BackDoor.Maxplus.4693

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\.afd] 'ImagePath' = '\?'

Malicious functions:

Injects code into

the following system processes:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Modifies file system :

Creates the following files:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Deletes itself.

Network activity:

Connects to:

'21#.#45.127.6':34355
'12.##4.216.198':34355
'13#.#36.178.85':34355
'68.##.150.69':34355
'64.##9.175.132':34355
'94.##7.98.155':34355
'76.##.94.219':34355
'11#.#81.176.80':34355
'94.##7.215.218':34355
'99.##0.115.163':34355
'10#.10.81.2':34355
'99.##1.70.227':34355
'72.##4.15.75':34355
'19#.#99.13.183':34355
'71.##.157.178':34355
'77.##.130.212':34355
'75.#.134.98':34355
'99.##7.149.11':34355
'76.##2.92.39':34355
'68.##.128.200':34355
'17#.#17.156.43':34355
'74.##5.177.228':34355
'75.##.186.82':34355
'18#.#8.176.217':34355
'17#.#18.237.89':34355
'10#.#24.170.229':34355
'20#.#62.25.137':34355
'67.##1.124.63':34355
'68.##6.41.53':34355
'24.##0.208.232':34355
'70.##8.118.45':34355
'75.##0.26.96':34355
'16#.#37.144.5':34355
'18#.#21.251.181':34355
'24.##4.195.12':34355
'20#.#2.53.254':34355
'13#.#00.139.55':34355
'84.##0.84.240':34355
'77.##7.52.161':34355
'75.##9.243.236':34355
'81.##.45.204':34355
'50.##9.234.3':34355
'2.###.231.52':34355
'71.##8.33.167':34355
'76.##.233.55':34355
'75.##2.143.74':34355
'20#.#30.200.212':34355
'68.##.70.173':34355
'71.##4.42.169':34355
'98.##1.43.117':34355
'18#.#9.133.213':34355
'14#.#01.202.204':34355
'75.##.119.27':34355
'75.##1.225.240':34355
'24.##4.81.56':34355
'98.##5.12.184':34355
'22#.#27.55.58':34355
'66.##8.53.88':34355
'17#.#72.81.128':34355
'96.##.92.240':34355
'18#.#7.116.232':34355
'89.##.240.102':34355
'68.##6.104.204':34355
'63.##8.184.39':34355
'98.##6.21.128':34355
'12#.#96.161.82':34355
'93.##6.216.179':34355
'10#.#06.136.30':34355
'24.##4.103.172':34355
'12#.#7.10.94':34355
'74.##.242.109':34355
'76.##0.43.141':34355
'18#.#05.166.233':34355
'82.##2.148.121':34355
'75.##8.172.210':34355
'75.##9.33.224':34355
'24.##7.14.43':34355
'21#.#81.90.104':34355
'69.##3.103.87':34355
'75.##.75.161':34355
'24.##.131.117':34355
'17#.#62.29.244':34355
'89.##.239.218':34355
'24.#6.9.159':34355
'20#.#7.116.180':34355
'18#.#9.139.144':34355
'10#.#7.29.71':34355
'11#.#4.235.77':34355
'19#.#48.85.159':34355
'77.##.192.253':34355
'68.##5.138.226':34355
'70.##0.153.49':34355
'18#.#8.122.109':34355
'24.##6.42.224':34355
'97.##.52.224':34355
'17#.#90.125.8':34355
'74.##.98.134':34355
'14.#8.3.220':34355
'12.##3.207.66':34355
'24.##2.178.70':34355
'18#.#99.78.174':34355
'18#.#2.143.245':34355
'72.##1.161.99':34355
'17#.#39.0.241':34355
'18#.#93.123.31':34355
'20#.#93.195.189':34355
'11#.#3.96.71':34355
'66.##.82.239':34355
'72.##7.21.63':34355
'99.##.205.64':34355
'68.##1.37.212':34355
'46.#95.1.74':34355
'65.##.252.24':34355
'98.##0.215.108':34355
'68.##.162.66':34355
'2.###.230.178':34355
'98.#7.20.10':34355
'68.##.78.202':34355
'67.##.179.169':34355
'18#.#.92.197':34355
'71.#5.83.14':34355
'21#.#17.224.194':34355
'18#.#2.226.6':34355
'20#.#5.237.213':34355
'84.##.98.141':34355
'17#.#9.242.84':34355
'75.##.117.245':34355
'21#.#11.243.70':34355
'16#.#16.42.86':34355
'15#.#6.87.104':34355
'74.##.73.124':34355
'82.##.176.105':34355
'24.##1.64.237':34355
'76.##.78.194':34355
'87.##.227.185':34355
'13#.#3.50.248':34355
'75.##6.169.84':34355
'76.##.198.168':34355
'17#.#03.195.38':34355
'85.##9.202.42':34355
'21#.#53.66.180':34355
'72.##3.57.35':34355
'24.#9.16.82':34355
'82.##6.34.232':34355
'71.##8.17.180':34355
'74.##.55.107':34355
'17#.#0.121.94':34355
'91.##.224.33':34355
'81.##2.79.190':34355
'68.##3.165.240':34355
'21#.#89.163.233':34355
'12#.#.231.26':34355
'67.##.116.197':34355
'17#.#52.179.102':34355
'21#.#9.114.177':34355
'99.##.189.238':34355
'71.##.149.236':34355
'93.##.196.232':34355
'68.#5.42.23':34355
'17#.#19.49.40':34355
'98.##8.58.67':34355
'89.##.185.113':34355
'95.##0.213.116':34355
'68.##4.78.171':34355
'13#.#06.166.42':34355
'68.##5.46.16':34355
'18#.#23.242.37':34355
'75.##6.47.139':34355
'42.#.169.12':34355
'10#.#69.63.100':34355
'17#.#98.89.167':34355
'pr####.fling.com':80
'17#.#2.190.142':80
'17#.#9.2.125':34355
'18#.#5.50.117':34355
'62.##3.156.127':34355
'70.##3.240.246':34355
'14#.#5.140.208':34355
'75.##8.133.6':34355
'74.##.116.153':34355
'18#.#3.31.81':34355
'68.##.69.129':34355
'20#.#61.221.71':34355
'99.##1.225.195':34355
'75.##3.171.136':34355
'21#.#18.97.106':34355
'75.##6.217.235':34355
'75.##.102.22':34355
'17#.#2.178.226':34355
'94.##5.158.140':34355
'84.##.173.135':34355
'98.##8.244.200':34355
'83.##7.254.137':34355
'77.##1.98.94':34355
'72.##.159.219':34355
'82.#.36.230':34355
'18#.#94.55.23':34355
'20#.#8.129.194':34355
'24.##.205.55':34355
'20#.#2.50.63':34355
'20#.#2.36.154':34355
'15#.#8.194.21':34355
'75.##3.82.197':34355
'98.##3.254.11':34355
'2.###.249.213':34355
'35.##.182.192':34355
'17#.#8.240.26':34355
'99.##2.35.23':34355
'50.##8.143.124':34355
'98.##9.127.239':34355
'31.##.124.134':34355
'18#.#97.5.69':34355
'99.##6.132.34':34355
'67.##.187.57':34355
'18#.#92.150.127':34355
'65.##.225.139':34355
'24.##1.68.14':34355
'68.##.42.220':34355
'91.##.225.225':34355
'74.##6.35.107':34355
'20#.#40.121.194':34355
'18#.#9.241.26':34355
'10#.#31.92.13':34355
'76.##9.201.162':34355
'67.##.156.166':34355
'75.#13.64.4':34355
'10#.#75.197.101':34355
'46.##3.48.204':34355
'64.#0.92.27':34355
'18.##1.107.171':34355
'82.#.152.74':34355
'84.#5.75.50':34355
'71.##4.35.251':34355
'68.##3.245.244':34355
'2.##6.9.19':34355
'98.##0.254.98':34355
'11#.#54.28.69':34355
'81.##0.121.4':34355
'18#.#0.112.203':34355
'81.##.212.144':34355
'98.##8.106.221':34355
'89.##2.142.212':34355
'24.##0.155.251':34355
'15#.#1.184.109':34355
'17#.#4.121.160':34355
'18#.2.241.5':34355
'18#.#9.214.194':34355
'71.##6.230.81':34355
'21#.#0.62.172':34355
'72.#.102.238':34355
'17#.#8.122.12':34355
'20#.#07.230.20':34355
'95.##2.125.85':34355
'71.##.85.148':34355
'98.##4.207.180':34355
'75.##8.77.134':34355
'20#.#32.206.135':34355
'85.##.22.254':34355

TCP:

HTTP GET requests:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK v{#��
DNS ASK v{#BGo
DNS ASK v{#x �k
DNS ASK v{#�yH
DNS ASK v{#.̀*
DNS ASK v{#�\
DNS ASK v{#M� �
DNS ASK v{#��
DNS ASK v{#aR�Y
DNS ASK v{#�I8
DNS ASK pr####.fling.com
DNS ASK v{#%
DNS ASK v{#��MB
DNS ASK v{#�;
'8.#.8.8':1036

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней