BackDoor.Maxplus.2557

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.afd] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Самоудаляется.

Сетевая активность:

Подключается к:

'95.##3.182.230':34355
'97.##3.39.155':34355
'20#.#20.243.49':34355
'72.##9.31.25':34355
'18#.#14.146.199':34355
'88.##.195.240':34355
'58.##9.25.245':34355
'2.###.123.196':34355
'18#.#14.146.204':34355
'66.##.96.160':34355
'97.#1.83.73':34355
'75.##3.82.227':34355
'13#.#40.96.45':34355
'99.##2.124.52':34355
'2.###.119.123':34355
'24.##9.135.183':34355
'91.##.191.235':34355
'76.##.148.21':34355
'18#.#9.200.16':34355
'74.##3.17.87':34355
'2.###.117.249':34355
'11#.#00.90.85':34355
'14#.#32.180.89':34355
'17#.#5.127.143':34355
'78.##.197.126':34355
'75.##.186.82':34355
'18#.#94.167.115':34355
'58.##1.166.112':34355
'12#.#49.76.201':34355
'2.###.120.125':34355
'16#.#32.224.130':34355
'18#.#03.91.221':34355
'13#.#40.97.173':34355
'21#.#47.217.83':34355
'69.##3.119.173':34355
'20#.#30.128.155':34355
'18#.#0.44.245':34355
'78.##0.184.163':34355
'70.##6.190.165':34355
'76.##3.126.146':34355
'67.##2.121.45':34355
'18#.#6.131.236':34355
'65.##.204.171':34355
'2.###.121.141':34355
'10#.#4.167.55':34355
'18#.#4.175.13':34355
'20#.#07.232.144':34355
'75.##.116.234':34355
'71.##6.14.44':34355
'67.##3.139.31':34355
'18#.#6.130.134':34355
'98.##2.253.78':34355
'12.##.140.225':34355
'22#.#36.7.109':34355
'11#.#2.47.144':34355
'92.#0.47.55':34355
'18#.#8.229.82':34355
'67.##1.215.235':34355
'15#.#7.30.228':34355
'77.##.156.74':34355
'78.##.77.223':34355
'72.##1.194.142':34355
'12.##.142.174':34355
'18#.#9.157.94':34355
'18#.#4.169.156':34355
'18#.#.118.180':34355
'98.##0.247.141':34355
'24.#.123.40':34355
'24.##.118.212':34355
'17#.#26.163.211':34355
'12#.#14.222.220':34355
'15#.#6.14.42':34355
'18#.#2.178.212':34355
'13#.#68.0.56':34355
'74.##1.44.133':34355
'68.##3.250.65':34355
'72.##9.216.36':34355
'76.##1.11.189':34355
'18#.#54.21.0':34355
'99.##4.58.224':34355
'75.##.108.152':34355
'17#.#19.141.237':34355
'24.##3.129.173':34355
'11#.#00.88.146':34355
'68.##3.160.124':34355
'15#.#6.45.244':34355
'66.##3.202.79':34355
'94.##.131.66':34355
'68.##.123.71':34355
'65.##.122.157':34355
'68.##.128.200':34355
'12.##6.81.241':34355
'99.##7.121.35':34355
'98.##8.211.5':34355
'11#.#5.31.57':34355
'18#.#62.81.174':34355
'60.##0.72.124':34355
'76.##2.159.55':34355
'69.##1.166.152':34355
'11#.#00.80.75':34355
'66.#.245.209':34355
'68.##.170.245':34355
'70.##0.153.131':34355
'90.##.83.252':34355
'49.#00.83.3':34355
'12#.#49.104.186':34355
'95.##7.174.147':34355
'2.###.11.186':34355
'13#.#68.34.129':34355
'11#.#5.28.208':34355
'99.##8.50.209':34355
'12#.#49.41.247':34355
'71.##4.105.216':34355
'8.##.14.150':34355
'69.##5.137.9':34355
'20#.#5.70.216':34355
'69.##3.147.144':34355
'18#.#39.172.69':34355
'78.#4.85.60':34355
'41.##3.58.20':34355
'68.##.20.215':34355
'71.##4.19.134':34355
'92.##.145.78':34355
'74.##.69.225':34355
'13#.#17.117.166':34355
'12#.#10.67.209':34355
'24.##3.58.111':34355
'92.#5.2.173':34355
'81.##4.143.190':34355
'67.#1.181.0':34355
'68.##8.234.206':34355
'75.##5.165.31':34355
'10#.#2.149.80':34355
'75.##9.228.90':34355
'18#.#22.128.137':34355
'99.##0.183.15':34355
'17#.#.237.143':34355
'18#.#6.201.219':34355
'18#.#4.13.34':34355
'95.##3.162.230':34355
'18#.#5.50.117':34355
'68.##4.40.31':34355
'71.##.109.72':34355
'67.##3.135.204':34355
'76.##.94.219':34355
'69.##1.183.245':34355
'18#.#07.166.81':34355
'18#.#2.172.225':34355
'74.##7.242.26':34355
'20#.#2.34.108':34355
'93.##6.214.252':34355
'68.##.242.147':34355
'95.#1.2.193':34355
'76.#8.47.41':34355
'18#.#92.149.184':34355
'17#.#8.122.12':34355
'18#.#4.147.58':34355
'81.##0.121.4':34355
'68.##9.249.241':34355
'20#.#0.16.91':34355
'68.##.134.96':34355
'20#.#7.90.56':34355
'98.##1.58.70':34355
'77.##.130.212':34355
'76.##9.201.162':34355
'24.#6.9.159':34355
'13#.#12.116.229':34355
'89.##4.254.220':34355
'80.##1.198.198':34355
'97.##.211.21':34355
'75.##.210.221':34355
'pr####.fling.com':80
'17#.#2.190.142':80
'75.##8.133.6':34355
'18#.#.118.58':34355
'17#.#6.188.210':34355
'50.##.206.159':34355
'71.##5.146.34':34355
'98.##9.224.198':34355
'65.##.207.221':34355
'71.##.92.212':34355
'97.#1.3.139':34355
'11#.#9.142.199':34355
'71.#.11.156':34355
'17#.#18.27.249':34355
'94.##2.178.163':34355
'24.##4.130.174':34355
'75.##8.125.46':34355
'98.##0.125.105':34355
'18#.#55.212.86':34355
'17#.#34.74.187':34355
'68.#5.42.23':34355
'13#.#3.151.226':34355
'18#.#26.70.190':34355
'69.##2.193.126':34355
'99.##0.180.160':34355
'76.##.53.143':34355
'96.##.203.88':34355
'17#.#9.218.111':34355
'17#.#30.216.14':34355
'17#.#8.240.26':34355
'88.##8.0.157':34355
'12#.#82.43.158':34355
'74.##2.49.207':34355
'17#.#8.139.148':34355
'18#.#1.64.168':34355
'13#.#40.98.185':34355
'67.##3.152.208':34355
'98.##5.221.224':34355
'24.##1.156.249':34355
'24.##.193.19':34355
'11#.#84.93.189':34355
'74.##.116.36':34355
'46.##0.178.223':34355
'69.##5.60.42':34355
'2.###.122.64':34355
'70.##6.192.153':34355
'99.##0.204.47':34355
'24.##9.82.81':34355
'91.##2.82.131':34355
'21#.#52.55.63':34355
'88.##8.206.111':34355
'70.##4.17.81':34355
'95.#26.4.56':34355
'18#.#7.225.62':34355
'2.###.115.180':34355
'76.##.47.216':34355
'18#.#.92.247':34355
'76.##.198.168':34355
'78.##.114.245':34355
'71.##3.240.67':34355
'81.##0.92.181':34355
'71.#0.32.45':34355
'71.##0.28.107':34355
'81.##.45.204':34355
'14.##4.223.234':34355
'18#.#7.103.156':34355
'18#.#8.116.253':34355
'98.##8.106.221':34355
'70.##.188.164':34355
'50.##.108.83':34355
'24.##0.155.251':34355
'80.##.245.209':34355
'2.###.118.76':34355
'11#.#00.91.108':34355
'82.##.132.22':34355
'76.##9.253.144':34355
'70.##3.115.150':34355
'71.##8.45.16':34355
'94.##1.22.186':34355
'18#.#8.127.188':34355
'50.##.218.59':34355
'21#.#36.15.25':34355
'92.##.152.26':34355
'24.#7.1.246':34355
'71.#98.8.37':34355
'18#.#7.157.246':34355
'46.##0.178.165':34355

TCP:

Запросы HTTP GET:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK v{#�Gv<
DNS ASK v{#� ��
DNS ASK v{#ryQ
DNS ASK v{#H�T
DNS ASK v{#$�T�
DNS ASK v{#��s}
DNS ASK v{#G��
DNS ASK v{#�<5
DNS ASK v{#kG
DNS ASK v{#��
DNS ASK pr####.fling.com
DNS ASK v{#�bֻ
DNS ASK v{#��9t
DNS ASK v{#\�]
DNS ASK v{#�͙
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней