BackDoor.Maxplus.3687

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.ipsec] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Самоудаляется.

Сетевая активность:

Подключается к:

'69.##1.43.116':34354
'99.##4.65.62':34354
'12#.#23.80.229':34354
'78.#4.9.19':34354
'68.##1.55.41':34354
'94.##5.34.231':34354
'69.##4.208.109':34354
'93.##8.34.73':34354
'46.##.215.57':34354
'60.##.247.97':34354
'49.##9.1.141':34354
'20#.#6.156.242':34354
'13#.#91.12.226':34354
'71.##9.117.142':34354
'10#.#25.141.123':34354
'17#.#25.45.143':34354
'11#.#9.232.113':34354
'67.##.207.200':34354
'97.##.195.211':34354
'95.##.116.76':34354
'94.##.110.142':34354
'46.##2.68.198':34354
'76.##1.151.151':34354
'31.##.238.89':34354
'95.#6.197.3':34354
'24.##7.111.101':34354
'95.##.235.201':34354
'69.##5.138.111':34354
'15#.#9.55.146':34354
'75.##.159.103':34354
'72.##5.216.63':34354
'93.##.228.83':34354
'50.##.101.80':34354
'78.##5.248.221':34354
'78.#5.29.12':34354
'24.##6.98.108':34354
'71.#1.2.212':34354
'77.##.241.121':34354
'46.##9.91.106':34354
'67.#86.31.6':34354
'10#.#.192.225':34354
'42.#.13.144':34354
'2.##3.0.102':34354
'2.###.78.105':34354
'71.#0.33.37':34354
'17#.#16.103.84':34354
'46.#.44.37':34354
'17#.#0.104.32':34354
'89.##9.90.27':34354
'71.##.224.154':34354
'98.##9.39.116':34354
'92.##4.188.136':34354
'68.##.212.246':34354
'15#.#2.177.157':34354
'10#.#06.180.191':34354
'2.###.155.171':34354
'10#.#85.138.147':34354
'18#.#47.68.252':34354
'69.##9.172.238':34354
'46.#2.45.14':34354
'11#.#42.207.235':34354
'67.##6.55.65':34354
'89.##.61.165':34354
'50.##3.137.183':34354
'89.#4.70.90':34354
'17#.#1.205.120':34354
'98.##2.85.140':34354
'18#.#43.35.166':34354
'19#.#89.7.175':34354
'70.##5.156.249':34354
'95.##.253.15':34354
'98.##8.105.216':34354
'78.##.120.61':34354
'17#.#0.234.35':34354
'17#.#2.255.34':34354
'99.##4.163.163':34354
'19#.#00.42.228':34354
'83.##1.184.52':34354
'68.##0.245.237':34354
'95.##.180.230':34354
'11#.#01.175.138':34354
'68.##.103.184':34354
'14.##6.10.186':34354
'50.##.155.71':34354
'17#.#1.194.75':34354
'78.##.19.206':34354
'75.#4.93.71':34354
'24.##5.196.75':34354
'78.##.223.77':34354
'85.##6.58.28':34354
'71.##.136.153':34354
'17#.#73.149.223':34354
'90.##0.162.210':34354
'19#.#18.100.176':34354
'17#.#16.120.71':34354
'75.##9.62.49':34354
'92.##3.84.231':34354
'70.##0.189.211':34354
'2.###.244.209':34354
'68.##2.93.199':34354
'17#.#1.82.63':34354
'92.##3.48.83':34354
'98.##7.159.28':34354
'2.##8.73.22':34354
'11#.#09.230.107':34354
'17#.#1.196.205':34354
'63.##8.222.106':34354
'94.##3.104.40':34354
'91.##8.41.190':34354
'11#.#6.128.250':34354
'13#.#95.20.100':34354
'46.##8.214.165':34354
'46.##9.69.67':34354
'71.##.237.251':34354
'19#.#00.62.42':34354
'92.##4.78.195':34354
'66.##.80.152':34354
'85.##3.233.202':34354
'24.##4.115.224':34354
'18#.#1.18.63':34354
'68.#2.3.92':34354
'18#.#42.55.118':34354
'65.##.239.19':34354
'18#.#31.110.1':34354
'91.##0.180.52':34354
'18#.#5.154.150':34354
'17#.#63.26.107':34354
'89.##6.90.116':34354
'92.##4.141.137':34354
'68.##.87.100':34354
'17#.#5.250.95':34354
'18#.#7.56.221':34354
'75.##.117.130':34354
'66.##7.128.24':34354
'67.##6.150.227':34354
'46.##6.69.73':34354
'19#.#46.217.204':34354
'95.##.185.117':34354
'72.##8.226.85':34354
'76.##9.86.36':34354
'95.##.181.86':34354
'87.##0.21.108':34354
'17#.#0.36.238':34354
'19#.#40.34.122':34354
'11#.#93.137.31':34354
'68.##.76.228':34354
'74.##7.7.178':34354
'17#.#09.151.104':34354
'31.##0.60.241':34354
'92.##5.38.97':34354
'68.##5.42.243':34354
'89.##7.83.129':34354
'2.##4.65.95':34354
'88.##4.125.102':34354
'24.##9.66.236':34354
'95.##.150.68':34354
'96.##8.229.235':34354
'74.##.244.95':34354
'92.##.158.96':34354
'46.##.24.169':34354
'10#.#2.19.186':34354
'67.##.79.137':34354
'97.##.177.127':34354
'67.##0.247.143':34354
'66.##9.96.107':34354
'46.##3.69.184':34354
'17#.#01.135.123':34354
'15#.#81.183.54':34354
'69.##7.213.136':34354
'82.##.20.133':34354
'98.##2.2.134':34354
'pr####.fling.com':80
'17#.#2.190.142':80
'46.##0.129.21':34354
'31.##9.1.157':34354
'10#.#29.165.158':34354
'15#.#81.159.168':34354
'18#.#59.143.241':34354
'13#.#04.172.125':34354
'41.##0.196.177':34354
'89.##4.136.187':34354
'67.##1.96.164':34354
'72.##0.70.247':34354
'72.##4.56.20':34354
'24.##5.180.124':34354
'18#.#73.206.145':34354
'2.###.230.122':34354
'18#.#8.227.104':34354
'95.##.230.38':34354
'85.##5.137.70':34354
'11#.#35.170.62':34354
'81.##5.12.212':34354
'17#.#1.188.246':34354
'24.#.164.36':34354
'70.##0.199.206':34354
'17#.7.27.61':34354
'71.##4.52.187':34354
'18#.#68.5.27':34354
'88.##7.171.189':34354
'70.##1.199.68':34354
'20#.#10.143.23':34354
'20#.#08.35.251':34354
'17#.#2.89.165':34354
'17#.#9.41.49':34354
'10#.#71.52.92':34354
'69.##3.191.218':34354
'2.###.179.189':34354
'17#.#68.39.142':34354
'68.##.96.116':34354
'21#.#22.88.194':34354
'98.##8.115.28':34354
'18#.#5.122.232':34354
'31.##0.202.44':34354
'82.##.124.42':34354
'31.#9.24.9':34354
'79.##2.194.156':34354
'21#.#30.104.224':34354
'24.##2.47.194':34354
'17#.#6.234.87':34354
'98.##7.126.49':34354
'95.#1.7.88':34354
'93.##.41.188':34354
'88.##3.190.183':34354
'96.##2.196.18':34354
'80.##7.94.241':34354
'92.##2.147.45':34354
'96.##.220.240':34354
'74.#60.1.73':34354
'79.##5.85.161':34354
'97.##.205.79':34354
'17#.#18.34.9':34354
'64.##9.54.104':34354
'41.#8.2.167':34354
'17#.#2.53.85':34354
'11#.#04.140.152':34354
'84.##4.176.141':34354
'68.#6.27.24':34354
'88.##8.171.45':34354
'89.##.170.88':34354
'95.##.52.230':34354
'41.#04.54.0':34354
'76.##8.124.207':34354
'88.##6.36.151':34354
'11#.#51.240.194':34354
'75.##.227.105':34354
'79.##7.109.30':34354
'67.##.124.224':34354
'88.##0.156.141':34354
'80.##3.196.195':34354
'85.##6.75.166':34354
'10#.#08.89.63':34354
'95.##.240.17':34354
'17#.#9.75.200':34354
'66.#.138.183':34354
'2.###.147.177':34354
'21#.#52.11.164':34354
'17#.#29.7.49':34354
'74.##3.64.217':34354

TCP:

Запросы HTTP GET:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK z#��s�
DNS ASK z#Ȃ�{
DNS ASK z#l�T
DNS ASK z#V��
DNS ASK z#:6QR
DNS ASK z#�v�
DNS ASK z#Y�
DNS ASK z#��9�
DNS ASK z#u�B!
DNS ASK z#��@
DNS ASK pr####.fling.com
DNS ASK z#��r
DNS ASK z#�J<�
DNS ASK z#��
DNS ASK z#�o�:
'8.#.8.8':1036

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней