Recognising the Symptoms of a Compromised System
A cryptominer or high-CPU malware often leaves discernible traces that can impact your system's performance and stability. Being aware of these symptoms is the first step in identifying a potential infection.
- Unexpectedly high CPU usage, even when the computer is idle or performing light tasks.
- Your computer's fan running loudly and continuously, indicating increased heat generation.
- A general sluggishness or unresponsiveness of the system, making common tasks frustratingly slow.
- Your battery draining much faster than usual on laptops or portable devices.
- Unexplained network activity or increased data usage, especially if you have a limited data plan.
Good to know
These symptoms alone don't confirm malware, but they warrant further investigation and should not be ignored.
Investigating with System Monitoring Tools
Linux offers several powerful command-line tools to monitor system resources. These tools can help you pinpoint processes consuming excessive CPU and identify potential rogue applications.
- Open your terminal and type
top. This command provides a dynamic real-time view of running processes. Look for processes consuming a high percentage under the 'CPU%' column. - Alternatively, use
htopfor a more interactive and visually appealing process viewer. You might need to install it first withsudo apt install htop. - To see which processes are using the most CPU, you can sort the output in
topby pressingP(for CPU usage). Inhtop, you can click on the 'CPU%' column header. - Pay close attention to unfamiliar process names or legitimate-looking processes (like 'systemd') that are consuming an unusually high amount of CPU.
Tip
Before acting on any suspicious process, note its process ID (PID) and the user it's running under.
Checking Process Details and Locations
Once you've identified a suspicious process, it's crucial to gather more information about it, including its full command and file path, to confirm if it's legitimate or malicious.
- With the PID of the suspicious process, use
ps aux | grep <PID>to display detailed information, including the full command that launched it. - Examine the output for the full path of the executable. Malware often runs from obscure or temporary directories, such as
/tmpor hidden folders within your home directory. - Check the user associated with the process. If a system-level process is running under a regular user's account, it could be suspicious.
- Look for unusual arguments or flags in the command line that might suggest a hidden or malicious intent.
Important
Do not delete or modify any files or processes at this stage, as this could destabilise your system or destroy forensic evidence.
Verifying Network Connections and Open Ports
Cryptominers and other malware often establish network connections to communicate with command-and-control servers or to transfer mined cryptocurrency. Checking network activity can provide further evidence.
- Use
netstat -tulnpto list all active network connections and listening ports, along with the process IDs and program names. - Look for unfamiliar outbound connections to unusual IP addresses or ports.
- Cross-reference the process IDs from the network connections with the suspicious processes you identified earlier.
- You can use
lsof -ito get a similar list of internet and network files opened by processes. - Pay attention to connections to known cryptocurrency pools or regions you don't typically connect to.
Good to know
Legitimate applications also use network connections, so always verify suspicious connections against expected behaviour.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers