Malware family: Ebury

I received an email from the abuse team informing me that two of my servers have malware from the Ebury family.

The email does not provide any further details. Is it possible that this is a false positive?

I create a script that uses several techniques to try to identify ebury on the server, but nothing was found.

Shared Host with almalinux and directadmin.

The script I used checks:

🧠 Memory (/proc/$pid/maps) of sshd processes — identifying maliciously loaded libraries;

🗃️ Strings and symbols in suspicious libraries (libssl, libcrypto, libkeyutils);

🔍 Validation of specific strings such as Xcat, credential harvest, malformed SSH-2.0-* in logs and binaries;

🔐 sshd integrity check via hash + RPM + .debug section;

📊 Scoring system to validate real infection, reducing false positives. 

log:

[2025-06-30 14:18:32] [INFO] Starting Ebury detection scan
[2025-06-30 14:18:32] [INFO] SSH daemon path: /usr/sbin/sshd
[2025-06-30 14:18:32] [INFO] SSH daemon size: 890640 bytes
[2025-06-30 14:18:32] [INFO] SSH daemon SHA256: 50274e0a25bfa3a28c839ce31a1661522d6bd78c1561190f00e3f140be714e06
[2025-06-30 14:18:32] [INFO] SSH version: OpenSSH_8.0p1
[2025-06-30 14:18:32] [INFO] === SSH BINARY DETAILED ANALYSIS ===
[2025-06-30 14:18:32] [INFO] File created: Fri Mar 14 22:13:17 -03 2025
[2025-06-30 14:18:32] [INFO] File modified: Wed Feb 19 17:59:40 -03 2025
[2025-06-30 14:18:32] [INFO] File accessed: Sun Jun 29 20:00:33 -03 2025
[2025-06-30 14:18:32] [INFO] Package: openssh-server-xxxxxx
[2025-06-30 14:18:32] [INFO] Package version: 8.0p1-25.el8_10.alma.1
[2025-06-30 14:18:32] [INFO] Package install date: Fri 14 Mar 2025 10:13:17 PM -03
[2025-06-30 14:18:32] [INFO] File type: /usr/sbin/sshd: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=xxxxxxxxxxxxxxxxxxxxxx, stripped
[2025-06-30 14:18:32] [INFO] Suspicious sections: no suspicious sections
[2025-06-30 14:18:32] [INFO] Linked libraries: linux-vdso.so.1 /lib64/ld-linux-x86-64.so.2 
[2025-06-30 14:18:32] [INFO] SSH version string: OpenSSH_8.0p1
[2025-06-30 14:18:32] [INFO] SSH hash verification: OpenSSH_8.0p1 AlmaLinux 8 (CLEAN)
[2025-06-30 14:18:32] [INFO] Days since SSH binary modification: 130
[2025-06-30 14:18:32] [INFO] No Ebury strings found in SSH binary
[2025-06-30 14:18:35] [INFO] Active SSH processes found
[2025-06-30 14:18:35] [INFO] SSH Process: root     2070771  0.0  0.0  76732  7384 ?        Ss   Mar14   0:00 /usr/sbin/sshd -D -oCiphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,xxxxxxxxxxx
[2025-06-30 14:18:35] [INFO] SSH Process: root     2580784  0.0  0.0 126560  9052 ?        Ss   10:35   0:00 sshd: root [priv]
[2025-06-30 14:18:35] [INFO] SSH Process: root     2580798  0.0  0.0 126560  5352 ?        S    10:35   0:00 sshd: root@pts/0
[2025-06-30 14:18:35] [INFO] SSH Process: root     2648426  0.0  0.0 126560  9012 ?        Ss   11:06   0:00 sshd: root [priv]
[2025-06-30 14:18:35] [INFO] SSH Process: root     2648449  0.0  0.0 126684  5892 ?        S    11:06   0:00 sshd: root@notty
[2025-06-30 14:18:35] [INFO] SSH listening ports:
[2025-06-30 14:18:35] [INFO] SSH Port: LISTEN 0      128          0.0.0.0:19111      0.0.0.0:*    users:(("sshd",pid=2070771,fd=3))
[2025-06-30 14:18:35] [INFO] SSH Port: LISTEN 0      128             [::]:19111         [::]:*    users:(("sshd",pid=2070771,fd=4))
[2025-06-30 14:18:35] [INFO] SSH Port: LISTEN 0      2048               *:2222             *:*    users:(("directadmin",pid=1086918,fd=8))
[2025-06-30 14:18:35] [INFO] Port 2222 used by DirectAdmin (legitimate)
[2025-06-30 16:31:45] [ALERT] Malicious library in SSH process: PID 2070771
[2025-06-30 16:31:45] [ALERT] Malicious library in SSH process: PID 2580784
[2025-06-30 16:31:45] [ALERT] Malicious library in SSH process: PID 2580798
[2025-06-30 16:31:45] [ALERT] Malicious library in SSH process: PID 2648426
[2025-06-30 16:31:45] [ALERT] Malicious library in SSH process: PID 2648449
[2025-06-30 16:31:45] [INFO] Active SSH connections found
[2025-06-30 16:31:45] [INFO] No infected libraries detected
[2025-06-30 16:31:45] [INFO] SSH daemon last modified: Wed Feb 19 17:59:40 -03 2025
[2025-06-30 16:31:45] [INFO] Timeline analysis completed
[2025-06-30 16:31:45] [INFO] No orphaned SSH [accepted] processes found
[2025-06-30 16:31:45] [INFO] No suspicious large SHM segments found
[2025-06-30 16:31:45] [ALERT] Suspicious abstract sockets: 1
[2025-06-30 16:31:46] [ALERT] Abstract socket: exim      3204912             mail    3u  unix 0xffff9183b6245580      0t0 2305675310 @/var/spool/exim/exim_daemon_notify type=DGRAM
[2025-06-30 16:31:46] [INFO] SSH binary files integrity verified
[2025-06-30 16:31:46] [INFO] SSH config files modified (normal for administration)
[2025-06-30 16:31:46] [INFO] Config change (legitimate): S.5....T.  c /etc/ssh/sshd_config

Hello,

An abusive behaviour (Malware) originating from your dedicated server nsXXXXXX[.]ip-XXX-XXX-XXX[.]net has been reported to or noticed by our Abuse Team.

Technical details showing the aforementioned problem follow :

-- start of the technical details --

Category: Malware

---- about ----

XXX[.]XXX[.]XXX[.]XXX (on SSH port)

---- Description ----

Malware family: Ebury


-- end of the technical details --

Your should investigate and fix this problem, as it constitutes a violation to our terms of service.

Please answer to this e-mail indicating which measures you've taken to stop the abusive behaviour.

Cordially,

The OVHcloud Trust & Safety team.