Is it safe to pg_dump and pg_restore a new postgres database that has malware? I'm pretty sure there is a crypto bot eating up my CPU through a postgres script. I would like to create an entirely new VM, and move my database with it using pg_dump and pg_restore. I already checked my postgres for new users, tables, databases; couldn't find anything odd there which could comprise me if I move my data. I'm a little worried however because the bot is some how getting access to my postgres, and nothing else on my VM.
Thank you for the help.
EDIT:
I managed to move my db with pg-dump and pg-dumpall. It's been a few days since I destroyed my last VM and made a new db with better security. It looks like I'm in the clear at least for this same attack.
Probably.  But if you just recreate the same vulnerable setup, you will just get infected again from scratch.  They probably got in by guessing the weak password on a super-user account.  So set up all new passwords on the new system and make then strong ones. (pg_dump will not carry over your old passwords anyway, but pg_dumpall will.). It would also be good to lock down your new pg_hba.conf so that superusers can only connect locally, or at least only from white-listed IP addresses.
They probably created a new function which gives them shell access, and pg_dump will carry over that function definition.  But if they can't log in in the first place they can't use it anymore; and it probably relies on a dropped binary .so file, which pg_dump will not carry over.