My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets



Added to the Dr.Web virus database: 2016-04-04

Virus description added:


  • 665346a64bee0ff2a52f004855d389433b4f0ce9 (6th version)
  • 84f7c64940e80a11b075b256ebba8e9c0d5b90e0 (7th version)
  • 7f27cfb76644b606959486f40cf4c4d8810e6977 (8th version)
  • 8f4ad9f9c9bb6bf0d9e533f56f5cc13682b37c19 (9th version)
  • 2c99068a37e59c1bfbb7c0f8a95952b35031267d (10th version)

Improved versions of Linux.BackDoor.Xudp.1 that have the following differences:

  • Instead of transfer.php, the link.php file is requested.
  • The Trojan is saved as /lib/sock.
  • The Trojan sends the following information in Http_thread:
    • number of kernels;
    • memory;
    • the uname-a value;
    • contents of /etc/issue.

In the 8th version (7f27cfb76644b606959486f40cf4c4d8810e6977), the RUN function is replaced with the SYSTEMEXIT function. When it is executed, popen is called, the output is sent to the server, and the backdoor then terminates itself. Also, the TCP_Flood function is modified.

The 9th version (8f4ad9f9c9bb6bf0d9e533f56f5cc13682b37c19) is detected as Linux.BackDoor.Xudp.3. In comparison with Linux.BackDoor.Xudp.1, it can carry out the Dns Amplification attack.

Curing recommendations


After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

The Russian developer of Dr.Web anti-viruses
Doctor Web has been developing anti-virus software since 1992
Dr.Web is trusted by users around the world in 200+ countries
The company has delivered an anti-virus as a service since 2007
24/7 tech support

Dr.Web © Doctor Web
2003 — 2021

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124