Sample Header Ad - 728x90

High CPU usage by process with obfuscated name on Linux server – Potential attack?

24 votes
2 answers
5818 views
We have been experiencing high load issues on our Linux server recently. Upon checking with the top command, we noticed an unknown process with a garbled command name (as shown in following images; notice that the command name would change after rebooting). This process is consuming a significant amount of CPU resources. screenshot of top showing PID 4712, the command <code class=89cdb92b, run by root, as taking 25,369% CPU with 23.0g virtual memory at uptime 4399:12" class="img-fluid rounded" style="max-width: 100%; height: auto; margin: 10px 0;" loading="lazy"> one-line screenshot of top showing PID 4747, the command <code class=ac1e4262, run by root, as taking 22,528% CPU with 23.0g virtual memory at uptime 958:07" class="img-fluid rounded" style="max-width: 100%; height: auto; margin: 10px 0;" loading="lazy"> We attempted to locate the executable path of this suspicious process, and the server returned the result shown below. The path indicates that the executable file has been deleted: /proc/4747/exe -> '/ac1e4262 (deleted)' From what I understand, this could mean that the process is still running even though its executable file has been removed. This situation might be indicative of a trojan or other malicious activity. My questions: 1. Is this high CPU usage by an unknown process with a garbled command name likely caused by a trojan or some other form of malware? 2. What steps should I take to investigate and resolve this issue to ensure the security and stability of our server?
Asked by yamato (349 rep)
Aug 25, 2024, 12:56 PM
Last activity: Aug 28, 2024, 01:34 PM