BackDoor.Maxplus.3732

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.afd] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Самоудаляется.

Сетевая активность:

Подключается к:

'74.##.243.87':34354
'67.##.104.84':34354
'93.##7.201.94':34354
'71.##.45.242':34354
'98.##7.159.28':34354
'17#.#30.104.34':34354
'75.#7.6.234':34354
'89.##.74.206':34354
'18#.#68.2.34':34354
'41.##2.240.96':34354
'87.##0.42.36':34354
'68.##3.167.185':34354
'76.#7.42.32':34354
'19#.#2.94.232':34354
'93.##0.224.96':34354
'24.#9.64.7':34354
'83.##5.46.74':34354
'99.##.61.228':34354
'24.##0.137.197':34354
'18#.#5.152.237':34354
'18#.#7.161.203':34354
'46.##5.19.112':34354
'17#.#68.23.228':34354
'18#.#0.191.225':34354
'71.#0.59.36':34354
'19#.#8.14.81':34354
'2.###.82.184':34354
'24.##2.41.105':34354
'24.##.217.229':34354
'75.##0.89.197':34354
'2.##9.19.25':34354
'69.##3.231.229':34354
'10#.#10.94.64':34354
'69.##0.2.108':34354
'86.##.160.60':34354
'20#.#20.25.48':34354
'66.#9.88.65':34354
'50.##9.12.151':34354
'14#.#74.106.67':34354
'18#.#0.65.112':34354
'10#.#7.6.180':34354
'67.##0.20.12':34354
'84.##1.207.67':34354
'70.##4.67.189':34354
'10#.#7.250.200':34354
'89.##6.130.125':34354
'15#.#6.67.208':34354
'71.##.56.173':34354
'72.##9.14.196':34354
'85.##.161.137':34354
'76.##.45.122':34354
'24.##9.99.212':34354
'98.##6.4.103':34354
'37.##.47.184':34354
'10#.#92.248.81':34354
'76.##6.63.129':34354
'50.##.133.155':34354
'92.##2.165.116':34354
'92.##4.153.204':34354
'24.##5.6.194':34354
'19#.#46.217.204':34354
'75.##7.232.204':34354
'19#.#1.146.118':34354
'91.##7.60.22':34354
'68.##4.245.39':34354
'24.##1.39.22':34354
'75.##6.118.19':34354
'21#.#7.108.166':34354
'86.##.216.149':34354
'2.###.37.244':34354
'20#.#0.98.142':34354
'77.##1.100.243':34354
'84.##.122.121':34354
'98.##0.245.94':34354
'41.##.151.192':34354
'78.##.144.83':34354
'66.##.14.194':34354
'20#.#06.115.106':34354
'68.##2.134.24':34354
'88.##8.204.96':34354
'18#.#19.175.98':34354
'2.##.166.131':34354
'93.##.223.249':34354
'78.#4.45.9':34354
'71.##.107.248':34354
'13#.#0.117.130':34354
'74.##.183.252':34354
'74.##3.193.205':34354
'24.#6.117.3':34354
'20#.#53.1.108':34354
'2.###.174.14':34354
'67.##4.26.139':34354
'95.##.180.15':34354
'98.##3.57.135':34354
'78.#4.12.10':34354
'93.##.123.246':34354
'18#.#95.70.126':34354
'17#.#22.111.205':34354
'75.##.106.59':34354
'94.##4.135.212':34354
'10#.#85.202.15':34354
'78.##0.188.84':34354
'92.##5.8.251':34354
'21#.#0.97.13':34354
'19#.#91.46.137':34354
'20#.6.51.19':34354
'92.##5.168.74':34354
'87.##0.57.154':34354
'24.#.103.121':34354
'2.###.12.225':34354
'68.##2.155.123':34354
'76.##2.188.244':34354
'21#.#40.87.139':34354
'17#.#3.103.61':34354
'70.##8.19.196':34354
'84.##6.245.71':34354
'72.##1.112.73':34354
'92.##5.193.82':34354
'46.##.113.34':34354
'78.##.130.78':34354
'98.##7.47.81':34354
'15#.#7.206.221':34354
'50.#2.29.46':34354
'87.#.218.57':34354
'79.##7.202.62':34354
'20#.#7.186.130':34354
'2.###.184.71':34354
'58.##.216.62':34354
'18#.#37.64.225':34354
'85.##3.247.253':34354
'72.##8.210.56':34354
'79.#.31.241':34354
'84.##.245.184':34354
'80.##1.172.33':34354
'97.##.168.128':34354
'93.##.84.171':34354
'71.#8.1.19':34354
'70.##5.183.7':34354
'17#.#5.68.218':34354
'93.##.202.36':34354
'29.##4.38.66':34354
'24.##.30.216':34354
'84.##7.188.146':34354
'69.##8.67.190':34354
'70.##5.244.156':34354
'24.##1.145.196':34354
'95.##.209.83':34354
'75.##3.239.112':34354
'78.##.193.121':34354
'24.##3.33.78':34354
'17#.90.96.3':34354
'71.##1.112.138':34354
'19#.#06.6.170':34354
'13#.#91.12.226':34354
'83.#.246.133':34354
'67.##6.137.30':34354
'18#.#37.108.36':34354
'18#.#1.198.13':34354
'20#.#22.13.78':34354
'75.#3.14.0':34354
'86.##6.219.123':34354
'20#.#8.105.201':34354
'21#.#45.183.218':34354
'62.##4.135.133':34354
'95.#5.84.80':34354
'37.#.81.24':34354
'24.##2.47.194':34354
'18#.#6.84.204':34354
'98.##9.40.246':34354
'98.##5.86.19':34354
'17#.#00.134.6':34354
'pr####.fling.com':80
'17#.#2.190.142':80
'74.##4.180.174':34354
'76.##6.107.121':34354
'89.#8.83.42':34354
'19#.#11.143.100':34354
'18#.#.27.202':34354
'15#.#1.180.120':34354
'98.##5.65.199':34354
'46.##9.47.219':34354
'10#.8.77.48':34354
'10#.#28.20.38':34354
'2.###.87.106':34354
'85.##7.89.190':34354
'98.##.202.64':34354
'21#.#67.21.5':34354
'19#.#98.216.89':34354
'24.##7.40.18':34354
'17#.#97.69.147':34354
'77.##0.30.103':34354
'67.##7.139.174':34354
'50.##.253.249':34354
'98.#64.0.75':34354
'24.##.152.118':34354
'83.##2.187.153':34354
'19#.#98.210.39':34354
'18#.#80.160.2':34354
'17#.#25.245.95':34354
'79.##2.153.252':34354
'17#.#6.107.24':34354
'17#.#3.224.249':34354
'93.##.48.145':34354
'98.##5.137.184':34354
'98.##2.179.166':34354
'41.##7.209.188':34354
'13#.#34.208.189':34354
'79.#.63.47':34354
'81.##8.140.114':34354
'95.##2.214.241':34354
'94.##7.247.135':34354
'85.#4.5.129':34354
'12#.#75.4.55':34354
'2.###.57.223':34354
'10#.#09.41.65':34354
'94.##4.64.254':34354
'63.##5.249.167':34354
'69.##2.174.162':34354
'76.##5.92.143':34354
'69.##5.180.142':34354
'18#.#54.188.99':34354
'18#.#15.196.170':34354
'88.##2.159.158':34354
'72.##0.19.60':34354
'17#.#18.199.122':34354
'85.##5.160.212':34354
'76.##8.124.207':34354
'2.###.219.252':34354
'10#.#9.196.57':34354
'68.##7.160.174':34354
'79.##3.202.149':34354
'94.##3.109.96':34354
'67.##.165.226':34354
'75.##0.180.220':34354
'75.##1.116.220':34354
'88.##2.100.220':34354
'93.##2.70.101':34354
'11#.#93.128.239':34354
'77.##4.24.217':34354
'64.##.198.239':34354
'86.##6.36.127':34354
'70.##.137.214':34354
'17#.#.63.191':34354
'89.##5.28.66':34354
'88.##7.40.139':34354
'78.##.102.229':34354
'17#.#4.75.217':34354
'75.##1.237.169':34354
'46.#0.73.77':34354
'89.##6.252.165':34354
'76.##4.218.40':34354
'46.##0.131.38':34354
'76.##.243.164':34354
'92.#0.5.155':34354
'95.##5.208.211':34354
'74.##.74.194':34354
'87.##7.166.54':34354
'17#.#68.62.224':34354

TCP:

Запросы HTTP GET:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK z#p}S
DNS ASK z#5�
DNS ASK z#�NZ�
DNS ASK z#�)�;
DNS ASK z#ǣ_
DNS ASK z#Y�x
DNS ASK z#��s
DNS ASK z#V27Z
DNS ASK z#�<L�
DNS ASK z#u'�
DNS ASK pr####.fling.com
DNS ASK z#lU�
DNS ASK z# �2
DNS ASK z#�k�2
DNS ASK z#c��
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней