BackDoor.Socks.79

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11222' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8101' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21136' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18015' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24701' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23444' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19666' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15050' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17836' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29400' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11092' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17561' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31051' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24258' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22607' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1404' = '<Полный путь к вирусу>'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Создает и запускает на исполнение:

'C:\lsass.exe' exe <Полный путь к вирусу>

Изменения в файловой системе:

Создает следующие файлы:

C:\lsass.exe

Сетевая активность:

Подключается к:

'41.##9.43.225':3128
'19#.#17.42.108':3128
'95.##6.199.172':3128
'20#.#44.163.26':3128
'75.##9.80.227':3128
'85.##5.215.89':3128
'68.##9.153.130':3128
'76.##9.47.171':3128
'22#.#49.84.42':3128
'10#.#09.154.149':3128
'20#.#36.99.18':3128
'89.##3.145.218':3128
'75.##9.59.21':3128
'20#.#3.128.70':3128
'78.#9.44.98':3128
'18#.#4.152.219':3128
'11#.89.9.19':3128
'69.##.204.14':3128
'62.##1.92.122':3128
'78.##.185.170':3128
'71.##.243.177':3128
'88.##9.56.62':3128
'70.##.141.210':3128
'89.##.88.140':3128
'19#.#42.64.152':3128
'71.##.91.112':3128
'82.##7.145.221':3128
'21#.#28.216.119':3128
'61.##9.227.90':3128
'66.##5.39.10':3128
'86.#1.9.113':3128
'83.##9.146.58':3128
'10#.#21.23.171':3128
'41.##9.43.208':3128
'2.##.224.157':3128
'74.##2.34.129':3128
'18#.#92.116.207':3128
'76.##7.155.138':3128
'89.##3.155.139':3128
'17#.23.85.2':3128
'20#.#3.132.103':3128
'18#.#21.249.139':3128
'17#.#3.152.252':3128
'74.#4.43.82':3128
'12#.#43.138.169':3128
'41.##9.42.39':3128
'94.##9.90.255':3128
'71.#0.80.70':3128
'98.##4.113.180':3128
'75.##7.177.27':3128
'60.#3.28.64':3128
'41.#50.18.9':3128
'97.##.66.201':3128
'24.##2.62.38':3128
'81.##.243.25':3128
'21#.#27.100.32':3128
'78.##.24.108':3128
'14#.#33.140.195':3128
'70.##.90.171':3128
'82.##.196.74':3128
'19#.#.10.166':3128
'11#.#33.239.184':3128
'24.##3.220.159':3128
'77.#2.56.66':3128
'80.##.90.229':3128
'79.##8.25.180':3128
'85.##2.12.94':3128
'82.##3.221.63':3128
'17#.#07.144.78':3128
'69.##6.4.245':3128
'10.#.1.254':3128
'10#.#82.80.107':3128
'15#.#9.229.24':3128
'86.##.165.24':3128
'89.##5.44.119':3128
'69.#7.254.8':3128
'19#.#17.45.181':3128
'95.##6.150.188':3128
'94.##9.169.1':3128
'41.##9.51.182':3128
'85.##.193.149':3128
'69.##.66.105':3128
'21#.#24.52.73':3128
'88.##7.21.89':3128
'68.##3.221.146':3128
'72.##5.150.233':3128
'85.##0.242.90':3128
'81.#3.180.1':3128
'69.##3.7.218':3128
'20#.#3.142.46':3128
'89.##4.169.235':3128
'84.##9.251.126':3128
'86.##.125.246':3128
'18#.#92.75.143':3128
'12#.#20.104.213':3128
'10#.#82.134.53':3128
'85.##8.186.30':3128
'20#.#25.233.8':3128
'17#.#51.183.251':3128
'localhost':6482
'11#.#4.56.147':6667
'58.##.63.116':6667
'21#.#49.78.233':6667
'18#.#92.116.207':6667
'76.##0.17.223':3128
'11#.#98.81.14':3128
'78.##.116.159':3128
'98.##3.41.173':3128
'85.##8.187.181':3128
'18#.#92.49.231':3128
'17#.#.86.104':3128
'71.##.83.135':3128
'84.##9.141.3':3128
'17#.#37.120.77':3128
'20#.#2.190.60':3128
'77.##1.243.150':3128
'71.#0.86.76':3128
'59.##.144.183':3128
'19#.#10.255.147':3128
'74.#8.2.89':3128
'12#.#93.247.36':3128
'21#.#86.168.164':3128
'18#.#27.129.97':3128
'10#.#82.62.140':3128
'87.##8.57.137':3128
'89.##.216.17':3128
'41.##2.95.12':3128
'24.#.229.177':3128
'82.##2.103.247':3128
'41.##6.12.78':3128
'17#.#51.202.150':3128
'85.##.213.26':3128
'92.##.63.158':3128
'12#.#43.239.200':3128
'89.##4.127.222':3128
'88.##6.79.53':3128
'65.#5.2.84':3128
'20#.#68.86.168':3128
'76.##7.134.40':3128
'89.##3.169.160':3128
'12#.#20.104.159':3128
'17#.#37.216.73':3128
'67.#25.22.9':3128
'68.##.133.85':3128
'18#.#60.110.101':3128
'12#.#68.130.45':3128
'17#.#51.15.100':3128
'75.##9.231.168':3128
'72.##4.119.245':3128
'20#.#09.60.66':3128
'67.##.252.140':3128
'19#.#01.90.89':3128
'83.##2.184.125':3128
'21#.#25.194.135':3128
'61.##.240.63':3128
'78.#3.67.48':3128
'62.##.126.114':3128
'72.##9.187.230':3128
'77.##.173.135':3128
'75.##3.32.225':3128
'68.##4.42.224':3128
'21#.#25.199.186':3128
'24.#.109.170':3128
'17#.#36.144.178':3128
'21#.#2.242.130':3128
'12#.#68.245.39':3128
'60.##.81.137':3128
'41.##7.18.27':3128
'85.##.185.143':3128
'21#.#42.139.148':3128
'66.##3.214.49':3128
'65.#4.68.90':3128
'89.##7.75.85':3128
'59.##.23.157':3128
'67.##1.75.211':3128
'61.##.198.151':3128
'18#.#67.42.193':3128
'86.##8.105.189':3128
'85.##1.122.24':3128
'76.##1.139.217':3128
'10#.#82.138.20':3128
'88.##3.230.71':3128
'79.##9.176.17':3128
'69.##1.148.110':3128
'10#.#82.130.57':3128
'20#.#32.222.204':3128
'41.##5.208.184':3128
'85.##4.234.100':3128
'21#.#6.112.137':3128
'21#.#50.232.253':3128
'96.#.48.88':3128
'19#.#17.204.114':3128
'41.##7.19.130':3128
'68.##8.68.20':3128
'83.#65.9.7':3128
'59.##6.187.31':3128
'71.#0.83.37':3128
'70.##8.145.212':3128
'72.##.200.153':3128
'79.##9.179.201':3128
'88.##3.179.180':3128
'77.##9.116.126':3128
'17#.#9.246.48':3128
'24.##7.29.118':3128
'85.##7.57.116':3128
'24.#.182.90':3128
'24.##5.13.198':3128
'20#.#0.125.203':3128
'91.##7.127.149':3128
'41.##9.45.216':3128
'18#.#69.233.30':3128
'59.##.171.43':3128
'89.#42.79.3':3128
'76.##9.139.250':3128
'76.##7.4.111':3128
'76.##.228.35':3128
'20#.#67.215.225':3128
'21#.#44.187.200':3128
'89.##2.32.160':3128
'20#.#09.111.198':3128
'20#.#61.60.118':3128
'10#.#08.121.24':3128
'20#.#3.233.211':3128
'77.##6.112.114':3128
'21#.#25.194.112':3128
'10#.#09.42.141':3128
'99.##.20.184':3128
'89.##2.38.99':3128
'67.##1.124.240':3128
'19#.#17.221.150':3128
'41.##9.38.21':3128
'20#.#4.35.33':3128
'74.##.209.166':3128
'75.#4.49.37':3128
'60.##.185.210':3128
'19#.#49.49.0':3128
'85.##1.119.167':3128
'99.##5.202.182':3128
'16#.#50.62.129':3128
'20#.#15.26.253':3128
'72.##4.184.210':3128
'64.##5.32.70':3128
'79.##9.184.229':3128
'76.##8.229.174':3128
'11#.#4.56.147':3128
'20#.#3.135.186':3128
'11#.#93.123.97':3128
'81.##3.159.26':3128
'66.##.65.155':3128
'12#.#83.227.100':3128
'92.##.230.206':3128
'70.##3.174.160':3128
'95.##6.159.102':3128
'66.##4.255.203':3128
'85.##4.60.135':3128
'60.##.245.220':3128
'21#.#25.178.100':3128
'20#.#6.189.88':3128
'85.##.169.176':3128
'85.##5.213.102':3128
'72.##.107.162':3128
'24.##9.179.203':3128
'12.##7.102.64':3128
'19#.#01.161.20':3128
'21#.#52.49.85':3128
'18#.#4.152.243':3128
'85.##2.96.46':3128
'20#.#53.206.134':3128
'94.##5.55.88':3128
'99.##4.39.66':3128
'21#.#19.194.130':3128
'65.##.236.70':3128
'84.##2.151.196':3128
'67.##2.186.176':3128
'77.##0.125.190':3128
'94.##.202.43':3128
'20#.#52.243.171':3128
'19#.#3.175.197':3128
'74.##.28.210':3128
'92.##1.94.172':3128
'78.#3.8.115':3128
'86.##.127.140':3128
'66.##9.155.42':3128
'14#.#48.224.140':3128
'67.##.126.190':3128
'19#.#3.166.12':3128
'12#.#4.69.136':3128
'95.##6.180.95':3128
'17#.#6.15.69':3128
'79.##8.24.207':3128
'12#.#68.31.145':3128
'98.##4.119.148':3128
'18#.#21.255.244':3128
'71.##2.54.178':3128
'71.##.81.163':3128
'20#.#3.133.174':3128
'24.##6.229.108':3128
'81.##8.155.163':3128
'19#.#28.92.90':3128
'80.##7.88.80':3128
'22#.#6.147.50':3128
'71.#0.86.42':3128
'21#.#49.78.233':3128
'85.##6.118.69':3128
'85.##.213.12':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней