My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets



Added to the Dr.Web virus database: 2019-06-01

Virus description added:

Technical Information

Malicious functions:
Launches processes:
  • sh -c mkdir \"/log\" > /dev/null 2>&1
  • mkdir /log
  • uname -a
  • sh -c route | grep default | grep -v grep
  • route
  • grep -v grep
  • grep default
Performs operations with the file system:
Creates folders:
  • /log
Creates or modifies files:
  • //bin/
  • /bin/
  • /etc/xCloud.db
  • /log/Log.txt
  • /bin/.version
  • /etc/xCloud.db-journal
Deletes files:
  • /etc/xCloud.db-wal
  • /etc/xCloud.db-journal
Network activity:
Awaits incoming connections on ports:
Establishes connection:
Sends data to the following servers:
  • 23#.###.255.250:1900

Curing recommendations


After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number