Hello 
One of my servers were hacked recently.The hacker has encrypted all files under directories '/home' and '/var/lib/mysql'.
Hacker has put a banner with the following content:
MySQL server fails with following error:
He had deleted all log files including lastlog,wtmp,utmp,secure ....etc.
Had any one came accross these type of hacks earlier ? Is there any resolution for this ? Is Server reload the only option to recover from this situation ? Does cPanel has any other log files to track this activity ?
Please help .
Thank You.
One of my servers were hacked recently.The hacker has encrypted all files under directories '/home' and '/var/lib/mysql'.
Hacker has put a banner with the following content:
Code:
#cat /root/cryptoshell.message
---------------------------------------------------------------------------
>>>>> WARNING <<<<<<
1 - DON’T DELETE CRYPTOSHELL FILES THAT ARE LOCATED IN “/ETC” FOLDER. THEY WILL BE REQUIRED TO RECOVER YOUR FILES.
2 - ANY ATTEMPT TO TRACK THIS SOFTWARE WILL LEAD TO THE IMMEDIATE DESTRUCTION OF THE PRIVATE KEY. WE USE COUNTLESS SERVERS AND DOMAINS, SO DON’T WASTE YOUR TIME…
---------------------------------------------------------------------------
The important files of this server has been encrypted using a unique public key RSA-2048.
Encrypted files include databases and users file (in home directory).
Here is a complete list of encrypted files: /etc/cryptoshell.encrypted.list
The single copy of the private key, which will allow you to decrypt the files, are located on a secret server on the Internet, and it will be destroyed in the specified time.
To obtain the private key to decrypt files on this server, you need to pay 2 BTC.
After payment, follow the steps below to decrypt all files.
===========================================================================
BE FAST!! YOUR PRIVATE KEY WILL BE DESTROYED IN: 2014-04-03 - 04:57:48 UTC+4
===========================================================================
---------------------------------------------------------------------------
>>>>> PAYMENT <<<<<<
Amount: 2 BTC
Bitcoin address: xxxxxxxxxxxxxxxxx
---------------------------------------------------------------------------
---------------------------------------------------------------------------
>>>>> DECRYPTION <<<<<<
1 - Confirm the payment. Run this command with BitCoin transaction ID: /root/cryptoshell_decrypt TRANSACTION_ID
2 - The software will confirm that the transaction ID has been sent. After this process, you will need to wait for 40 minutes to try run the same command again.
3 - When the transaction ID is approved, the software will start to decrypt all encrypted files.
----------------------------------------------------------------------------
=================================================================================
Code:
========
/etc/init.d/mysql restart
rm: cannot remove `/var/lib/mysql/server.hostname.pid': Operation not permitted
ERROR! MySQL server process #�
����5^H�;��x�N�[ap��b���bQ���Eӕ��:�****1U��6��
V"�K����z!cϲ��Ҟ�Н����GDkU��^����?�[email protected]��
,�"ͰZ�!��6��qf[
0�v�q�$�H�z�攢���
���R��&\��u+<�D-zI����������kh��ن?�o+���(�y��u�k�1?�
�~��!��D�q��R;�V�{�x�C+룘z�P��_���yi��w�j���#>Q���X�V6���5y>�����8`gv�$�p.=
��wυ�a:�K���rS��3\p4�n��5��qzQ�,������%z^��q�;S�G� is not running!
rm: cannot remove `/var/lib/mysql/server.hostname.com.pid': Operation not permitted
Starting MySQL SUCCESS!
========Had any one came accross these type of hacks earlier ? Is there any resolution for this ? Is Server reload the only option to recover from this situation ? Does cPanel has any other log files to track this activity ?
Please help .
Thank You.
