"obamal" process consumes High CPU 100% in Mgmt server R80.20 with latest JHF

[Vinodhini]

Dear All,

I have customer Mgmt server 80.20 with latest JHF.

In "top" command - could see "obamal" process taking 100% High CPU. SO unable to open SmartConsole.

The appliance rebooted a day before only, still no luck. Unable to get what this process is about. no much details in messages file also.

Attached screenshot. Can anyone give shed some info on this please....

Regards, Vinodhini

[PhoneBoy]

I've never seen that process before and there's not even anything in SK about it.
Recommend a TAC case.

[John_Fleming]

Its a bitcoin miner mangs.. its not obamal its obama1. Explains the high cpu and memory usage.

Welcome to being owned. Proceed directly to pant pooping and give the IR line a call.

https://www.checkpoint.com/support-services/threatcloud-incident-response/

[Timothy_Hall]

After seeing John's post I initially thought he was answering in jest, but after some quick poking around on one of my lab systems it looks like he is not.

There is no legitimate process or program with anything approaching that name included in R80.20, so the process shouldn't be there.  Perhaps it is part of some kind of Threat Prevention update that my lab system does not have (hence the "mal" part of the name) but the question of how the program got onto that system needs to be answered, specifically as to whether it was placed there by an authorized user or an unauthorized one.  Good luck.

[John_Fleming]

My post was %100 was not in jest to be clear. Call the IR team as I said. Best case i'm completely wrong and IR team is like "thanks for wasting our time". Worst case you have an amazing team starting an IR process for you with a skill set you most likely can not bring. Checkpoint is here to help secure your everything.

[PhoneBoy]

100% in agreement here, best to get IRT involved.