BackDoor.Maxplus.4581

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\.afd] 'ImagePath' = '\?'

Malicious functions:

Injects code into

the following system processes:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Modifies file system :

Creates the following files:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Deletes itself.

Network activity:

Connects to:

'75.##.214.151':34355
'11#.#2.174.181':34355
'76.##2.4.203':34355
'66.##3.202.79':34355
'62.##.227.140':34355
'24.##2.40.211':34355
'98.##.230.10':34355
'22#.#1.56.76':34355
'79.##2.172.55':34355
'11#.#4.132.94':34355
'94.##2.217.89':34355
'86.#.241.25':34355
'75.##6.230.88':34355
'88.##8.44.37':34355
'11#.#9.53.242':34355
'71.##.60.213':34355
'75.##2.236.43':34355
'92.##.227.192':34355
'12#.#3.79.62':34355
'79.##6.177.61':34355
'84.##.84.248':34355
'99.##0.202.205':34355
'68.##.172.145':34355
'10#.#9.27.219':34355
'91.##2.239.74':34355
'82.##6.34.232':34355
'74.##5.177.228':34355
'94.##.134.196':34355
'75.##4.197.184':34355
'18#.#15.180.25':34355
'70.#5.87.48':34355
'85.##.125.178':34355
'20#.#2.253.24':34355
'18#.#9.204.68':34355
'18#.#0.141.35':34355
'10#.#8.86.29':34355
'68.##0.28.194':34355
'77.##9.165.200':34355
'89.##8.49.50':34355
'10#.#7.38.105':34355
'12#.#36.92.193':34355
'19#.#48.87.71':34355
'66.##8.53.77':34355
'66.##.206.249':34355
'95.#6.6.121':34355
'74.##.239.103':34355
'99.##8.204.212':34355
'68.##.218.215':34355
'67.##1.215.235':34355
'65.##8.153.102':34355
'86.##6.69.229':34355
'66.#.184.115':34355
'20#.#72.33.241':34355
'18#.#9.60.40':34355
'66.##.24.194':34355
'84.##1.219.63':34355
'90.##4.251.135':34355
'80.#4.72.60':34355
'11#.#9.22.167':34355
'31.##.123.143':34355
'78.##.111.225':34355
'18#.#5.0.188':34355
'17#.#54.206.94':34355
'78.##0.188.18':34355
'46.##0.111.2':34355
'22#.#80.171.27':34355
'70.##0.191.220':34355
'76.##6.146.238':34355
'88.#8.114.8':34355
'12#.#16.22.229':34355
'20#.#67.82.50':34355
'95.##3.160.77':34355
'18#.#.246.140':34355
'11#.#3.100.157':34355
'42.##1.175.44':34355
'17#.#4.37.229':34355
'17#.#4.166.246':34355
'18#.#1.148.136':34355
'17#.#15.49.43':34355
'21#.#21.135.113':34355
'92.#6.172.6':34355
'20#.#2.34.122':34355
'12#.#86.234.46':34355
'18#.#6.151.102':34355
'24.##0.128.169':34355
'75.##4.230.68':34355
'66.#8.36.97':34355
'17#.#8.96.28':34355
'75.##0.118.78':34355
'63.##0.247.95':34355
'20#.#59.236.59':34355
'98.##8.79.17':34355
'68.#.10.116':34355
'20#.#65.240.135':34355
'70.##9.151.115':34355
'70.##3.78.216':34355
'66.##.209.100':34355
'24.##3.117.219':34355
'17#.#54.206.54':34355
'80.##2.176.110':34355
'41.#51.0.78':34355
'17#.#56.90.122':34355
'42.##1.32.90':34355
'20#.#66.118.90':34355
'31.##.100.19':34355
'14#.#3.168.49':34355
'18#.#0.126.220':34355
'21#.#4.41.110':34355
'20#.#2.33.159':34355
'18#.#01.36.18':34355
'67.##.116.90':34355
'71.##.58.254':34355
'11#.#88.70.95':34355
'75.##.52.191':34355
'11#.#2.101.243':34355
'68.##.162.66':34355
'22#.#80.168.183':34355
'68.##4.93.178':34355
'76.##8.45.219':34355
'94.##6.184.7':34355
'24.##7.65.216':34355
'24.##1.33.153':34355
'20#.#7.157.70':34355
'24.##4.103.172':34355
'2.###.149.33':34355
'71.##.252.92':34355
'18#.#14.146.221':34355
'18#.#7.218.217':34355
'77.##0.23.186':34355
'12#.#1.169.41':34355
'71.##.157.178':34355
'17#.#48.6.200':34355
'24.##4.130.174':34355
'10#.#75.197.19':34355
'20#.#5.37.87':34355
'24.##4.27.99':34355
'69.##4.27.184':34355
'98.##5.167.169':34355
'12.##4.216.198':34355
'75.##8.133.6':34355
'92.#.128.32':34355
'13#.#32.97.61':34355
'98.##0.254.98':34355
'20#.#6.246.171':34355
'20#.#3.145.235':34355
'11#.#54.60.236':34355
'69.#13.8.98':34355
'20#.#40.118.99':34355
'60.##8.21.237':34355
'71.##8.193.10':34355
'17#.#72.81.128':34355
'94.##1.22.186':34355
'71.##8.33.167':34355
'99.##.28.247':34355
'88.##.189.63':34355
'76.##.94.219':34355
'94.##6.187.225':34355
'69.##5.193.11':34355
'81.##2.79.190':34355
'21#.#89.163.233':34355
'93.##.196.232':34355
'95.##3.103.154':34355
'81.##.212.144':34355
'24.#7.1.246':34355
'16#.#16.143.167':34355
'20#.#64.235.24':34355
'71.##8.17.180':34355
'87.##.227.185':34355
'98.##8.106.221':34355
'90.##4.251.148':34355
'46.##3.196.32':34355
'pr####.fling.com':80
'17#.#2.190.142':80
'74.##.17.223':34355
'81.##0.121.4':34355
'21#.#11.243.70':34355
'87.#.130.116':34355
'89.##.239.218':34355
'13#.#.154.217':34355
'68.#5.42.23':34355
'18#.#5.50.117':34355
'76.##2.146.34':34355
'15#.#.22.131':34355
'24.##2.96.160':34355
'84.##.106.31':34355
'78.##1.93.108':34355
'98.##8.162.151':34355
'20#.#2.153.23':34355
'24.##.205.55':34355
'98.##3.204.82':34355
'11#.#27.233.55':34355
'17#.#03.195.38':34355
'94.##5.86.147':34355
'95.##3.178.67':34355
'80.##6.140.94':34355
'98.#7.20.10':34355
'68.##.214.88':34355
'75.##.117.250':34355
'71.#5.83.14':34355
'72.##.205.238':34355
'99.##7.236.187':34355
'14#.#96.99.34':34355
'24.#6.9.159':34355
'70.##3.66.189':34355
'88.##0.220.162':34355
'21#.#0.62.172':34355
'70.##8.118.45':34355
'96.#.230.95':34355
'20#.#60.97.45':34355
'68.##6.104.204':34355
'17#.#8.122.12':34355
'17#.#6.59.143':34355
'71.##5.122.11':34355
'20#.#5.115.162':34355
'85.##.242.205':34355
'2.##7.22.89':34355
'31.##.107.28':34355
'74.##.218.222':34355
'75.##2.212.27':34355
'90.##4.250.23':34355
'92.##.250.199':34355
'67.##1.129.33':34355
'83.##3.19.69':34355
'87.##8.61.89':34355
'10#.#7.152.72':34355
'98.##0.240.34':34355
'68.##1.37.212':34355
'24.##9.28.26':34355
'17#.#1.165.84':34355
'87.##1.142.40':34355
'94.#9.53.22':34355
'19#.#48.24.234':34355
'98.##4.202.109':34355
'76.##8.49.107':34355
'17#.#03.9.27':34355
'98.##1.199.97':34355
'50.##7.1.231':34355
'18#.#10.48.75':34355
'71.##.85.148':34355
'70.#4.132.2':34355
'2.###.220.250':34355
'77.##.210.175':34355
'10#.#.72.172':34355
'97.##1.154.165':34355
'98.##0.215.108':34355
'67.##7.198.229':34355
'17#.#9.2.125':34355
'68.##0.161.71':34355
'46.##5.37.156':34355
'85.##6.113.47':34355
'18#.#5.6.194':34355
'82.#.36.230':34355
'75.##6.169.84':34355
'99.##2.128.185':34355
'17#.#2.118.92':34355
'67.##.179.169':34355
'70.##1.123.84':34355
'74.##.242.45':34355

TCP:

HTTP GET requests:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK v{#Q
DNS ASK v{#*6�`
DNS ASK v{#�o&
DNS ASK v{#�̆
DNS ASK v{#؂#I
DNS ASK v{#F��
DNS ASK v{#��
DNS ASK v{#IK
DNS ASK v{#�0:
DNS ASK v{#j�[
DNS ASK pr####.fling.com
DNS ASK v{#st�i
DNS ASK v{#�N�
DNS ASK v{#�J��
DNS ASK v{#|��!
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней