如何确定这些 perl 进程是否是恶意的？

Question

我们的 Suse Linux Web 服务器最近运行速度相当缓慢，重新启动可以暂时缓解该问题。

经过进一步检查，我发现防火墙阻止了奇怪端口上的一些出站流量，这些流量似乎源自 perl 命令......

网络统计：

# netstat -nape | head -2; netstat -nape | grep 185.162.9.131
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name   
tcp        0      1 192.168.0.1:45781       185.162.9.131:147       SYN_SENT    30         65180      26829/fixit         
tcp        0      1 192.168.0.1:45777       185.162.9.131:147       SYN_SENT    30         65175      29159/epim          
tcp        0      1 192.168.0.1:45783       185.162.9.131:147       SYN_SENT    30         65182      26052/usel          
tcp        0      1 192.168.0.1:45773       185.162.9.131:147       SYN_SENT    30         65067      6265/usel           
tcp        0      1 192.168.0.1:45782       185.162.9.131:147       SYN_SENT    30         65181      5885/epim           
tcp        0      1 192.168.0.1:45771       185.162.9.131:147       SYN_SENT    30         65065      5529/epim           
tcp        0      1 192.168.0.1:45775       185.162.9.131:147       SYN_SENT    30         65161      26432/epim 

lsof：表明它是一个perl命令

# lsof -i :45775
COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
perl    26432 wwwrun    4u  IPv4  65161      0t0  TCP apache.home:45775->hosted-by.eurohoster.online:iso-ip (SYN_SENT)

我希望 pstree 可能会透露一些有用的信息，但我仍然没有更接近：

# pstree -ap wwwrun
perl,5529 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,5530 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,5885 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,5886 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,6265 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,6266 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

perl,26052 \040\040\040\040\040\040\040\040\040\040

perl,26053 \040\040\040\040\040\040\040\040\040\040

perl,26432 \040\040\040\040\040\040\040\040\040\040

perl,26433 \040\040\040\040\040\040\040\040\040\040

perl,26829 \040\040\040\040\040\040\040\040\040

perl,26830 \040\040\040\040\040\040\040\040\040

perl,28459 \040\040\040\040\040\040\040\040\040\040\040\040\040\040\040\040

有谁对我如何准确地找出这些 perl 进程是什么以及它们是如何启动的有任何建议吗？