BackDoor.Maxplus.4513

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\.ipsec] 'ImagePath' = '\?'

Malicious functions:

Injects code into

the following system processes:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Modifies file system :

Creates the following files:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Deletes itself.

Network activity:

Connects to:

'76.##.102.235':34354
'50.##.126.76':34354
'41.##2.228.13':34354
'24.##9.249.128':34354
'88.##5.140.171':34354
'75.##0.166.245':34354
'14#.#35.137.233':34354
'10#.#01.226.237':34354
'24.##1.50.251':34354
'17#.#01.190.13':34354
'18#.#23.203.181':34354
'68.##.113.29':34354
'76.##9.98.90':34354
'68.#5.63.52':34354
'71.##2.208.211':34354
'70.##0.78.62':34354
'93.#2.3.227':34354
'46.##.83.181':34354
'92.##5.49.124':34354
'89.##.100.188':34354
'68.##3.93.137':34354
'98.##6.27.47':34354
'95.##3.244.236':34354
'76.##9.197.152':34354
'18#.#60.15.44':34354
'2.###.182.33':34354
'95.##.199.136':34354
'12#.#01.132.52':34354
'98.##4.185.15':34354
'79.##7.109.142':34354
'81.##.34.123':34354
'90.##0.167.40':34354
'17#.#.192.11':34354
'91.##0.180.52':34354
'94.##3.10.240':34354
'17#.#22.131.93':34354
'17#.#01.3.248':34354
'93.##0.197.126':34354
'95.##.181.46':34354
'41.##1.136.102':34354
'10#.#6.220.54':34354
'11#.#54.161.131':34354
'78.##.235.170':34354
'74.##.244.33':34354
'83.##5.46.74':34354
'69.#3.40.91':34354
'21#.#30.80.191':34354
'14#.#33.128.177':34354
'17#.#9.83.78':34354
'46.##0.129.109':34354
'98.##6.167.171':34354
'82.##1.29.120':34354
'68.#7.0.42':34354
'66.##8.80.50':34354
'75.##9.161.99':34354
'70.##6.156.34':34354
'17#.#95.28.177':34354
'10#.#00.167.242':34354
'93.##4.28.38':34354
'68.##7.55.127':34354
'72.##5.10.146':34354
'46.##1.218.127':34354
'77.##2.170.40':34354
'98.##4.93.20':34354
'99.##.110.170':34354
'87.##.132.205':34354
'98.##.198.121':34354
'78.##2.171.12':34354
'76.##1.145.59':34354
'41.##1.67.16':34354
'78.##.101.235':34354
'24.##.175.56':34354
'98.##0.223.20':34354
'88.##2.212.11':34354
'68.#.64.201':34354
'66.##.130.253':34354
'92.##.64.134':34354
'89.##6.66.85':34354
'99.##.220.186':34354
'67.##3.226.42':34354
'18#.#0.240.153':34354
'68.##7.167.108':34354
'66.##8.250.100':34354
'46.##.253.157':34354
'84.##0.202.52':34354
'94.##6.117.239':34354
'10.##.230.17':34354
'18#.#8.55.175':34354
'75.##.30.141':34354
'15#.#6.32.166':34354
'46.##9.97.170':34354
'85.##.19.175':34354
'17#.#1.207.26':34354
'69.##2.123.132':34354
'86.##7.45.203':34354
'66.##.228.90':34354
'62.##5.119.170':34354
'86.##4.254.166':34354
'95.##.187.217':34354
'24.##.130.15':34354
'69.##7.39.146':34354
'75.##.239.234':34354
'2.###.180.176':34354
'89.##0.200.172':34354
'22#.#75.156.34':34354
'68.##.234.202':34354
'24.##7.231.112':34354
'92.##.42.149':34354
'88.##0.156.141':34354
'10#.#3.103.59':34354
'15#.#1.225.128':34354
'24.##6.184.98':34354
'24.#.245.233':34354
'70.#8.9.40':34354
'71.##4.77.74':34354
'68.#5.31.24':34354
'15#.#7.24.45':34354
'10#.#33.196.35':34354
'46.##8.116.61':34354
'83.##.128.174':34354
'94.##.204.69':34354
'18#.#7.165.174':34354
'17#.#3.179.121':34354
'75.##1.72.76':34354
'17#.#4.219.46':34354
'91.##7.60.22':34354
'20#.#01.67.176':34354
'71.##.81.162':34354
'94.##6.152.122':34354
'94.##7.197.206':34354
'68.##6.156.77':34354
'98.#1.36.40':34354
'79.##.34.162':34354
'67.##2.44.217':34354
'11#.#98.6.192':34354
'96.##9.14.194':34354
'17#.#4.68.211':34354
'15#.#01.146.185':34354
'93.##3.184.44':34354
'74.#4.8.253':34354
'95.##.194.195':34354
'67.##0.107.112':34354
'46.##2.213.154':34354
'95.##.198.35':34354
'24.##4.61.67':34354
'10.##.92.105':34354
'93.##.32.166':34354
'20#.#7.169.174':34354
'84.##.243.135':34354
'74.##9.205.19':34354
'76.##0.19.96':34354
'68.##.149.93':34354
'46.##0.77.88':34354
'71.##6.16.211':34354
'77.##2.33.238':34354
'2.##.38.135':34354
'46.##0.133.116':34354
'46.##5.144.71':34354
'21#.#7.3.104':34354
'94.##0.17.88':34354
'67.##9.65.141':34354
'86.##.129.203':34354
'98.##7.159.28':34354
'71.##7.235.104':34354
'41.##2.198.120':34354
'19#.#91.65.113':34354
'18#.#29.186.183':34354
'18#.#7.38.72':34354
'76.##0.167.146':34354
'17#.#52.30.220':34354
'17#.16.33.3':34354
'pr####.fling.com':80
'17#.#2.190.142':80
'21#.#71.81.25':34354
'75.##6.72.136':34354
'87.##.91.102':34354
'71.##4.75.104':34354
'78.##.150.64':34354
'18#.#6.149.221':34354
'10#.#85.138.147':34354
'68.##.62.136':34354
'79.##3.223.104':34354
'72.##5.198.123':34354
'98.##6.177.77':34354
'18#.#7.188.212':34354
'31.##.137.35':34354
'68.#.218.179':34354
'12#.#45.28.33':34354
'96.##.169.235':34354
'69.##7.220.238':34354
'95.##.215.102':34354
'78.#9.6.158':34354
'79.##4.192.124':34354
'41.#6.75.99':34354
'11#.#41.210.223':34354
'95.#9.59.95':34354
'31.##0.61.137':34354
'31.##.90.158':34354
'79.#.217.85':34354
'69.##0.125.68':34354
'68.##4.162.120':34354
'71.##4.52.187':34354
'76.##9.114.87':34354
'95.#0.50.41':34354
'24.##2.24.188':34354
'94.##.115.18':34354
'82.##1.64.77':34354
'89.##4.228.232':34354
'89.##.105.113':34354
'24.##1.240.249':34354
'24.#2.115.5':34354
'98.##4.27.12':34354
'17#.#1.203.233':34354
'69.##1.117.197':34354
'92.##5.235.210':34354
'2.###.104.154':34354
'11#.#99.177.36':34354
'84.##3.92.230':34354
'62.#4.37.29':34354
'98.##6.186.216':34354
'68.##.11.163':34354
'17#.#0.207.56':34354
'95.##.99.106':34354
'17#.#1.191.162':34354
'10#.#85.102.102':34354
'85.#30.43.4':34354
'24.##8.240.33':34354
'78.##.165.141':34354
'46.##9.228.141':34354
'79.##0.190.10':34354
'65.##6.200.40':34354
'67.##.115.69':34354
'77.##7.174.167':34354
'21#.#42.68.14':34354
'21#.#65.147.211':34354
'46.##0.64.108':34354
'24.##7.4.254':34354
'11#.#2.112.246':34354
'92.##9.135.107':34354
'2.###.24.194':34354
'84.##6.146.247':34354
'78.##1.243.214':34354
'92.##.10.158':34354
'10#.#.97.113':34354
'66.##9.64.15':34354
'41.##2.107.181':34354
'68.##0.242.73':34354
'79.##9.249.191':34354
'71.#.211.188':34354
'76.##1.65.145':34354
'85.##.224.246':34354
'10#.#9.212.68':34354
'61.##4.68.120':34354
'76.##.245.62':34354
'76.##.56.147':34354
'17#.#9.18.164':34354
'69.##9.155.45':34354
'93.##.223.167':34354

TCP:

HTTP GET requests:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK z#�P
DNS ASK z#E��
DNS ASK z#�w
DNS ASK z#�ǝd
DNS ASK z#�Mr�
DNS ASK z#)sUM
DNS ASK z#�h�,
DNS ASK z#&�
DNS ASK z#��a
DNS ASK z#�
DNS ASK pr####.fling.com
DNS ASK z#��
DNS ASK z#p1D
DNS ASK z#��m
DNS ASK z#�
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней