BackDoor.Maxplus.3797

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.<Служебное имя>] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Самоудаляется.

Сетевая активность:

Подключается к:

'88.##0.154.17':34354
'75.##3.62.87':34354
'17#.#8.135.102':34354
'10#.#67.125.198':34354
'92.##5.146.16':34354
'88.##9.208.82':34354
'31.##0.60.198':34354
'24.##.54.198':34354
'78.##8.112.18':34354
'95.##.156.91':34354
'21#.#02.51.94':34354
'19#.#46.217.204':34354
'94.##3.122.100':34354
'17#.#68.26.217':34354
'46.##8.138.98':34354
'17#.#07.111.17':34354
'91.##5.11.128':34354
'71.#0.0.130':34354
'17#.#4.103.71':34354
'21#.#5.19.70':34354
'24.##8.59.135':34354
'13#.#91.112.135':34354
'10#.#98.228.66':34354
'76.#10.35.8':34354
'75.##.43.245':34354
'75.##3.93.79':34354
'68.#.166.246':34354
'46.##3.120.220':34354
'85.##7.89.190':34354
'18#.#03.43.190':34354
'84.##.211.77':34354
'93.##8.244.26':34354
'68.##9.155.247':34354
'95.##6.156.24':34354
'24.##.143.12':34354
'74.##.130.195':34354
'11#.#02.3.196':34354
'62.##3.239.83':34354
'20#.#25.131.83':34354
'89.##.105.113':34354
'19#.#94.50.68':34354
'24.##1.70.127':34354
'84.##2.27.181':34354
'17#.#9.90.183':34354
'19#.#9.28.29':34354
'18#.#2.227.119':34354
'66.#5.67.71':34354
'95.##.151.71':34354
'78.##.109.97':34354
'78.#.187.37':34354
'94.##3.49.95':34354
'69.##2.0.203':34354
'83.##4.252.97':34354
'94.##.152.199':34354
'76.##3.242.96':34354
'71.##.100.203':34354
'85.##8.74.19':34354
'76.#7.20.91':34354
'46.#0.21.86':34354
'19#.#5.205.87':34354
'89.##5.173.195':34354
'85.##8.225.94':34354
'17#.#68.20.213':34354
'95.##2.86.206':34354
'2.###.188.91':34354
'88.##8.53.97':34354
'94.##0.27.220':34354
'24.##6.157.91':34354
'95.##.171.82':34354
'69.##1.43.116':34354
'2.###.115.99':34354
'79.##7.58.36':34354
'92.##.22.222':34354
'17#.#50.222.81':34354
'74.##7.163.67':34354
'78.##1.213.71':34354
'88.##3.24.22':34354
'62.##0.178.21':34354
'17#.#16.225.24':34354
'91.##7.60.22':34354
'99.##7.102.242':34354
'19#.#2.181.247':34354
'98.##3.51.254':34354
'17#.#8.248.7':34354
'68.#.166.254':34354
'46.##5.101.5':34354
'72.##2.3.246':34354
'18#.#42.55.118':34354
'12#.#2.162.190':34354
'71.#.77.147':34354
'50.##.210.195':34354
'18#.#86.223.154':34354
'2.###.35.171':34354
'75.##4.118.135':34354
'21#.#00.48.126':34354
'93.##.240.178':34354
'77.##3.63.234':34354
'46.##0.111.52':34354
'68.##.239.141':34354
'17#.#2.51.54':34354
'69.##8.221.143':34354
'72.##8.105.48':34354
'76.##5.50.52':34354
'89.##9.96.35':34354
'17#.#34.185.63':34354
'89.##4.23.10':34354
'67.##.227.173':34354
'1.##.183.173':34354
'10#.#99.136.229':34354
'67.##3.156.232':34354
'24.##2.91.61':34354
'79.##6.147.171':34354
'18#.#58.43.170':34354
'75.#4.0.2':34354
'69.##3.213.163':34354
'85.#0.48.37':34354
'65.##.52.166':34354
'24.##9.153.64':34354
'95.##.126.46':34354
'46.##.162.234':34354
'18#.#.220.154':34354
'18#.#23.47.240':34354
'10#.#4.120.152':34354
'76.#7.74.47':34354
'99.##6.204.163':34354
'82.#4.90.38':34354
'66.##.23.156':34354
'89.##.147.165':34354
'46.#5.56.29':34354
'2.##0.44.88':34354
'10#.#0.63.164':34354
'93.##.213.111':34354
'15#.#52.138.181':34354
'10.##.161.210':34354
'18#.#18.215.185':34354
'93.##.100.121':34354
'71.##.200.250':34354
'71.##9.16.51':34354
'95.##.133.56':34354
'74.##.244.33':34354
'18#.#5.24.225':34354
'91.##0.180.52':34354
'24.##.248.129':34354
'88.##2.203.129':34354
'77.#0.93.46':34354
'79.##2.48.200':34354
'14.##.153.205':34354
'75.##5.205.205':34354
'87.#.167.49':34354
'99.##1.160.193':34354
'24.##5.216.13':34354
'79.##.128.130':34354
'17#.#8.113.118':34354
'76.#8.8.137':34354
'92.##.211.16':34354
'10#.#14.193.219':34354
'17#.#24.146.95':34354
'14#.#96.101.91':34354
'17#.#0.239.11':34354
'21#.#02.149.176':34354
'41.##.35.132':34354
'79.##.118.213':34354
'98.##1.57.137':34354
'92.##.41.167':34354
'76.##7.124.98':34354
'74.##2.125.219':34354
'21#.#6.24.108':34354
'95.#3.218.2':34354
'75.##6.100.197':34354
'10#.#3.103.59':34354
'76.##4.115.238':34354
'pr####.fling.com':80
'17#.#2.190.142':80
'17#.#4.103.208':34354
'24.##.25.103':34354
'78.#1.31.59':34354
'68.##3.240.88':34354
'82.##.173.118':34354
'19#.#75.65.200':34354
'10#.#75.71.82':34354
'67.##3.126.229':34354
'31.##.37.197':34354
'92.##5.246.237':34354
'75.##5.131.203':34354
'76.##.43.118':34354
'46.##.66.229':34354
'17#.#9.248.8':34354
'24.##3.56.213':34354
'17#.#77.206.3':34354
'10#.#33.194.29':34354
'17#.#14.17.147':34354
'92.##9.154.141':34354
'41.##1.101.26':34354
'67.#.220.159':34354
'95.##5.52.149':34354
'75.##1.132.49':34354
'17#.#2.125.149':34354
'12#.#23.103.5':34354
'18#.#37.210.145':34354
'24.#36.3.4':34354
'74.##4.19.147':34354
'2.###.69.158':34354
'95.#4.86.45':34354
'86.##6.53.161':34354
'2.###.219.158':34354
'95.##5.37.36':34354
'17#.#0.36.238':34354
'46.##7.207.2':34354
'93.#0.108.3':34354
'37.##.224.66':34354
'76.##6.29.254':34354
'2.##.137.244':34354
'66.##9.186.66':34354
'95.##.230.130':34354
'18#.9.81.64':34354
'79.##3.223.175':34354
'24.#9.16.10':34354
'75.##.245.235':34354
'77.#3.28.55':34354
'84.##0.207.144':34354
'21#.#42.104.144':34354
'18#.#1.136.64':34354
'17#.#68.34.8':34354
'75.##0.209.225':34354
'17#.#68.27.141':34354
'11#.#18.44.241':34354
'17#.#32.173.239':34354
'17#.#32.123.124':34354
'20#.#.114.119':34354
'95.##.71.107':34354
'98.##8.182.175':34354
'92.#7.23.48':34354
'98.##7.212.237':34354
'12#.#01.127.149':34354
'75.##6.117.170':34354
'92.##4.78.195':34354
'84.##5.56.235':34354
'69.#3.40.91':34354
'70.##0.93.186':34354
'66.##8.248.183':34354
'72.##0.114.243':34354
'19#.#90.140.155':34354
'37.##.150.161':34354
'98.##6.62.93':34354
'41.##7.95.166':34354
'96.#1.44.39':34354
'93.##.223.39':34354
'74.##2.65.188':34354
'31.##5.134.17':34354
'17#.#6.23.172':34354
'77.#2.41.74':34354
'98.##3.40.228':34354
'46.##6.85.16':34354
'2.##.191.202':34354
'24.##.238.97':34354
'18#.#7.51.255':34354
'19#.#.198.221':34354

TCP:

Запросы HTTP GET:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK z#."4
DNS ASK z#.Eޏ
DNS ASK z#.
DNS ASK z#.{�i
DNS ASK z#.��
DNS ASK z#.�1@
DNS ASK z#.Զ!
DNS ASK z#.`~
DNS ASK z#.n
DNS ASK z#.u��
DNS ASK pr####.fling.com
DNS ASK z#.��
DNS ASK z#.�{I
DNS ASK z#.9�`
DNS ASK z#.��
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней