My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets



Added to the Dr.Web virus database: 2020-04-28

Virus description added:

Technical Information

Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
  • gwd0ap2z3g31wyndt2mmu3xu
  • 5btlvwk3m41dbuvczafuezs
  • gvm4auf1y24ayuru4fkpl2
  • njufzmc3xfsdkajfecwee
  • maxanbl0iyrimibrpykts
  • c15zjp5yxgdk5pp3rsp2s
  • 1u5a0epiqy2rfcrhitd0p
  • b0qiqu1nzv251pxabugs
  • vemwy5y5eqhdxii4un2vkg
  • lo4wkn0lf3cb3omugn0kfvu
  • zhz4nxyctokyhw2alvz0
Performs operations with the file system:
Creates or modifies files:
Network activity:
Awaits incoming connections on ports:
  • 19#.##8.218.50:3467
Establishes connection:
  • 8.#.8.8:53
  • 5.###.227.18:4321
  • 5.###.227.18:7685

Curing recommendations


After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number