My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets



Added to the Dr.Web virus database: 2016-04-04

Virus description added:


  • 665346a64bee0ff2a52f004855d389433b4f0ce9 (6th version)
  • 84f7c64940e80a11b075b256ebba8e9c0d5b90e0 (7th version)
  • 7f27cfb76644b606959486f40cf4c4d8810e6977 (8th version)
  • 8f4ad9f9c9bb6bf0d9e533f56f5cc13682b37c19 (9th version)
  • 2c99068a37e59c1bfbb7c0f8a95952b35031267d (10th version)

Improved versions of Linux.BackDoor.Xudp.1 that have the following differences:

  • Instead of transfer.php, the link.php file is requested.
  • The Trojan is saved as /lib/sock.
  • The Trojan sends the following information in Http_thread:
    • number of kernels;
    • memory;
    • the uname-a value;
    • contents of /etc/issue.

In the 8th version (7f27cfb76644b606959486f40cf4c4d8810e6977), the RUN function is replaced with the SYSTEMEXIT function. When it is executed, popen is called, the output is sent to the server, and the backdoor then terminates itself. Also, the TCP_Flood function is modified.

The 9th version (8f4ad9f9c9bb6bf0d9e533f56f5cc13682b37c19) is detected as Linux.BackDoor.Xudp.3. In comparison with Linux.BackDoor.Xudp.1, it can carry out the Dns Amplification attack.

Curing recommendations


After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number