topic Re: "obamal" process consumes High CPU 100% in Mgmt server R80.20 with latest JHF in General Topics

"obamal" process consumes High CPU 100% in Mgmt server R80.20 with latest JHF

Vinodhini — Wed, 22 Jul 2020 13:07:42 GMT

Dear All,

I have customer Mgmt server 80.20 with latest JHF.

In "top" command - could see "obamal" process taking 100% High CPU. SO unable to open SmartConsole.

The appliance rebooted a day before only, still no luck. Unable to get what this process is about. no much details in messages file also.

Attached screenshot. Can anyone give shed some info on this please....

Regards, Vinodhini

Re: "obamal" process consumes High CPU 100% in Mgmt server R80.20 with latest JHF

PhoneBoy — Fri, 24 Jul 2020 20:03:13 GMT

I've never seen that process before and there's not even anything in SK about it.
Recommend a TAC case.

Re: "obamal" process consumes High CPU 100% in Mgmt server R80.20 with latest JHF

John_Fleming — Sat, 25 Jul 2020 11:07:34 GMT

Its a bitcoin miner mangs.. its not obamal its obama1. Explains the high cpu and memory usage.

Welcome to being owned. Proceed directly to pant pooping and give the IR line a call.

https://www.checkpoint.com/support-services/threatcloud-incident-response/

Re: "obamal" process consumes High CPU 100% in Mgmt server R80.20 with latest JHF

Timothy_Hall — Fri, 24 Jul 2020 23:48:20 GMT

After seeing John's post I initially thought he was answering in jest, but after some quick poking around on one of my lab systems it looks like he is not.

There is no legitimate process or program with anything approaching that name included in R80.20, so the process shouldn't be there. Perhaps it is part of some kind of Threat Prevention update that my lab system does not have (hence the "mal" part of the name) but the question of how the program got onto that system needs to be answered, specifically as to whether it was placed there by an authorized user or an unauthorized one. Good luck.

Re: "obamal" process consumes High CPU 100% in Mgmt server R80.20 with latest JHF

John_Fleming — Sat, 25 Jul 2020 01:18:01 GMT

My post was %100 was not in jest to be clear. Call the IR team as I said. Best case i'm completely wrong and IR team is like "thanks for wasting our time". Worst case you have an amazing team starting an IR process for you with a skill set you most likely can not bring. Checkpoint is here to help secure your everything.

Re: "obamal" process consumes High CPU 100% in Mgmt server R80.20 with latest JHF

PhoneBoy — Sat, 25 Jul 2020 05:08:36 GMT

100% in agreement here, best to get IRT involved.