BackDoor.Maxplus.2522

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.<Служебное имя>] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Самоудаляется.

Сетевая активность:

Подключается к:

'65.##.94.141':34354
'76.##0.33.251':34354
'20#.#9.214.134':34354
'20#.#3.238.139':34354
'84.##5.160.142':34354
'17#.#3.224.249':34354
'78.##.165.141':34354
'70.##3.77.96':34354
'78.##6.159.43':34354
'2.##.86.125':34354
'10.##2.16.33':34354
'95.##.251.104':34354
'17#.#6.88.226':34354
'68.##4.45.101':34354
'97.##.182.147':34354
'85.##0.53.121':34354
'18#.#29.183.239':34354
'98.##2.166.150':34354
'18#.#10.234.156':34354
'79.##2.196.158':34354
'89.#8.42.17':34354
'86.##6.255.234':34354
'18#.#8.101.160':34354
'17#.#22.141.105':34354
'81.##.219.89':34354
'17#.#50.17.89':34354
'21#.52.36.9':34354
'21#.#21.213.132':34354
'76.#9.210.4':34354
'50.##.107.243':34354
'24.##1.40.88':34354
'67.##5.147.153':34354
'46.##1.215.251':34354
'75.##8.174.185':34354
'76.##.97.251':34354
'65.##.125.83':34354
'22#.#9.164.38':34354
'84.##.133.17':34354
'18#.#72.93.171':34354
'95.#5.77.29':34354
'17#.#8.235.224':34354
'86.##1.141.166':34354
'76.#06.0.98':34354
'64.##1.249.199':34354
'88.##9.224.33':34354
'18#.#37.91.254':34354
'18#.#37.106.171':34354
'17#.#1.220.118':34354
'94.##3.127.136':34354
'41.##3.138.155':34354
'24.##7.119.216':34354
'95.##.121.91':34354
'90.##1.191.33':34354
'76.##.72.193':34354
'93.##8.246.211':34354
'67.##8.235.101':34354
'62.##7.227.229':34354
'82.##4.237.26':34354
'17#.#58.148.144':34354
'17#.#9.97.103':34354
'14#.#16.227.239':34354
'24.##0.23.142':34354
'66.##.116.86':34354
'81.#2.6.74':34354
'86.#.37.170':34354
'70.##4.176.182':34354
'86.##1.8.170':34354
'11#.#7.65.227':34354
'31.#0.232.1':34354
'87.##8.17.16':34354
'75.##7.249.237':34354
'98.##5.175.237':34354
'68.#.33.168':34354
'67.##7.134.28':34354
'89.##8.141.224':34354
'18#.#9.203.218':34354
'76.##9.155.239':34354
'50.##9.60.227':34354
'18#.#0.112.24':34354
'74.##3.100.118':34354
'76.##7.162.226':34354
'15#.59.80.5':34354
'88.##0.156.141':34354
'94.##.226.142':34354
'66.##9.139.239':34354
'15#.#3.15.126':34354
'68.#.144.118':34354
'90.##3.144.127':34354
'76.##1.174.4':34354
'72.##8.12.240':34354
'77.#26.3.10':34354
'98.##0.131.164':34354
'21#.#11.187.159':34354
'24.##1.205.249':34354
'79.#15.15.9':34354
'90.##0.165.156':34354
'69.##7.39.146':34354
'76.##5.100.24':34354
'95.##.79.198':34354
'71.##.121.193':34354
'66.##.125.193':34354
'76.##5.87.254':34354
'18#.#0.157.202':34354
'83.##8.199.199':34354
'10#.#85.225.52':34354
'60.##4.42.72':34354
'93.##.75.183':34354
'18#.#26.58.21':34354
'46.##5.138.73':34354
'67.##7.214.67':34354
'75.##9.169.64':34354
'99.##.227.185':34354
'20#.#2.103.188':34354
'69.##5.129.214':34354
'84.##0.40.215':34354
'24.##.99.120':34354
'71.#9.61.38':34354
'66.##.33.216':34354
'46.##7.241.216':34354
'10#.#1.172.2':34354
'98.##0.82.31':34354
'24.##3.36.203':34354
'18#.#8.112.45':34354
'68.#5.63.52':34354
'1.##.24.203':34354
'68.##.223.125':34354
'15#.#7.192.41':34354
'69.##1.215.203':34354
'17#.#7.138.205':34354
'24.##9.126.96':34354
'64.##.125.77':34354
'46.##4.23.29':34354
'98.##3.141.11':34354
'15#.#9.224.173':34354
'2.##.14.11':34354
'17#.#5.141.202':34354
'72.#2.132.9':34354
'13#.#95.64.144':34354
'18#.#16.236.234':34354
'24.##8.198.55':34354
'89.##.86.187':34354
'84.##6.248.60':34354
'17#.#0.106.136':34354
'84.##.213.110':34354
'94.##6.117.239':34354
'15#.#81.131.133':34354
'88.##2.100.220':34354
'79.##5.176.173':34354
'2.###.25.164':34354
'46.##.14.188':34354
'83.#34.3.95':34354
'69.##2.22.37':34354
'74.##.172.12':34354
'18#.#9.132.137':34354
'81.##.221.52':34354
'78.##.235.170':34354
'91.##4.139.157':34354
'69.##7.88.86':34354
'95.#5.31.59':34354
'24.##.138.178':34354
'68.##.22.120':34354
'69.##5.100.129':34354
'10#.#85.65.179':34354
'2.###.144.188':34354
'17#.#4.35.213':34354
'69.##0.246.199':34354
'96.#5.6.104':34354
'24.##6.237.95':34354
'85.##0.149.94':34354
'17#.#4.37.132':34354
'15#.56.5.45':34354
'pr####.fling.com':80
'17#.#2.190.142':80
'76.##0.167.146':34354
'79.##3.242.71':34354
'19#.#79.3.253':34354
'79.##9.161.141':34354
'97.##.220.97':34354
'89.##.105.113':34354
'72.#7.212.2':34354
'87.##.243.15':34354
'68.##3.133.191':34354
'94.##.41.117':34354
'60.##7.164.203':34354
'97.##.236.241':34354
'10#.#85.36.182':34354
'68.##0.146.217':34354
'69.##4.238.77':34354
'69.##1.190.12':34354
'68.##.109.110':34354
'71.##.111.192':34354
'17#.#15.63.87':34354
'18#.#37.55.100':34354
'58.##9.238.150':34354
'12.##.251.164':34354
'17#.#6.107.24':34354
'69.##.170.74':34354
'88.##1.118.125':34354
'77.##.223.232':34354
'50.##3.29.124':34354
'76.##.251.139':34354
'76.##3.61.63':34354
'21#.#31.160.244':34354
'12#.#45.74.18':34354
'89.##.221.114':34354
'46.##1.200.192':34354
'66.#2.91.27':34354
'71.#7.84.97':34354
'11#.#75.154.208':34354
'81.##8.145.70':34354
'10#.#85.38.74':34354
'17#.#.97.152':34354
'11#.#1.217.187':34354
'79.##9.56.186':34354
'78.##7.203.29':34354
'19#.#17.218.196':34354
'18#.#37.41.107':34354
'1.##.241.26':34354
'77.##.194.81':34354
'78.##.139.169':34354
'68.##.179.27':34354
'80.##3.146.109':34354
'41.##6.78.45':34354
'68.##2.13.85':34354
'96.##.145.194':34354
'95.#7.9.68':34354
'82.##1.105.49':34354
'76.##0.140.65':34354
'95.##8.246.54':34354
'17#.#6.241.228':34354
'83.##8.40.172':34354
'11#.#5.10.48':34354
'2.##.137.126':34354
'10.##9.28.250':34354
'72.##8.176.174':34354
'69.##4.102.116':34354
'67.##.218.108':34354
'17#.#68.20.213':34354
'24.##6.72.205':34354
'71.#2.22.5':34354
'17#.#18.34.9':34354
'75.##.13.216':34354
'42.#.151.134':34354
'17#.#56.154.105':34354
'71.##7.172.156':34354
'18#.#7.225.93':34354
'84.##6.125.222':34354
'82.##9.79.197':34354
'75.##8.146.105':34354
'79.##3.201.111':34354
'67.#.40.233':34354
'10.#89.14.6':34354
'75.##1.101.178':34354
'72.##5.247.253':34354
'76.##5.226.163':34354
'18#.#37.191.85':34354
'18#.#8.128.240':34354
'2.###.204.249':34354

TCP:

Запросы HTTP GET:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK z#ڭ\>
DNS ASK z#�ʶ�
DNS ASK z#D�{
DNS ASK z#~�V
DNS ASK z#~~�
DNS ASK z#�@Y
DNS ASK z#q[�
DNS ASK z#��7
DNS ASK z#]�m
DNS ASK z#��
DNS ASK pr####.fling.com
DNS ASK z#��
DNS ASK z#�v
DNS ASK z#'��_
DNS ASK z#�'�
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней