My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets



Added to the Dr.Web virus database: 2021-04-14

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/cron.hourly/checkpaidversionvpssim
Malicious functions:
Launches processes:
  • /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
  • /bin/bash <SAMPLE_FULL_PATH> -c
  • cat
  • grep opcache.blacklist /etc/php.d/opcache.ini
  • /etc/vpssim/menu/inc/re-start-php-fpm-service
  • chmod +x /etc/cron.hourly/checkpaidversionvpssim
Performs operations with the file system:
Modifies file access rights:
  • /etc/cron.hourly/checkpaidversionvpssim
Creates or modifies files:
  • /etc/logrotate.d/nginx
  • /tmp/sh-thd-201187253
  • /etc/logrotate.d/php-fpm
  • /tmp/sh-thd-201187252
  • /etc/logrotate.d/mysql
  • /etc/php.d/opcache.ini
  • /etc/vpssim/opcache.blacklist
  • /etc/vpssim/vpssim.config.firstime
Deletes files:
  • /tmp/sh-thd-201187253
  • /tmp/sh-thd-201187252
Collects RAM information

Curing recommendations


After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

© Doctor Web
2003 — 2023

Doctor Web is a cybersecurity company focused on threat detection, prevention and response technologies