High CPU usage by process with obfuscated name on Linux server – Potential attack?
24
votes
2
answers
5818
views
We have been experiencing high load issues on our Linux server recently. Upon checking with the
top
command, we noticed an unknown process with a garbled command name (as shown in following images; notice that the command name would change after rebooting). This process is consuming a significant amount of CPU resources.
89cdb92b, run by
ac1e4262, run by

root
, as taking 25,369% CPU with 23.0g virtual memory at uptime 4399:12" class="img-fluid rounded" style="max-width: 100%; height: auto; margin: 10px 0;" loading="lazy">

root
, as taking 22,528% CPU with 23.0g virtual memory at uptime 958:07" class="img-fluid rounded" style="max-width: 100%; height: auto; margin: 10px 0;" loading="lazy">
We attempted to locate the executable path of this suspicious process, and the server returned the result shown below. The path indicates that the executable file has been deleted:
/proc/4747/exe -> '/ac1e4262 (deleted)'
From what I understand, this could mean that the process is still running even though its executable file has been removed. This situation might be indicative of a trojan or other malicious activity.
My questions:
1. Is this high CPU usage by an unknown process with a garbled command name likely caused by a trojan or some other form of malware?
2. What steps should I take to investigate and resolve this issue to ensure the security and stability of our server?
Asked by yamato
(349 rep)
Aug 25, 2024, 12:56 PM
Last activity: Aug 28, 2024, 01:34 PM
Last activity: Aug 28, 2024, 01:34 PM