My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets



Added to the Dr.Web virus database: 2020-10-07

Virus description added:

Technical Information

Malicious functions:
Substitutes application name for:
  • rpcbind
Manages services:
  • systemctl daemon-reload
  • systemctl enable systemd-hwdb-upgrade.service
Launches processes:
  • /proc/self/exe /sbin/rpcbind -w
  • sh -c systemctl daemon-reload &>/dev/null
  • sh -c systemctl enable systemd-hwdb-upgrade.service &>/dev/null
Performs operations with the file system:
Modifies file access rights:
  • /etc/iproute2/rt_ksfield
  • /usr/lib/
Creates symlinks:
  • /usr/lib/
Creates or modifies files:
  • /tmp/.X11-unix/Xa
  • /etc/iproute2/rt_ksfield
  • /lib/systemd/system/systemd-hwdb-upgrade.service
Network activity:
Sends data to the following servers:
  • 88.###.193.105:44468
  • 71.###.239.95:42908
  • 18#.##.45.252:52085
  • 12#.##8.66.9:34366

Curing recommendations


After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number