BackDoor.MaosBoot.3144

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Tools Access Virtual Drive Services SNMP' = 'C:\qgikdtociazet\wqjphghqpd.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Installer Internet DCOM Access Thread] 'ImagePath' = 'C:\qgikdtociazet\wqjphghqpd.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Installer Internet DCOM Access Thread] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'C:\qgikdtociazet\keymacdbjyii.exe' "c:\qgikdtociazet\wqjphghqpd.exe"
'C:\qgikdtociazet\wqjphghqpd.exe'
'C:\qgikdtociazet\vo2qx7fkajcngln9.exe'

Изменения в файловой системе:

Создает следующие файлы:

C:\qgikdtociazet\wqjphghqpd.exe
C:\qgikdtociazet\keymacdbjyii.exe
C:\qgikdtociazet\vo2qx7fkajcngln9.exe
%WINDIR%\qgikdtociazet\qkoczxdoxj
C:\qgikdtociazet\qkoczxdoxj

Присваивает атрибут 'скрытый' для следующих файлов:

C:\qgikdtociazet\keymacdbjyii.exe
C:\qgikdtociazet\wqjphghqpd.exe

Удаляет следующие файлы:

C:\qgikdtociazet\vo2qx7fkajcngln9.exe
%WINDIR%\qgikdtociazet\qkoczxdoxj

Подменяет следующие файлы:

%WINDIR%\qgikdtociazet\qkoczxdoxj

Сетевая активность:

Подключается к:

'fi###early.net':80
'pa###safety.net':80
'fi###smell.net':80
'pa###early.net':80
'fi###future.net':80
'fr####eparate.net':80
'fi###safety.net':80
'pa###future.net':80
'pa###smell.net':80
'wo###early.net':80
'sm###early.net':80
'wo###smell.net':80
'sm###smell.net':80
'wo###future.net':80
'sm###future.net':80
'wo###safety.net':80
'sm###safety.net':80
'ex#####nceseparate.net':80
'al####yclothes.net':80
'ge#####andistant.net':80
'al####yhealth.net':80
'ge#####anclothes.net':80
'me####separate.net':80
'fo####health.net':80
'al####ydistant.net':80
'fo####separate.net':80
'ge####manhealth.net':80
'fr####lothes.net':80
'ex#####nceclothes.net':80
'fr###health.net':80
'ex#####ncehealth.net':80
'ge#####anseparate.net':80
'al####yseparate.net':80
'fr####istant.net':80
'ex#####ncedistant.net':80
'wa###future.net':80
'me####future.net':80
'be###smell.net':80
'me####safety.net':80
'fo####future.net':80
'kn###early.net':80
'be###safety.net':80
'kn###smell.net':80
'be###early.net':80
'fo####safety.net':80
'ge####manfuture.net':80
'al####yfuture.net':80
'ge####mansafety.net':80
'al####ysafety.net':80
'fo###wearly.net':80
'me###rearly.net':80
'fo###wsmell.net':80
'me###rsmell.net':80
'kn###safety.net':80
'wa###smell.net':80
'th####tearly.net':80
'cr###future.net':80
'th####tsmell.net':80
'wa###safety.net':80
'th####tfuture.net':80
'wa###early.net':80
'th####tsafety.net':80
'su####future.net':80
'su###rsmell.net':80
'cr###smell.net':80
'be###future.net':80
'kn###future.net':80
'su####safety.net':80
'cr###safety.net':80
'su###rearly.net':80
'cr###early.net':80

TCP:

Запросы HTTP GET:

http://fi###early.net/index.php
http://pa###safety.net/index.php
http://fi###smell.net/index.php
http://pa###early.net/index.php
http://fi###future.net/index.php
http://fr####eparate.net/index.php
http://fi###safety.net/index.php
http://pa###future.net/index.php
http://pa###smell.net/index.php
http://wo###early.net/index.php
http://sm###early.net/index.php
http://wo###smell.net/index.php
http://sm###smell.net/index.php
http://wo###future.net/index.php
http://sm###future.net/index.php
http://wo###safety.net/index.php
http://sm###safety.net/index.php
http://ex#####nceseparate.net/index.php
http://al####yclothes.net/index.php
http://ge#####andistant.net/index.php
http://al####yhealth.net/index.php
http://ge#####anclothes.net/index.php
http://me####separate.net/index.php
http://fo####health.net/index.php
http://al####ydistant.net/index.php
http://fo####separate.net/index.php
http://ge####manhealth.net/index.php
http://fr####lothes.net/index.php
http://ex#####nceclothes.net/index.php
http://fr###health.net/index.php
http://ex#####ncehealth.net/index.php
http://ge#####anseparate.net/index.php
http://al####yseparate.net/index.php
http://fr####istant.net/index.php
http://ex#####ncedistant.net/index.php
http://wa###future.net/index.php
http://me####future.net/index.php
http://be###smell.net/index.php
http://me####safety.net/index.php
http://fo####future.net/index.php
http://kn###early.net/index.php
http://be###safety.net/index.php
http://kn###smell.net/index.php
http://be###early.net/index.php
http://fo####safety.net/index.php
http://ge####manfuture.net/index.php
http://al####yfuture.net/index.php
http://ge####mansafety.net/index.php
http://al####ysafety.net/index.php
http://fo###wearly.net/index.php
http://me###rearly.net/index.php
http://fo###wsmell.net/index.php
http://me###rsmell.net/index.php
http://kn###safety.net/index.php
http://wa###smell.net/index.php
http://th####tearly.net/index.php
http://cr###future.net/index.php
http://th####tsmell.net/index.php
http://wa###safety.net/index.php
http://th####tfuture.net/index.php
http://wa###early.net/index.php
http://th####tsafety.net/index.php
http://su####future.net/index.php
http://su###rsmell.net/index.php
http://cr###smell.net/index.php
http://be###future.net/index.php
http://kn###future.net/index.php
http://su####safety.net/index.php
http://cr###safety.net/index.php
http://su###rearly.net/index.php
http://cr###early.net/index.php

UDP:

DNS ASK fi###early.net
DNS ASK pa###safety.net
DNS ASK fi###smell.net
DNS ASK pa###early.net
DNS ASK fi###safety.net
DNS ASK fr####eparate.net
DNS ASK ex#####nceseparate.net
DNS ASK pa###future.net
DNS ASK fi###future.net
DNS ASK wo###early.net
DNS ASK sm###early.net
DNS ASK wo###smell.net
DNS ASK sm###smell.net
DNS ASK wo###safety.net
DNS ASK sm###future.net
DNS ASK pa###smell.net
DNS ASK sm###safety.net
DNS ASK wo###future.net
DNS ASK al####yclothes.net
DNS ASK ge#####andistant.net
DNS ASK al####yhealth.net
DNS ASK ge#####anclothes.net
DNS ASK al####ydistant.net
DNS ASK fo####health.net
DNS ASK me####health.net
DNS ASK fo####separate.net
DNS ASK me####separate.net
DNS ASK fr####lothes.net
DNS ASK ex#####nceclothes.net
DNS ASK fr###health.net
DNS ASK ex#####ncehealth.net
DNS ASK fr####istant.net
DNS ASK al####yseparate.net
DNS ASK ge####manhealth.net
DNS ASK ex#####ncedistant.net
DNS ASK ge#####anseparate.net
DNS ASK me####future.net
DNS ASK be###smell.net
DNS ASK me####safety.net
DNS ASK fo####future.net
DNS ASK kn###smell.net
DNS ASK be###safety.net
DNS ASK kn###safety.net
DNS ASK be###early.net
DNS ASK kn###early.net
DNS ASK ge####manfuture.net
DNS ASK al####yfuture.net
DNS ASK ge####mansafety.net
DNS ASK al####ysafety.net
DNS ASK fo###wsmell.net
DNS ASK me###rearly.net
DNS ASK fo####safety.net
DNS ASK me###rsmell.net
DNS ASK fo###wearly.net
DNS ASK wa###smell.net
DNS ASK th####tearly.net
DNS ASK cr###future.net
DNS ASK th####tsmell.net
DNS ASK wa###early.net
DNS ASK th####tfuture.net
DNS ASK wa###future.net
DNS ASK th####tsafety.net
DNS ASK wa###safety.net
DNS ASK su###rsmell.net
DNS ASK cr###smell.net
DNS ASK be###future.net
DNS ASK kn###future.net
DNS ASK su###rearly.net
DNS ASK cr###safety.net
DNS ASK su####future.net
DNS ASK cr###early.net
DNS ASK su####safety.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней