BackDoor.Maxplus.4648

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.netbt] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Самоудаляется.

Сетевая активность:

Подключается к:

'75.##1.211.121':34355
'71.##6.230.81':34355
'12#.#43.104.121':34355
'24.##8.244.153':34355
'22#.#38.35.232':34355
'71.##4.42.169':34355
'24.##.200.108':34355
'98.##8.162.151':34355
'16#.#24.5.130':34355
'75.##.121.53':34355
'10#.#.80.140':34355
'68.##6.104.204':34355
'24.#0.98.23':34355
'66.##3.202.79':34355
'76.##6.203.251':34355
'76.##4.141.53':34355
'24.##2.178.70':34355
'2.###.57.165':34355
'24.##3.189.50':34355
'20#.#9.140.223':34355
'71.#5.83.14':34355
'21#.#0.130.157':34355
'98.##8.58.67':34355
'98.##8.244.200':34355
'17#.#9.229.239':34355
'76.##2.177.106':34355
'68.##1.37.212':34355
'20#.#3.156.152':34355
'12#.#85.86.26':34355
'20#.#3.216.175':34355
'99.##3.151.99':34355
'69.##3.3.248':34355
'68.##4.93.178':34355
'76.##6.146.238':34355
'18#.#3.207.78':34355
'76.##9.201.162':34355
'71.##.169.123':34355
'67.##.190.62':34355
'76.##.198.168':34355
'50.##.108.83':34355
'18#.#3.161.10':34355
'90.##3.94.27':34355
'70.##0.153.49':34355
'84.##6.78.172':34355
'76.##8.106.42':34355
'18#.#10.98.100':34355
'76.##.94.219':34355
'18#.#5.176.131':34355
'17#.#72.81.128':34355
'70.##8.118.45':34355
'12.##4.216.198':34355
'71.##9.196.139':34355
'24.##4.81.56':34355
'10#.#.11.176':34355
'60.##0.168.177':34355
'17#.#2.143.144':34355
'11#.#31.196.217':34355
'24.#6.9.159':34355
'10#.#75.197.135':34355
'21#.#11.243.70':34355
'50.##7.80.77':34355
'93.##6.219.18':34355
'98.##0.254.98':34355
'17#.#30.24.148':34355
'18#.#4.122.190':34355
'99.##6.132.34':34355
'18#.#9.214.194':34355
'18#.#23.108.235':34355
'21#.#17.224.194':34355
'98.##3.54.217':34355
'24.#9.15.17':34355
'99.##6.68.25':34355
'68.##6.41.53':34355
'64.##1.144.5':34355
'76.##.253.117':34355
'98.##7.27.148':34355
'21#.#0.62.172':34355
'98.##4.135.180':34355
'18#.#21.91.24':34355
'24.#12.6.91':34355
'75.##1.225.240':34355
'76.##0.43.141':34355
'76.##.78.194':34355
'71.#98.8.37':34355
'12#.#17.66.149':34355
'68.##6.251.93':34355
'10#.#37.143.52':34355
'24.##5.71.193':34355
'10#.#5.93.72':34355
'68.##6.145.207':34355
'64.##9.175.132':34355
'68.##6.15.52':34355
'77.##.130.212':34355
'10#.10.81.2':34355
'71.##4.35.251':34355
'75.##9.33.224':34355
'18#.#3.221.33':34355
'71.#.127.67':34355
'68.##.150.69':34355
'24.##0.99.73':34355
'24.##4.103.172':34355
'79.##.183.30':34355
'24.##0.155.251':34355
'72.##6.118.132':34355
'17#.#4.121.160':34355
'24.##6.42.224':34355
'90.##1.17.241':34355
'69.##3.237.152':34355
'11#.#0.143.102':34355
'18#.#6.131.75':34355
'76.#6.84.30':34355
'98.##0.215.108':34355
'10#.#24.170.229':34355
'97.##.52.150':34355
'12#.#10.93.248':34355
'18#.#92.186.150':34355
'82.##2.148.121':34355
'71.##.85.148':34355
'99.##5.103.161':34355
'72.##7.21.63':34355
'74.##.55.107':34355
'17#.#0.228.175':34355
'20#.#29.50.64':34355
'72.##.217.88':34355
'46.##0.111.2':34355
'72.##1.161.99':34355
'20#.#32.220.195':34355
'75.##8.172.210':34355
'71.##2.138.92':34355
'65.##8.153.102':34355
'69.#24.21.7':34355
'17#.#98.89.167':34355
'20#.#7.26.15':34355
'10#.#69.63.100':34355
'17#.#48.6.200':34355
'18#.#1.34.211':34355
'68.##4.78.171':34355
'20#.#0.137.126':34355
'18#.#93.53.74':34355
'14#.#05.130.223':34355
'76.##2.206.92':34355
'17#.#8.240.26':34355
'46.##3.48.204':34355
'75.##8.133.6':34355
'17#.#4.58.34':34355
'68.##2.155.85':34355
'66.##8.53.173':34355
'75.##.127.20':34355
'92.##0.98.255':34355
'18#.#.99.241':34355
'12#.#89.131.145':34355
'84.##5.53.135':34355
'82.##.176.105':34355
'18#.#3.183.113':34355
'13#.#5.174.226':34355
'65.##.225.139':34355
'89.##.185.113':34355
'17#.#99.92.186':34355
'74.##7.240.225':34355
'18#.#97.5.69':34355
'98.##8.106.221':34355
'21#.#18.20.232':34355
'42.#.169.136':34355
'83.##.118.161':34355
'18#.#0.152.183':34355
'81.##.212.144':34355
'85.##.75.193':34355
'87.##.227.185':34355
'17#.#3.124.118':34355
'24.##.205.55':34355
'20#.#30.200.212':34355
'pr####.fling.com':80
'17#.#2.190.142':80
'20#.#30.128.155':34355
'17#.#62.14.198':34355
'76.##2.146.34':34355
'99.##3.133.8':34355
'98.##1.178.58':34355
'67.##.116.197':34355
'98.##3.254.11':34355
'84.#5.75.50':34355
'20#.#3.86.186':34355
'69.##2.82.48':34355
'69.##8.236.252':34355
'62.##3.156.127':34355
'4.##4.24.58':34355
'20#.#61.233.105':34355
'20#.#6.213.78':34355
'93.##.221.45':34355
'76.##1.236.123':34355
'75.##9.243.236':34355
'77.##.192.253':34355
'20#.#71.11.142':34355
'74.##.116.153':34355
'76.##.172.224':34355
'18#.#2.238.245':34355
'12#.#76.252.125':34355
'2.###.13.176':34355
'71.##.149.236':34355
'84.##0.84.240':34355
'17#.#7.22.38':34355
'67.##.156.166':34355
'17#.#8.170.123':34355
'69.##6.93.226':34355
'98.#7.20.10':34355
'18#.#07.219.95':34355
'79.#.243.93':34355
'89.##.239.218':34355
'24.##6.22.160':34355
'20#.#2.179.23':34355
'98.##6.21.128':34355
'18.##1.99.149':34355
'76.##2.56.235':34355
'79.##5.144.188':34355
'94.##5.86.147':34355
'68.#8.6.215':34355
'72.##.159.219':34355
'18#.#8.45.60':34355
'12#.#08.250.166':34355
'70.##1.94.107':34355
'69.##9.59.18':34355
'18#.#6.151.102':34355
'18#.#23.242.76':34355
'18#.#02.35.215':34355
'20#.#51.210.121':34355
'18#.20.17.2':34355
'21#.#83.133.234':34355
'85.##.242.205':34355
'65.##.252.24':34355
'75.##.134.173':34355
'68.#5.42.23':34355
'74.##.73.124':34355
'50.##9.234.3':34355
'2.##.164.42':34355
'17#.#40.252.72':34355
'75.##6.169.84':34355
'98.##7.92.29':34355
'64.#0.92.27':34355
'75.##0.26.96':34355
'77.##9.82.18':34355
'97.#6.66.6':34355
'24.##1.25.218':34355
'66.##.82.239':34355
'20#.#62.25.137':34355
'18#.#7.212.60':34355
'46.##.149.184':34355
'70.##3.240.246':34355
'17#.#8.37.74':34355
'76.##.39.187':34355
'46.##5.23.79':34355
'20#.#2.32.41':34355
'68.##.78.202':34355
'13#.#12.116.54':34355
'18#.#5.50.117':34355
'17#.#03.195.38':34355
'18#.#26.31.87':34355
'18#.#99.85.204':34355
'18#.#22.86.25':34355

TCP:

Запросы HTTP GET:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK v{#єe
DNS ASK v{#�
DNS ASK v{#O�B
DNS ASK v{#uͨ}
DNS ASK v{#GG�
DNS ASK v{#�y`T
DNS ASK v{#zb�5
DNS ASK v{#��/
DNS ASK v{#V�T�
DNS ASK v{#��Ӡ
DNS ASK pr####.fling.com
DNS ASK v{#��Œ
DNS ASK v{#�;*]
DNS ASK v{#,��t
DNS ASK v{#��
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней