BackDoor.Maxplus.3682

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.<Служебное имя>] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Самоудаляется.

Сетевая активность:

Подключается к:

'67.##2.39.131':34354
'17#.#0.16.161':34354
'2.###.39.228':34354
'99.##6.108.132':34354
'15#.#81.141.232':34354
'2.###.142.52':34354
'98.##0.250.143':34354
'59.##1.32.66':34354
'18#.#23.110.11':34354
'79.##9.105.148':34354
'24.##1.29.59':34354
'24.##7.42.61':34354
'22#.#07.111.61':34354
'71.##6.145.106':34354
'78.#2.72.86':34354
'68.#7.52.33':34354
'95.#9.38.18':34354
'67.##9.227.153':34354
'50.##.133.130':34354
'17#.#68.27.205':34354
'88.##9.224.33':34354
'85.##5.71.213':34354
'68.#1.29.79':34354
'92.#7.19.14':34354
'89.##6.253.179':34354
'41.##3.69.234':34354
'94.##.175.83':34354
'79.##2.24.228':34354
'72.##9.174.116':34354
'89.##6.130.107':34354
'88.##8.102.148':34354
'99.##7.155.245':34354
'21#.#2.59.201':34354
'10.#49.4.14':34354
'17#.#4.217.56':34354
'41.##1.40.194':34354
'69.##5.138.111':34354
'1.##.25.28':34354
'10#.#0.248.238':34354
'86.##.100.105':34354
'11#.#19.180.77':34354
'95.##.40.210':34354
'2.##.104.89':34354
'19#.#40.125.86':34354
'89.##8.229.119':34354
'18#.#5.107.159':34354
'99.##8.109.12':34354
'77.##.208.38':34354
'84.##8.217.193':34354
'67.#43.47.5':34354
'2.###.115.215':34354
'18#.#9.184.249':34354
'93.##8.34.73':34354
'10#.#28.83.219':34354
'18#.#31.27.180':34354
'74.##3.253.108':34354
'31.##0.226.182':34354
'24.##1.61.179':34354
'93.#0.51.42':34354
'86.#.118.25':34354
'67.##2.224.43':34354
'11#.#52.120.108':34354
'66.##.102.58':34354
'71.##3.68.25':34354
'17#.#6.173.38':34354
'15#.#1.73.197':34354
'84.##0.253.161':34354
'93.#5.33.70':34354
'84.##8.30.205':34354
'72.##9.178.149':34354
'71.##.188.206':34354
'17#.#9.113.153':34354
'92.#6.57.14':34354
'83.##3.136.24':34354
'91.##5.69.77':34354
'95.##.248.83':34354
'84.##0.194.14':34354
'78.##.28.180':34354
'2.###.157.192':34354
'89.##.69.206':34354
'91.##.167.174':34354
'88.##5.122.100':34354
'75.##5.46.100':34354
'66.##5.216.108':34354
'67.##.165.226':34354
'17#.#8.250.85':34354
'75.##6.84.252':34354
'14.#6.80.95':34354
'85.##.208.92':34354
'2.##4.10.40':34354
'89.##5.122.213':34354
'74.##4.33.139':34354
'17#.#32.41.38':34354
'17#.#8.234.42':34354
'17#.#4.34.51':34354
'37.##.185.136':34354
'17#.#4.73.136':34354
'95.##0.178.5':34354
'84.##0.253.45':34354
'93.##6.188.89':34354
'17#.#9.226.6':34354
'41.##0.180.220':34354
'17#.#90.70.126':34354
'76.##.154.111':34354
'68.##9.70.117':34354
'86.##6.233.228':34354
'17#.#2.136.131':34354
'46.##.66.229':34354
'74.##1.60.21':34354
'75.##9.62.49':34354
'78.##.33.111':34354
'77.#0.93.46':34354
'2.###.70.111':34354
'50.##8.245.142':34354
'98.##0.254.143':34354
'67.##3.237.206':34354
'46.##9.244.246':34354
'98.##0.226.147':34354
'13#.#85.25.148':34354
'98.##7.159.28':34354
'41.##.255.216':34354
'95.##.13.132':34354
'95.##1.106.134':34354
'95.##9.48.101':34354
'62.##9.138.54':34354
'84.##6.96.245':34354
'98.##2.234.137':34354
'78.##.38.214':34354
'99.##1.18.239':34354
'10#.#29.165.158':34354
'69.##2.79.187':34354
'10.##2.224.198':34354
'93.##.205.240':34354
'18#.#86.0.98':34354
'89.##0.235.254':34354
'67.##1.75.212':34354
'24.#8.8.170':34354
'94.##3.8.142':34354
'85.##.166.28':34354
'49.##.122.235':34354
'76.##0.163.243':34354
'92.##.112.247':34354
'19#.#8.190.229':34354
'89.##.153.120':34354
'76.##.45.122':34354
'18#.#.113.234':34354
'71.##0.114.40':34354
'69.##6.164.199':34354
'69.##.250.20':34354
'98.##3.197.73':34354
'10#.#51.53.169':34354
'96.##.104.91':34354
'62.##0.178.21':34354
'17#.#1.160.204':34354
'79.#2.41.85':34354
'88.##8.7.173':34354
'77.##3.45.92':34354
'85.#6.63.5':34354
'10#.#62.106.216':34354
'24.##5.203.104':34354
'17#.#2.185.39':34354
'63.##8.222.106':34354
'71.##.174.169':34354
'80.##4.25.212':34354
'46.##7.103.120':34354
'50.#5.158.7':34354
'82.##0.32.105':34354
'89.##4.129.142':34354
'98.##8.245.172':34354
'83.##4.35.146':34354
'90.##3.135.140':34354
'pr####.fling.com':80
'17#.#2.190.142':80
'88.##2.203.129':34354
'19#.#01.203.99':34354
'18#.#5.236.35':34354
'68.#.111.252':34354
'18#.#84.147.48':34354
'41.##6.92.121':34354
'72.#30.59.4':34354
'17#.#17.151.61':34354
'70.##8.104.148':34354
'24.##.190.21':34354
'19#.#2.94.232':34354
'71.#0.57.19':34354
'66.##.60.103':34354
'24.##6.10.140':34354
'21#.#30.77.184':34354
'10#.#5.81.67':34354
'46.##9.175.168':34354
'75.##.96.203':34354
'2.###.23.190':34354
'92.##4.150.226':34354
'92.##.232.38':34354
'78.##0.182.39':34354
'77.##0.30.103':34354
'20#.#8.222.3':34354
'18#.#37.70.43':34354
'81.##.159.77':34354
'17#.#8.240.64':34354
'95.##.72.180':34354
'84.##5.222.72':34354
'89.#8.60.61':34354
'18#.#5.100.98':34354
'75.##.227.105':34354
'17#.#9.161.72':34354
'46.##9.38.63':34354
'93.##.138.73':34354
'81.##1.151.245':34354
'71.##4.74.10':34354
'19#.#8.188.116':34354
'89.##.96.103':34354
'24.##2.144.156':34354
'2.##2.50.13':34354
'46.##9.48.220':34354
'18#.#.187.226':34354
'89.##.68.174':34354
'79.##9.247.211':34354
'17#.#68.50.181':34354
'81.##.169.225':34354
'69.##0.150.17':34354
'19#.#4.55.34':34354
'20#.#1.53.77':34354
'95.#7.28.93':34354
'66.##1.164.23':34354
'78.##.120.61':34354
'95.##.97.189':34354
'75.##.110.24':34354
'18#.#4.94.253':34354
'10.#7.59.5':34354
'20#.#48.110.47':34354
'63.##8.142.217':34354
'68.##.232.162':34354
'46.##.224.141':34354
'89.##6.111.145':34354
'95.#6.66.53':34354
'67.##.179.230':34354
'79.##9.57.205':34354
'93.##7.195.4':34354
'18#.#30.71.69':34354
'83.##2.187.153':34354
'18#.#47.96.174':34354
'70.##6.158.225':34354
'83.##.193.81':34354
'2.##9.4.230':34354
'95.#1.1.2':34354
'14#.#72.165.138':34354
'95.##.155.10':34354
'24.##.239.96':34354
'24.##6.78.205':34354
'24.##8.109.174':34354
'17#.#0.237.95':34354
'98.#48.6.54':34354
'96.##.230.27':34354
'13#.#8.29.91':34354
'66.##8.26.242':34354
'98.##3.25.70':34354
'37.##.104.21':34354

TCP:

Запросы HTTP GET:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK z#��
DNS ASK z#4�I
DNS ASK z#��!
DNS ASK z#��,�
DNS ASK z#�a�`
DNS ASK z#X_
DNS ASK z#�Dc
DNS ASK z#W�
DNS ASK z#��
DNS ASK z#t�Wr
DNS ASK pr####.fling.com
DNS ASK z#m�A@
DNS ASK z#��
DNS ASK z#�f�
DNS ASK z#b8
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней