My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets



Added to the Dr.Web virus database: 2023-10-06

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/rcS
Malicious functions:
Substitutes application name for:
Performs process tracing:
  • swapper/0
Manages services:
  • ['systemctl', 'list-unit-files', '--full', '--type=socket']
  • ['systemctl', 'stop', 'iptables.service']
  • ['systemctl', 'stop', 'firewalld.service']
Launches processes:
  • /usr/sbin/xtables-nft-multi /sbin/iptables -X
  • /bin/sh /usr/sbin/service firewalld stop
  • mv <SAMPLE_FULL_PATH> /bin/.developer
  • /bin/sh /usr/sbin/service iptables stop
  • /usr/sbin/xtables-nft-multi /sbin/iptables -F
  • mv /etc/rc.bak /etc/rc.local
  • rm -rf /tmp/* /var/* /var/run/* /var/tmp/*
  • mv /etc/init.d/rcS.bak /etc/init.d/rcS
  • /usr/sbin/xtables-nft-multi iptables -F
  • cp /etc/init.d/rcS /etc/init.d/rcS.bak
  • rm -rf /bin/netstat
  • echo \x27/bin/.developer -d\x27 >> /etc/init.d/rcS
  • sed -ne s/\x5c.socket\x5cs*[a-z]*\x5cs*$/.socket/p
  • basename /usr/sbin/service
  • cp /etc/rc.local /etc/rc.bak
  • rm -rf ~/.bash_history
Performs operations with the file system:
Creates or modifies files:
  • /run/lock/emptiness.lock
Network activity:
Establishes connection:

Curing recommendations


After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number