BackDoor.Maxplus.8109

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '89D.exe' = '%PROGRAM_FILES%\LP\C038\89D.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.netbt] 'ImagePath' = '\*'

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\-1998166001
%TEMP%\dsdfca.exe
%TEMP%\nkamk.exe
%TEMP%\gywaume.exe
%PROGRAM_FILES%\LP\C038\4.tmp
%TEMP%\nsz3.tmp\David Weber - Honor Harrington 02 - The Honor Of The Queen.exe
%TEMP%\nsz3.tmp\ic5.exe
%TEMP%\nsz3.tmp\3R2R.exe
%TEMP%\nsz3.tmp\2 Gansta.exe
%TEMP%\nkamk.exe (загружен из сети Интернет)
%TEMP%\gywaume.exe (загружен из сети Интернет)
%TEMP%\dsdfca.exe (загружен из сети Интернет)
%TEMP%\-1998166001 (загружен из сети Интернет)

Запускает на исполнение:

<SYSTEM32>\msiexec.exe /V
<SYSTEM32>\svchost.exe

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe
<SYSTEM32>\cmd.exe
%WINDIR%\Explorer.EXE
<SYSTEM32>\winlogon.exe

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKCU>\Software\BPFTP\Bullet Proof FTP\Options]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Options]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Main]
[<HKLM>\Software\FlashFXP]
[<HKCU>\Software\BPFTP\Bullet Proof FTP\Main]
[<HKCU>\Software\BPFTP]
[<HKCU>\Software\South River Technologies\WebDrive\Connections]
[<HKLM>\Software\South River Technologies\WebDrive\Connections]
[<HKCU>\Software\FTPWare\COREFTP\Sites]
[<HKCU>\Software\Sota\FFFTP\Options]
[<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
[<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
[<HKCU>\Software\Ghisler\Windows Commander]
[<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
[<HKCU>\Software\Far\Plugins\FTP\Hosts]
[<HKCU>\Software\Far2\Plugins\FTP\Hosts]
[<HKCU>\Software\Ghisler\Total Commander]
[<HKCU>\Software\FlashFXP]
[<HKLM>\Software\FlashFXP\3]
[<HKCU>\Software\FlashFXP\3]
[<HKLM>\Software\Ghisler\Windows Commander]
[<HKLM>\Software\Ghisler\Total Commander]

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:59636'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ubsnltn[1].php
%TEMP%\sqpvrlh.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\zdlfahcaip[1].php
%TEMP%\gkih.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\izucahpkip[1].php
%TEMP%\nkamk.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\evpxez[1].php
%TEMP%\cmameeao.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\nvmkfmhfa[1].php
%TEMP%\nildxk.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\arzgbzhf[1].php
%TEMP%\desk.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\jnupkvq[1].php
%TEMP%\plmnimmi.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\jwezxfzk[1].php
%TEMP%\uxwdet.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\rvdojqpje[1].php
%TEMP%\muis.exe
%TEMP%\gywaume.exe
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%TEMP%\nsz3.tmp\3R2R.exe
%TEMP%\nsz3.tmp\David Weber - Honor Harrington 02 - The Honor Of The Queen.exe
%TEMP%\nsi2.tmp
%TEMP%\nsz3.tmp\2 Gansta.exe
%TEMP%\nsz3.tmp\ic5.exe
%TEMP%\dsdfca.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wqtkipkiqk[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\imgbidoje[1].php
%TEMP%\-1998166001
%APPDATA%\88E66\680F.8E6
%PROGRAM_FILES%\LP\C038\4.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ctbidkjq[1].php
%PROGRAM_FILES%\LP\C038\89D.exe

Удаляет следующие файлы:

%TEMP%\nsz3.tmp\David Weber - Honor Harrington 02 - The Honor Of The Queen.exe
%TEMP%\nsz3.tmp\ic5.exe
%TEMP%\nsz3.tmp\2 Gansta.exe
%TEMP%\nsz3.tmp\3R2R.exe

Сетевая активность:

Подключается к:

'19#.#6.189.219':34354
'10#.#74.11.171':34354
'46.#5.0.235':34354
'50.#2.19.62':34354
'31.##1.27.97':34354
'24.#0.46.97':34354
'50.##5.173.225':34354
'17#.#13.81.18':34354
'12#.#21.252.230':34354
'76.##5.119.163':34354
'99.##.186.245':34354
'19#.#28.149.105':34354
'19#.#53.33.15':34354
'71.##5.121.102':34354
'11#.#59.103.27':34354
'70.##6.62.24':34354
'24.#0.72.64':34354
'70.##.145.137':34354
'69.##4.77.148':34354
'18#.#10.84.242':34354
'18#.#33.11.57':34354
'12#.#23.155.163':34354
'71.##2.204.41':34354
'24.##.218.205':34354
'14.##.107.97':34354
'19#.#01.106.36':34354
'20#.#09.198.70':34354
'67.##3.156.70':34354
'18#.#84.67.49':34354
'18#.#76.211.184':34354
'71.##.14.151':34354
'19#.#3.255.114':34354
'68.##6.120.248':34354
'17#.#03.4.60':34354
'12#.#21.33.104':34354
'68.#0.27.81':34354
'17#.#04.214.228':34354
'11#.#84.143.49':34354
'68.##.175.189':34354
'11#.#3.20.31':34354
'15#.#5.150.221':34354
'18#.#0.60.180':34354
'19#.#38.219.254':34354
'24.##2.28.114':34354
'68.##3.247.110':34354
'74.##5.182.47':34354
'11#.#05.98.23':34354
'20#.#09.38.65':34354
'98.##3.168.61':34354
'10#.#98.112.65':34354
'20#.#11.156.42':34354
'12#.#22.31.93':34354
'24.##2.2.124':34354
'19#.#05.18.114':34354
'10#.#.210.170':34354
'18#.#2.157.9':34354
'11#.#4.224.180':34354
'68.##2.31.76':34354
'2.###.63.152':34354
'76.##4.20.70':34354
'70.##6.8.248':34354
'96.#.41.133':34354
'18#.#78.255.73':34354
'12#.#27.133.12':34354
'18#.#.144.72':34354
'75.##6.51.65':34354
'24.##9.160.101':34354
'71.##.166.153':34354
'74.##3.220.250':34354
'17#.#02.44.17':34354
'17#.#62.115.16':34354
'66.##7.154.215':34354
'91.##7.60.22':34354
'89.##2.69.24':34354
'20#.#64.126.93':34354
'99.##1.122.221':34354
'10#.#0.68.15':34354
'11#.#49.158.222':34354
'64.##0.211.100':34354
'19#.#77.153.138':34354
'20#.#12.147.222':34354
'98.##.35.173':34354
'92.##4.236.170':34354
'67.##.13.187':34354
'71.##.56.173':34354
'70.##3.53.102':34354
'aa###ker.com':80
'18#.#2.173.168':34354
'99.##.122.140':34354
'11#.#4.129.24':34354
'24.#3.3.215':34354
'66.##8.154.22':34354
'17#.#25.84.15':34354
'96.##.108.43':34354
'19#.#06.74.199':34354
'90.##4.208.38':34354
'67.##3.196.41':34354
'76.#7.37.24':34354
'12#.#22.4.13':34354
'68.##7.142.17':34354
'41.##2.116.68':34354
'97.##0.116.86':34354
'97.##.123.227':34354
'24.#4.23.93':34354
'20#.#2.35.218':34354
'10#.#6.51.87':34354
'11#.#93.70.186':34354
'10#.#91.85.126':34354
'71.##.131.32':34354
'10#.#7.189.161':34354
'17#.#18.66.223':34354
'21#.#25.193.162':34354
'67.#3.25.19':34354
'65.#5.98.37':34354
'97.##.105.85':34354
'24.##.198.80':34354
'76.##.54.119':34354
'24.##.166.44':34354
'24.##7.162.46':34354
'70.##2.230.197':34354
'18#.#91.230.196':34354
'14.##.106.131':34354
'24.##3.134.127':34354
'15#.#2.196.83':34354
'12#.#7.216.42':34354
'10#.#.218.234':34354
'19#.#12.125.81':34354
'20#.#48.246.234':34354
'41.##2.240.82':34354
'20#.#8.21.223':34354
'11#.#01.226.208':34354
'17#.#10.157.51':34354
'20#.#67.106.214':34354
'95.##.71.106':34354
'96.##.180.173':34354
'76.##4.102.14':34354
'72.##4.238.142':34354
'76.##.162.191':34354
'68.##5.137.155':34354
'76.##6.65.15':34354
'66.##.217.238':34354
'76.##0.170.158':34354
'76.##2.253.146':34354
'24.##.107.194':34354
'24.##8.104.149':34354
'80.##2.35.15':34354
'84.##0.215.194':34354
'24.##4.140.249':34354
'18#.#91.127.89':34354
'20#.#65.14.2':34354
'19#.#18.209.87':34354
'20#.#16.127.130':34354
'69.##4.28.180':34354
'67.##.226.247':34354
'76.#5.48.82':34354
'74.##0.45.193':34354
'18#.#4.92.116':34354
'76.##3.235.96':34354
'76.##2.23.10':34354
'74.##.146.85':34354
'98.##7.226.43':34354
'18#.#4.199.150':34354
'24.##7.81.191':34354
'18#.#1.128.78':34354
'76.##.134.135':34354
'72.##.249.200':34354
'69.##0.70.38':34354
'18#.#56.3.226':34354
'19#.#98.80.146':34354
'14.##.176.214':34354
'24.##1.155.173':34354
'localhost':80
'18#.#9.141.223':34354
'68.##.225.134':34354
'95.##.230.91':34354
'69.##6.219.140':34354
'67.##2.26.249':34354
'22#.#.112.227':34354
'24.##.141.93':34354
'17#.#57.205.111':34354
'63.##8.36.29':34354
'66.##8.73.221':34354
'20#.#39.77.65':34354
'69.##7.214.101':34354
'19#.#40.206.218':34354
'67.##4.35.100':34354
'85.##5.26.224':34354
'17#.#26.169.0':34354
'68.##8.255.48':34354
'10#.#0.61.18':34354
'68.#.89.67':34354
'24.#7.96.49':34354
'71.##5.102.118':34354
'74.##.126.236':34354
'20#.#88.150.44':34354
'95.##.157.81':34354
'24.##6.238.39':34354
'68.##.72.143':34354
'75.##5.31.47':34354
'76.##.228.93':34354
'58.##.129.241':34354
'75.##3.75.186':34354
'76.##5.186.19':34354
'70.##3.184.111':34354
'19#.#63.114.252':34354
'76.##0.136.51':34354
'18#.#2.184.212':34354
'17#.#34.79.6':34354
'89.##.105.113':34354
'21#.#1.208.25':34354
'72.##9.163.48':34354
'31.##4.51.208':34354
'71.##.200.200':34354
'19#.#8.18.205':34354
'24.##6.66.177':34354
'79.##4.52.15':34354
'17#.#57.90.174':34354
'68.##0.200.38':34354
'85.##4.186.65':34354
'24.##.199.191':34354
'76.#12.6.55':34354
'18#.#8.129.102':34354
'18#.#26.40.173':34354
'18#.#2.184.201':34354
'76.##2.148.185':34354
'24.##2.71.50':34354
'75.##0.79.199':34354
'24.#.210.136':34354
'18#.#4.207.6':34354
'20#.#89.172.188':34354
'91.##.147.87':34354
'24.##8.180.207':34354
'74.##6.46.146':34354
'76.##.165.126':34354
'24.#.56.212':34354
'27.##.18.248':34354
'17#.#0.215.187':34354
'18#.#26.91.129':34354
'99.##.151.120':34354
'75.##5.29.179':34354
'65.#8.1.216':34354
'75.##5.3.248':34354
'18#.#15.144.44':34354
'95.##.65.102':34354
'97.##2.58.23':34354
'79.##8.196.127':34354
'89.##6.243.155':34354
'11#.#69.243.169':34354
'76.##.89.179':34354
'17#.#5.87.19':34354
'70.##.22.123':34354
'70.#5.63.51':34354
'18#.#4.9.231':34354
'89.##5.242.184':34354
'66.##5.169.80':34354
'95.##.166.54':34354
'20#.#61.5.66':34354
'20#.#14.102.75':34354

TCP:

Запросы HTTP GET:

aa###ker.com/dpxezto/zdlfahcaip.php?ad####################################
aa###ker.com/dpxezto/ubsnltn.php?ad####################################
aa###ker.com/dpxezto/izucahpkip.php?ad####################################
aa###ker.com/dpxezto/jwezxfzk.php?ad####################################
aa###ker.com/dpxezto/jnupkvq.php?ad####################################
aa###ker.com/dpxezto/arzgbzhf.php?ad####################################
aa###ker.com/dpxezto/rvdojqpje.php?ad####################################
aa###ker.com/dpxezto/ctbidkjq.php?ad####################################
wd##niez.cn/stat2.php?&a###
wd##niez.cn/stat2.php?&a##
aa###ker.com/dpxezto/wqtkipkiqk.php?ad####################################
aa###ker.com/dpxezto/nvmkfmhfa.php?ad####################################
aa###ker.com/dpxezto/evpxez.php?ad####################################
aa###ker.com/dpxezto/imgbidoje.php?ad####################################

UDP:

DNS ASK crl.microsoft.com
DNS ASK wp#d
DNS ASK www.ya##o.com
DNS ASK www.google.com
DNS ASK tr#####rosystems.com
DNS ASK ou#####transfers.com
DNS ASK aa###ker.com
DNS ASK ru####stumprs.com
DNS ASK en#####ringcrossing.com

Другое:

Ищет следующие окна:

ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней