnuma_hint.so 2255:CLEAN|9|irqbalance 验收通过：RPM 正常、服务 active、无恶意 maps/socket 2275:VERIFY|PASS|文件不存在：/usr/lib64/libnuma_hint.so 2280:VERIFY|PASS|未发现进程加载 libnuma_hint 2299:POST_CLEAN_CHECK=复核 libnuma_hint maps、hpgoc2 socket、irqbalance RPM 校验、hc2 是否重生、memfd/.ov2 是否重生，以及 PHP data:// 计数是否继续增加。