BackDoor.Maxplus.2486

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.i8042prt] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Самоудаляется.

Сетевая активность:

Подключается к:

'75.##6.72.136':34354
'76.##9.252.137':34354
'94.#1.29.90':34354
'10#.#4.164.88':34354
'94.##9.213.141':34354
'71.##9.117.142':34354
'15#.#24.253.139':34354
'74.##6.179.141':34354
'75.##.110.101':34354
'95.##0.27.95':34354
'76.##2.164.103':34354
'68.##.229.117':34354
'93.##.222.92':34354
'82.#8.93.91':34354
'24.#9.9.119':34354
'68.##3.150.124':34354
'10#.#9.49.170':34354
'58.##.205.71':34354
'75.##.11.170':34354
'67.##.228.73':34354
'97.##.154.176':34354
'18#.#4.181.66':34354
'95.##.86.170':34354
'93.#5.33.70':34354
'15#.#0.35.133':34354
'62.##7.98.79':34354
'96.##.189.155':34354
'50.##0.94.158':34354
'76.##9.222.76':34354
'68.##.150.163':34354
'10#.#29.165.158':34354
'84.##6.240.160':34354
'86.##4.48.118':34354
'70.##1.170.253':34354
'99.##5.97.252':34354
'89.#2.11.95':34354
'17#.#9.114.5':34354
'2.###.55.105':34354
'19#.#64.214.7':34354
'10#.#.148.104':34354
'24.##5.252.94':34354
'68.##.34.122':34354
'72.##1.112.2':34354
'65.##4.104.129':34354
'24.#29.2.8':34354
'99.##.107.120':34354
'74.##2.188.121':34354
'67.#6.183.9':34354
'78.##.178.112':34354
'76.##7.192.115':34354
'18#.#7.8.106':34354
'72.##8.164.105':34354
'18#.#06.158.104':34354
'46.##.197.116':34354
'65.##9.242.104':34354
'68.#2.7.5':34354
'24.##.130.112':34354
'24.##3.176.129':34354
'93.##2.9.189':34354
'46.##3.178.113':34354
'70.##.64.110':34354
'35.##.51.107':34354
'79.##.178.184':34354
'24.##.248.111':34354
'15#.#81.134.65':34354
'18#.#5.165.29':34354
'86.##8.42.221':34354
'24.##5.171.218':34354
'72.##8.51.34':34354
'68.##.102.233':34354
'92.##7.112.234':34354
'88.##2.219.230':34354
'68.#.148.232':34354
'17#.#68.20.213':34354
'18#.#79.217.216':34354
'10#.#0.240.253':34354
'84.##1.189.210':34354
'98.##.131.203':34354
'24.##6.140.218':34354
'83.##7.164.36':34354
'97.#3.86.35':34354
'18#.#5.115.236':34354
'78.##0.189.253':34354
'21#.#12.176.248':34354
'74.##3.149.251':34354
'15#.#3.197.104':34354
'68.##.150.110':34354
'2.##4.67.7':34354
'74.#3.235.5':34354
'11#.#41.60.17':34354
'2.##4.5.238':34354
'98.##9.251.19':34354
'98.##0.4.236':34354
'96.##.108.240':34354
'67.##.202.240':34354
'69.##9.172.238':34354
'68.##1.246.12':34354
'82.##.74.179':34354
'98.##4.101.186':34354
'93.##0.205.57':34354
'76.##7.166.254':34354
'68.##.110.187':34354
'24.##9.45.53':34354
'75.##4.249.54':34354
'81.##.195.54':34354
'24.##.24.180':34354
'84.##2.27.181':34354
'76.##9.200.179':34354
'75.##9.169.64':34354
'17#.#06.115.182':34354
'68.##4.142.184':34354
'96.##.85.181':34354
'82.##3.53.182':34354
'24.#.247.196':34354
'70.##0.78.197':34354
'93.#7.46.48':34354
'92.##0.98.196':34354
'10.##3.74.205':34354
'90.##7.159.206':34354
'50.##.213.45':34354
'93.##.173.44':34354
'17#.#.96.188':34354
'86.##1.40.51':34354
'91.##0.180.52':34354
'46.##.14.188':34354
'2.###.76.191':34354
'76.#1.86.48':34354
'75.#4.33.50':34354
'15#.#24.149.190':34354
'72.##9.142.222':34354
'98.##7.159.28':34354
'24.##.179.86':34354
'17#.#2.16.225':34354
'79.##9.160.56':34354
'17#.#5.16.219':34354
'20#.#9.244.74':34354
'17#.#0.225.57':34354
'65.##5.67.134':34354
'66.##9.49.27':34354
'17#.#8.209.75':34354
'76.##9.105.88':34354
'1.##.192.228':34354
'13#.#02.101.60':34354
'79.##9.160.230':34354
'12#.#69.104.62':34354
'68.##.218.89':34354
'84.##0.213.113':34354
'10#.#32.108.51':34354
'17#.#57.58.71':34354
'71.#.141.110':34354
'87.##7.43.47':34354
'69.##9.28.192':34354
'17#.#0.31.48':34354
'89.#1.38.56':34354
'68.##.96.116':34354
'98.##2.101.137':34354
'17#.#0.238.185':34354
'46.##.191.53':34354
'17#.#38.252.212':34354
'78.##7.90.215':34354
'85.##0.54.134':34354
'18#.#93.57.250':34354
'66.##.96.213':34354
'24.##7.85.169':34354
'69.##2.117.16':34354
'98.##9.0.189':34354
'98.##8.131.227':34354
'10#.#10.186.40':34354
'13#.#29.48.103':34354
'24.##9.146.186':34354
'10#.#7.172.253':34354
'pr####.fling.com':80
'17#.#2.190.142':80
'72.##6.8.121':34354
'18#.#7.14.251':34354
'69.##2.195.117':34354
'41.##1.54.154':34354
'46.##.43.237':34354
'18#.#59.35.161':34354
'11#.#92.57.120':34354
'68.##1.191.155':34354
'78.##1.233.235':34354
'89.##6.202.235':34354
'17#.#9.132.253':34354
'50.##.170.141':34354
'69.##1.13.86':34354
'67.##0.216.45':34354
'37.##.177.162':34354
'10#.#39.158.34':34354
'93.##.146.15':34354
'62.##.122.238':34354
'67.##2.39.10':34354
'94.##6.52.148':34354
'75.##.74.197':34354
'76.##6.154.83':34354
'72.##5.158.154':34354
'99.#8.67.82':34354
'15#.#0.249.15':34354
'71.##.136.145':34354
'93.##.27.145':34354
'98.##0.119.238':34354
'84.##.234.239':34354
'65.##.183.236':34354
'66.##9.244.160':34354
'96.##.191.234':34354
'67.#5.7.18':34354
'98.##.185.158':34354
'21#.#6.60.78':34354
'21#.#86.246.77':34354
'17#.#1.25.160':34354
'18#.#6.179.242':34354
'31.##0.226.136':34354
'24.##0.153.138':34354
'98.##5.138.87':34354
'98.##2.2.134':34354
'95.##.131.250':34354
'12#.#58.71.246':34354
'15#.#3.80.249':34354
'85.##1.209.9':34354
'19#.#78.37.241':34354
'67.##7.7.160':34354
'18#.#7.101.85':34354
'68.##5.234.86':34354
'10#.#94.171.138':34354
'37.##.135.241':34354
'98.##5.58.140':34354
'75.#1.40.39':34354
'72.##.114.188':34354
'75.##0.225.189':34354
'14.##.224.42':34354
'24.##.151.38':34354
'15#.#5.150.217':34354
'76.#8.59.51':34354
'71.##.127.212':34354
'10#.#0.254.39':34354
'94.##7.107.204':34354
'84.##2.120.46':34354
'46.##3.54.203':34354
'75.##.240.48':34354
'66.##5.228.49':34354
'66.##8.123.192':34354
'69.##.249.204':34354
'17#.#71.130.65':34354
'17#.#1.243.69':34354
'10#.#51.123.63':34354
'17#.#2.56.65':34354
'68.##2.65.25':34354
'19#.#9.233.24':34354
'71.##.182.25':34354
'75.##4.210.71':34354
'46.##2.113.220':34354
'99.##7.194.58':34354
'24.##6.252.34':34354
'68.##.90.219':34354
'72.##2.194.228':34354
'10#.#62.86.38':34354
'24.##9.133.227':34354
'71.##.134.61':34354

TCP:

Запросы HTTP GET:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK z#�I0�
DNS ASK z#�.�0
DNS ASK z#{wX
DNS ASK z#A�
DNS ASK z#-�
DNS ASK z#��5�
DNS ASK z#N��
DNS ASK z#�z�
DNS ASK z#bj
DNS ASK z#��
DNS ASK pr####.fling.com
DNS ASK z#�l�9
DNS ASK z#��
DNS ASK z#R�
DNS ASK z#��q
'8.#.8.8':1037

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней