BackDoor.Maxplus.4659

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\.netbt] 'ImagePath' = '\?'

Malicious functions:

Injects code into

the following system processes:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Modifies file system :

Creates the following files:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Deletes itself.

Network activity:

Connects to:

'24.##6.22.160':34355
'74.##7.35.83':34355
'50.##.108.83':34355
'19#.#.122.188':34355
'75.##8.133.6':34355
'18#.#9.214.194':34355
'76.##6.146.238':34355
'20#.#30.200.212':34355
'10#.#.11.176':34355
'12#.#43.104.121':34355
'98.##0.25.241':34355
'98.##.233.36':34355
'20#.#0.137.126':34355
'21#.#0.130.157':34355
'75.##.101.205':34355
'24.##7.217.236':34355
'20#.#.35.195':34355
'10#.#37.143.52':34355
'12#.#76.252.125':34355
'67.##2.136.11':34355
'70.##8.118.45':34355
'69.##2.9.168':34355
'71.##9.196.139':34355
'84.##.99.132':34355
'71.##.149.236':34355
'72.##7.21.63':34355
'68.##.247.15':34355
'74.##5.39.186':34355
'98.##0.215.108':34355
'17#.#90.44.129':34355
'98.##7.27.148':34355
'98.##8.244.200':34355
'58.##8.196.241':34355
'76.##.94.219':34355
'17#.#2.143.144':34355
'65.##.225.139':34355
'75.##.121.53':34355
'24.##8.244.153':34355
'75.##.186.82':34355
'68.##6.15.52':34355
'97.##.234.91':34355
'18#.57.5.68':34355
'96.#6.87.31':34355
'76.##0.43.141':34355
'17#.#8.232.205':34355
'21#.#83.133.234':34355
'99.##6.132.34':34355
'74.##.22.212':34355
'18#.#21.91.24':34355
'76.##.78.194':34355
'4.###.66.128':34355
'50.##3.134.42':34355
'69.##3.16.117':34355
'67.##1.164.149':34355
'66.##.82.239':34355
'12#.#1.97.197':34355
'99.##5.103.161':34355
'21#.#69.94.201':34355
'66.#.185.171':34355
'64.##9.175.132':34355
'21#.#11.243.70':34355
'71.##5.141.130':34355
'12#.#85.86.26':34355
'98.##1.150.96':34355
'18#.#14.145.123':34355
'66.##3.233.30':34355
'24.#12.6.91':34355
'71.##6.230.81':34355
'17#.#.22.224':34355
'72.##6.118.132':34355
'17#.#98.89.167':34355
'69.##3.69.74':34355
'24.#4.42.50':34355
'24.#6.9.159':34355
'24.##.205.55':34355
'10#.#.80.140':34355
'18#.#1.91.244':34355
'76.##9.179.18':34355
'24.#0.98.23':34355
'66.##5.39.65':34355
'97.##.52.150':34355
'68.##7.117.189':34355
'17#.#9.214.95':34355
'24.##9.193.162':34355
'12#.#3.79.62':34355
'18#.#90.65.14':34355
'75.##1.134.66':34355
'75.##1.225.240':34355
'24.##.58.192':34355
'75.##8.172.210':34355
'98.##4.135.180':34355
'71.##2.242.145':34355
'76.##5.73.38':34355
'11#.#0.6.204':34355
'75.##.127.85':34355
'17#.#72.81.128':34355
'20#.#7.178.139':34355
'24.##4.81.56':34355
'70.#1.18.98':34355
'18#.#99.85.204':34355
'77.##.130.212':34355
'10#.#06.130.182':34355
'67.##.190.62':34355
'68.##4.93.178':34355
'11#.#8.83.23':34355
'20#.#3.208.144':34355
'17#.#8.240.26':34355
'69.#24.21.7':34355
'18#.#4.140.159':34355
'18#.20.17.2':34355
'17#.#7.218.109':34355
'75.##1.240.167':34355
'65.##.252.24':34355
'75.##9.33.224':34355
'18#.#.127.140':34355
'71.#5.83.14':34355
'98.##6.21.128':34355
'72.##3.203.48':34355
'98.#7.20.10':34355
'75.##5.159.179':34355
'11#.#1.3.224':34355
'77.##.192.253':34355
'71.##.85.148':34355
'70.##3.105.77':34355
'70.##.70.183':34355
'97.#6.66.6':34355
'67.##7.42.164':34355
'16#.#28.203.193':34355
'84.#5.75.50':34355
'69.##8.236.252':34355
'68.##.153.200':34355
'76.##4.141.53':34355
'76.##.172.224':34355
'98.##4.226.50':34355
'76.##2.146.34':34355
'98.##5.24.23':34355
'81.##0.121.4':34355
'18#.#23.242.76':34355
'13#.#5.174.226':34355
'98.##7.92.29':34355
'98.##8.106.221':34355
'17#.#48.6.200':34355
'10#.#75.197.135':34355
'94.##6.70.113':34355
'20#.#2.179.23':34355
'50.#2.97.76':34355
'24.##.200.100':34355
'70.##1.94.107':34355
'18#.#99.249.165':34355
'12.##4.216.198':34355
'17#.#62.14.198':34355
'76.#6.0.166':34355
'76.##.39.187':34355
'17#.#4.239.35':34355
'18#.#5.50.117':34355
'72.##3.57.35':34355
'18#.#01.209.184':34355
'64.##1.144.5':34355
'11#.73.20.2':34355
'98.##3.254.11':34355
'12#.#50.210.207':34355
'75.##1.211.121':34355
'67.##4.43.88':34355
'24.##0.99.73':34355
'50.##9.234.3':34355
'74.##.55.107':34355
'18#.#85.232.101':34355
'74.##.73.124':34355
'24.##2.178.70':34355
'62.##3.156.127':34355
'17#.#5.77.221':34355
'pr####.fling.com':80
'17#.#2.190.142':80
'68.#5.42.23':34355
'17#.#0.228.175':34355
'17#.#4.166.154':34355
'18#.#0.160.187':34355
'18#.#8.213.127':34355
'42.#.14.55':34355
'20#.#6.213.78':34355
'22#.#38.53.241':34355
'17#.#29.102.125':34355
'71.##8.17.180':34355
'68.##.123.73':34355
'18#.#99.22.120':34355
'12#.#08.250.166':34355
'84.##0.84.240':34355
'67.##1.30.107':34355
'17#.#2.87.118':34355
'76.#9.42.28':34355
'18#.#6.244.5':34355
'46.##3.48.204':34355
'68.##4.170.130':34355
'24.#.125.145':34355
'68.##.234.47':34355
'17#.#17.191.47':34355
'83.##7.77.14':34355
'17#.#4.121.160':34355
'69.##6.54.138':34355
'68.##4.78.171':34355
'70.##.62.159':34355
'67.##5.151.242':34355
'24.##2.153.150':34355
'20#.#3.86.186':34355
'24.##9.38.250':34355
'24.##6.42.224':34355
'11#.#7.208.89':34355
'75.##0.26.96':34355
'98.##8.58.67':34355
'76.##9.201.162':34355
'71.##4.35.251':34355
'74.##.41.236':34355
'64.#0.92.27':34355
'75.##.119.27':34355
'18#.#23.108.235':34355
'17#.#3.124.118':34355
'68.##2.155.85':34355
'66.##.159.48':34355
'72.##1.161.99':34355
'68.##6.104.204':34355
'18#.#5.45.168':34355
'74.##3.29.65':34355
'75.##2.205.69':34355
'17#.#62.2.141':34355
'68.##6.41.53':34355
'20#.#72.161.83':34355
'20#.#61.233.105':34355
'67.##.156.166':34355
'71.##.169.123':34355
'65.##8.153.102':34355
'72.##.159.219':34355
'76.##2.206.92':34355
'67.##2.218.95':34355
'68.##1.37.212':34355
'75.##6.169.84':34355
'20#.#2.32.41':34355
'71.##.170.186':34355
'10#.#69.63.100':34355
'76.##.198.168':34355
'69.##9.59.18':34355
'24.##4.195.12':34355
'17#.#19.135.103':34355
'17#.#03.195.38':34355
'98.##0.254.98':34355
'24.##0.155.251':34355
'68.##.150.69':34355
'71.##.71.156':34355
'75.##9.243.236':34355
'67.##3.135.37':34355
'20#.#7.64.147':34355
'98.##3.54.217':34355
'76.##9.139.32':34355
'72.##5.18.103':34355
'50.##7.80.77':34355
'18#.#9.72.109':34355
'20#.#50.141.92':34355
'17#.#8.116.173':34355
'17#.#9.2.125':34355

TCP:

HTTP GET requests:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK v{#�,J
DNS ASK v{#�K��
DNS ASK v{#Sm�
DNS ASK v{#iu�t
DNS ASK v{#�h�
DNS ASK v{#��O]
DNS ASK v{#f��<
DNS ASK v{#�n
DNS ASK v{#J`{
DNS ASK v{#�{��
DNS ASK pr####.fling.com
DNS ASK v{#�
DNS ASK v{#T
DNS ASK v{#07�}
DNS ASK v{#��
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней