Hospital xmrig 24h Cycle Verify Report

Sprint: hospital-xmrig-cycle-verify-20260501 (post-eradicate) Run: 2026-05-01T14:00:04+09:00 Verdict: PASS Cycle window: 2026-05-01 04:55 UTC (=13:55 KST), checked at 05:00 UTC (=14:00 KST)

---

=== xmrig cycle verify start: 2026-05-01T14:00:04+09:00 ===

1. /var/log/miner-scan.log 마지막 50줄

[Sat Apr 25 02:37:17 PM UTC 2026] LOG-TAMPER-ALERT: /var/log/auth.log is missing! [Sat Apr 25 02:37:17 PM UTC 2026] LOG-TAMPER-ALERT: /var/log/syslog is missing! [Sat Apr 25 02:37:17 PM UTC 2026] Removed 2 threats [Sat Apr 25 02:59:04 PM UTC 2026] CREDENTIAL HARVEST DIR REMOVED: /tmp/.e6d7461dc [Sat Apr 25 02:59:07 PM UTC 2026] Removed 1 threats [Sat Apr 25 03:15:02 PM UTC 2026] THREAT FOUND: xmrig PIDs=1825812 [Sat Apr 25 03:15:08 PM UTC 2026] Removed 1 threats [Sat Apr 25 04:05:46 PM UTC 2026] TEST: hospital guard alert 자동화 정상 동작 검증 [Sat Apr 25 04:05:46 PM UTC 2026] THREAT FOUND: TEST_PATTERN PIDs=99999 [Sat Apr 25 04:05:46 PM UTC 2026] Removed 1 threats (TEST) [Sun Apr 26 03:00:05 AM UTC 2026] MINING-POOL-CONNECTION port=45700 pid=649753 cmd=/usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 5440 -container-ip 172.26.0.3 -container-port 5432 -use-listen-fd [Sun Apr 26 03:00:05 AM UTC 2026] MINING-POOL-CONNECTION port=45700 pid=736795 cmd=node /opt/hospital/apps/api-gateway/dist/apps/api-gateway/src/main.js
[Sun Apr 26 03:00:07 AM UTC 2026] Removed 2 threats [Sun Apr 26 12:15:04 PM UTC 2026] MINING-POOL-CONNECTION port=45700 pid=1487171 cmd=/opt/assistant/apps/ai-service/venv/bin/python3 /opt/assistant/apps/ai-service/venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 7002 [Sun Apr 26 12:15:04 PM UTC 2026] MINING-POOL-CONNECTION port=45700 pid=736691 cmd=node /opt/shop/apps/api/dist/apps/api/src/main.js
[Sun Apr 26 12:15:06 PM UTC 2026] Removed 2 threats [Mon Apr 27 08:40:04 PM UTC 2026] MINING-POOL-CONNECTION port=45700 pid=1262828 cmd=node /opt/assistant/apps/api-gateway/dist/apps/api-gateway/src/main.js
[Mon Apr 27 08:40:04 PM UTC 2026] MINING-POOL-CONNECTION port=45700 pid=2159879 cmd=/opt/assistant/apps/ai-service/venv/bin/python3 /opt/assistant/apps/ai-service/venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 7002 [Mon Apr 27 08:40:06 PM UTC 2026] Removed 2 threats [Tue Apr 28 11:55:01 AM UTC 2026] THREAT FOUND: cryptonight PIDs=610832 [Tue Apr 28 11:55:06 AM UTC 2026] Removed 1 threats [Wed Apr 29 04:14:35 AM UTC 2026] THREAT FOUND: xmrig PIDs=3069856 3069864 [Wed Apr 29 04:14:41 AM UTC 2026] [DRY-RUN] Would remove 1 threats [Wed Apr 29 10:20:01 AM UTC 2026] THREAT FOUND: cryptonight PIDs=94982 [Wed Apr 29 10:20:06 AM UTC 2026] Removed 1 threats [Thu Apr 30 04:55:01 AM UTC 2026] THREAT FOUND: xmrig PIDs=3936263 [Thu Apr 30 04:55:07 AM UTC 2026] Removed 1 threats [Fri May 1 04:50:01 AM UTC 2026] THREAT FOUND: syssls PID=3749113 [Fri May 1 04:50:01 AM UTC 2026] THREAT FOUND: syssls PID=3749111 [Fri May 1 04:50:02 AM UTC 2026] THREAT FOUND: cryptonight PID=3749151 [Fri May 1 04:50:02 AM UTC 2026] THREAT FOUND: cryptonight PID=3749150 [Fri May 1 04:50:02 AM UTC 2026] THREAT FOUND: kaluad PID=3749205 [Fri May 1 04:50:02 AM UTC 2026] THREAT FOUND: kaluad PID=3749203 [Fri May 1 04:50:02 AM UTC 2026] THREAT FOUND: D3iY9nq5 PID=3749241 [Fri May 1 04:50:08 AM UTC 2026] Removed 3 threats [Fri May 1 04:50:08 AM UTC 2026] Removed 4 threats [Fri May 1 05:00:01 AM UTC 2026] THREAT FOUND: monero PID=3786103 [Fri May 1 05:00:01 AM UTC 2026] THREAT FOUND: monero PID=3786105 [Fri May 1 05:00:01 AM UTC 2026] THREAT FOUND: randomx PID=3786192 [Fri May 1 05:00:01 AM UTC 2026] THREAT FOUND: kaluad PID=3786321

2. cycle 발생 여부

✅ 04-30 04:55 UTC 이후 새 THREAT FOUND 0건 — 박멸 PASS

3. /root/.incident_auto/forensic_* 신규 파일

(forensic 파일 0건 — 위협 미발생)

4. /root/.incident_auto/precycle_* (cycle boundary 추적)

-rw-r--r-- 1 root root 59774 May 1 04:50 /root/.incident_auto/precycle_1777611009_pre50.txt -rw-r--r-- 1 root root 70432 May 1 04:50 /root/.incident_auto/precycle_1777611009_ss50.txt -rw-r--r-- 1 root root 59307 May 1 04:55 /root/.incident_auto/precycle_1777611309_pre55.txt -rw-r--r-- 1 root root 70308 May 1 04:55 /root/.incident_auto/precycle_1777611309_ss55.txt

04:55 UTC ps snapshot diff (vs 04:50)

compare: precycle_1777611009_pre50.txt vs precycle_1777611309_pre55.txt 199d198 < 3565282 [kworker/1:2-cgroup_destroy] 237d235 < 3696367 [kworker/2:1-cgroup_destroy] 239c237 < 3696376 [kworker/6:1-events]

3696376 [kworker/6:1-mm_percpu_wq] 244c242 < 3731123 [kworker/4:0-events]

---

3731123 [kworker/4:0-mm_percpu_wq] 247,248c245 < 3733645 [kworker/u16:0-flush-253:0] < 3735482 [kworker/u16:5-events_power_efficient]

---

3733645 [kworker/u16:0-events_power_efficient] 250,252d246 < 3735752 postgres: < 3735754 postgres: < 3735756 postgres: 259,263c253 < 3742931 [kworker/2:0-events] < 3743002 postgres: < 3743004 postgres: < 3743710 postgres: < 3744490 postgres:

---

3742931 [kworker/2:0-cgroup_destroy] 265,267d254

5. assistant-api / pet-api-gateway NRestarts (Restart=on-failure 60s 효과)

assistant-api: NRestarts=382 State=activating pet-api-gateway: NRestarts=383 State=activating

6. /etc/ld.so.preload immutable 유지

----i---------e------- /etc/ld.so.preload

7. 트레이딩 4서버 active 검증

[kahan] gunja-pair-hedge: active gunja-multi-tenant: active gunja-sync-worker: active [gate] gate-pair-hedge: active gate-admin-dashboard: active 1 timers listed. Pass --all to see loaded but inactive timers, too.

8. Telegram 보고

Telegram /api/blog result: OK: {"success":true}