BackDoor.Maxplus.2461

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.mrxsmb] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Самоудаляется.

Сетевая активность:

Подключается к:

'76.##.94.219':34355
'66.##.82.239':34355
'20#.#62.25.137':34355
'76.##.198.168':34355
'17#.#3.124.118':34355
'81.##7.66.50':34355
'68.##3.197.190':34355
'24.##0.99.73':34355
'99.##6.132.34':34355
'17#.#1.106.162':34355
'11#.#7.208.89':34355
'12#.#37.232.79':34355
'75.##0.26.96':34355
'11#.#1.3.224':34355
'75.##.121.53':34355
'84.##3.46.170':34355
'24.##2.178.70':34355
'98.##6.21.128':34355
'11#.#00.87.173':34355
'71.#5.83.14':34355
'17#.#06.147.134':34355
'67.##7.42.164':34355
'71.##.85.148':34355
'24.##4.130.174':34355
'13#.#5.174.226':34355
'24.#6.9.159':34355
'98.##4.135.180':34355
'72.##6.118.132':34355
'18#.#26.223.136':34355
'24.##.205.55':34355
'81.##.45.204':34355
'24.##8.244.153':34355
'17#.#4.239.35':34355
'70.##8.118.45':34355
'12#.#45.79.59':34355
'18#.#94.46.158':34355
'18#.#10.39.124':34355
'76.##0.43.141':34355
'17#.#4.58.34':34355
'69.#24.21.7':34355
'17#.#2.143.144':34355
'18#.#5.50.117':34355
'76.##9.201.162':34355
'98.##4.226.50':34355
'82.##5.59.182':34355
'65.##.225.139':34355
'67.##2.174.186':34355
'93.##6.219.58':34355
'62.##9.113.24':34355
'87.#.12.198':34355
'78.##6.188.175':34355
'17#.#4.121.160':34355
'74.##7.35.83':34355
'84.#5.75.50':34355
'2.###.158.170':34355
'17#.#98.89.167':34355
'74.##6.17.226':34355
'99.##3.123.207':34355
'24.##9.52.18':34355
'76.##.253.117':34355
'76.##4.141.53':34355
'93.##.196.232':34355
'11#.#42.213.91':34355
'75.##2.200.117':34355
'75.#7.75.46':34355
'17#.#72.81.128':34355
'67.##4.43.174':34355
'12.##4.216.198':34355
'67.##.190.62':34355
'10#.#37.143.52':34355
'76.##1.236.123':34355
'82.##2.148.121':34355
'98.##7.27.148':34355
'19#.#48.24.24':34355
'24.##7.217.236':34355
'75.##1.211.121':34355
'14#.#57.154.95':34355
'18#.#19.135.82':34355
'20#.#7.116.180':34355
'18#.#0.103.107':34355
'70.##4.219.25':34355
'2.##6.4.140':34355
'88.##5.202.82':34355
'72.##8.83.67':34355
'99.#03.12.2':34355
'66.##.227.206':34355
'20#.#61.233.105':34355
'17#.#5.110.38':34355
'18#.#52.31.77':34355
'12#.#16.113.24':34355
'17#.#9.194.101':34355
'18#.#4.32.171':34355
'50.##.108.83':34355
'18#.#26.130.9':34355
'68.##5.87.130':34355
'20#.#64.155.211':34355
'11#.#4.137.153':34355
'89.##0.186.39':34355
'10#.#06.130.182':34355
'17#.#29.1.13':34355
'98.##3.54.217':34355
'66.#.185.171':34355
'69.##8.118.98':34355
'71.##6.230.81':34355
'10#.#89.76.38':34355
'68.##.150.69':34355
'24.##6.22.160':34355
'75.#.134.98':34355
'17#.#9.2.125':34355
'75.##9.33.224':34355
'20#.#9.148.143':34355
'98.##7.92.95':34355
'68.##1.37.212':34355
'65.##.252.24':34355
'70.##8.176.100':34355
'75.##2.94.197':34355
'97.#6.66.6':34355
'18#.20.17.2':34355
'77.##1.123.130':34355
'17#.#62.112.113':34355
'18#.59.67.5':34355
'12#.#.224.167':34355
'17#.#0.228.175':34355
'76.##.78.194':34355
'18#.#92.185.124':34355
'10#.#6.230.5':34355
'94.##7.102.228':34355
'15#.#1.181.93':34355
'20#.#72.161.83':34355
'98.##0.215.108':34355
'16#.#0.85.249':34355
'76.##.172.224':34355
'76.##.39.187':34355
'67.##3.56.221':34355
'18#.#01.178.40':34355
'70.##9.196.133':34355
'17#.#8.130.157':34355
'69.##2.9.168':34355
'92.##2.216.100':34355
'77.##1.192.162':34355
'94.##2.97.126':34355
'75.##.234.242':34355
'99.##7.149.11':34355
'10#.#75.197.135':34355
'67.##1.30.107':34355
'72.##3.57.35':34355
'85.##4.230.102':34355
'24.#12.6.91':34355
'17#.#69.104.53':34355
'13#.#32.97.61':34355
'79.#7.68.81':34355
'20#.#58.174.28':34355
'12#.#08.250.166':34355
'21#.#0.130.157':34355
'18#.#94.160.47':34355
'24.##4.81.56':34355
'14#.#5.140.208':34355
'18#.#97.5.69':34355
'67.##.156.166':34355
'20#.#61.235.108':34355
'87.##.210.212':34355
'46.##5.3.109':34355
'18#.#23.107.231':34355
'18#.#55.127.254':34355
'18#.#5.249.148':34355
'84.##5.53.135':34355
'18#.#84.233.183':34355
'18#.#23.242.111':34355
'50.##7.80.77':34355
'17#.#03.195.38':34355
'75.##8.209.123':34355
'pr####.fling.com':80
'17#.#2.190.142':80
'11#.#54.59.226':34355
'81.##0.121.4':34355
'76.##8.106.42':34355
'80.##0.68.251':34355
'81.##2.79.190':34355
'75.#6.23.46':34355
'17#.#7.218.109':34355
'20#.#3.82.154':34355
'72.##1.161.99':34355
'10#.#0.95.156':34355
'17#.#34.64.39':34355
'18#.#17.58.185':34355
'98.##8.162.151':34355
'97.##.234.91':34355
'2.##3.6.197':34355
'18#.#3.245.219':34355
'21#.30.1.63':34355
'14#.#69.233.146':34355
'67.##.116.197':34355
'75.##6.169.84':34355
'89.##.185.113':34355
'20#.#2.39.111':34355
'21#.#29.91.238':34355
'91.##1.11.213':34355
'85.##.242.205':34355
'75.##4.126.188':34355
'92.#5.26.16':34355
'75.##8.77.134':34355
'68.##.128.200':34355
'18#.#2.74.193':34355
'17#.#18.232.232':34355
'18#.#.102.186':34355
'72.##.159.219':34355
'18#.#10.99.223':34355
'24.##6.42.224':34355
'91.##.226.226':34355
'68.##6.104.204':34355
'71.##8.17.180':34355
'64.##1.144.5':34355
'17#.#29.57.145':34355
'46.##3.48.204':34355
'70.##3.240.246':34355
'62.##3.156.127':34355
'82.##.176.105':34355
'75.##.186.82':34355
'71.##9.196.139':34355
'98.##0.254.98':34355
'85.##.105.162':34355
'12#.#43.104.33':34355
'93.##.218.252':34355
'77.##.130.212':34355
'95.##3.161.174':34355
'67.##1.255.133':34355
'71.##4.42.169':34355
'2.##.186.170':34355
'18#.#93.53.74':34355
'71.#98.8.37':34355
'98.##8.244.200':34355
'85.##1.215.238':34355
'20#.82.88.2':34355
'94.##6.13.240':34355
'13#.#15.248.82':34355
'18#.#10.64.105':34355
'70.#25.5.34':34355
'24.##5.50.23':34355
'89.##6.139.92':34355
'94.##1.22.186':34355
'77.##1.98.94':34355
'21#.#9.116.118':34355
'17#.#8.240.26':34355
'88.##5.119.80':34355
'74.##.114.92':34355
'18#.#6.151.102':34355
'68.##3.165.240':34355
'81.##.212.144':34355
'12#.#23.93.119':34355
'75.##1.225.240':34355
'74.##.73.124':34355
'16#.#24.5.130':34355
'68.##4.78.171':34355
'76.##2.206.92':34355
'18#.#01.205.186':34355
'21#.#81.66.234':34355
'87.##.227.185':34355
'21#.#0.62.172':34355

TCP:

Запросы HTTP GET:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK v{#��=
DNS ASK v{#Κז
DNS ASK v{#j��
DNS ASK v{#P��p
DNS ASK v{#<.�
DNS ASK v{#�8Y
DNS ASK v{#_�8
DNS ASK v{#��w
DNS ASK v{#s�
DNS ASK v{#��
DNS ASK pr####.fling.com
DNS ASK v{#�؝�
DNS ASK v{#�RrP
DNS ASK v{# �y
DNS ASK v{#�w�
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней