Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsf2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hixrfaqtawzaieijbtqzsbgdup' WindowName: 'mmtceksriggbnjbrxyfkswxmjtudlbvfejldkw'
- ClassName: 'edbqzeejmcvzfcw' WindowName: 'yzigbuzxsatwiehpayiwwaxkesgdnibvjao'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ytkgwppmxxwaqcozpyd' WindowName: 'ebqjjodehoseqwicderrwals'
- ClassName: 'ufrxgzufeommasdnrktwqkhelvchjduqchdiln' WindowName: 'bbsjmmrwdhcppheo'
- ClassName: 'qhwabugkduiybwknbhjnptdviywsioo' WindowName: 'tbelvjgrucegfkiqckkhh'
- ClassName: 'gawlpwnfgdxydiklylpeufkgigspnglkgqgsuca' WindowName: 'qfzthwfowarwdsgflijcymzpcodq'
- ClassName: 'ueqjpywydrumwshuan' WindowName: 'umhxuugfvwrrvwvm'
- ClassName: 'gyarpzdfpazlwvlsrnikfxvcdfqbbclvwhdbou' WindowName: 'qqznxyxdpaqbsyvnhorohibfiioksfodioj'
- ClassName: 'fjpwhijpnbhubzqoccgfpxutkcieftaxbjzw' WindowName: 'uluhtzyxmxfuavbzzhbhmrqdfqaiqrfuekeg'
- ClassName: 'ejoqpmuabdlifexhayardwycsws' WindowName: 'vtjqqxitnlcqdtpheemsxjpqiefrtm'
- ClassName: 'jfddsfuzirktvnirxiijpudvyugmsbqwdu' WindowName: 'maezbdbmmxasxqxdbbdsgvrs'
- ClassName: 'bydcoyvxyurxhytypcymfhvpkzsxxghmschmm' WindowName: 'sonylicugfpqvwldkdi'
- ClassName: 'srykmjvyqsnyhibqqsrrbco' WindowName: 'sbooxfxudflyrxardypfnxxeawgt'
- ClassName: 'ddiytfiduuxehfdyrdafwfazwcmqvwlijcwetx' WindowName: 'lkfvwgikiicjpzhywolbpjsubav'
- ClassName: 'qvlizpjxqbmiuisqnhhuzvrdhmduw' WindowName: 'bkptzcdmkkcxjuuyfsmcspyqwzoq'
- ClassName: 'orsasjhlgpcamidxnnkvxvbbwaiqorpxywa' WindowName: 'yimudhxaseamahevywbfwrvo'
- ClassName: 'uvenaqvnfpdehgfwmag' WindowName: 'lfrtyedeotgznphxrsersw'
- ClassName: 'rhvcxlminavftmzymwcdvtpkipogrhftgawtr' WindowName: 'srdmznaatlmdwmthmofcgiwgcmlmloiuy'
- ClassName: 'vxuihynhqaxjoevvmev' WindowName: 'wmclqyahzcozucnb'
- ClassName: 'kxwycyszloktgwbhznldniiji' WindowName: 'buzzbmqkctjsjuzaj'
- ClassName: 'braldoyhvpcjccfpsfshlgzwd' WindowName: 'thqjsbanjljfwtgnqhukklkvelhxztvmgck'
- ClassName: 'zgvzobllyrqxbtjnvvvdsbqbkqqiirteoszyiaa' WindowName: 'lwykzfalizeqbslvfvbhmlcukhuq'
- ClassName: 'xnbrtdmrrcofkxqpvgas' WindowName: 'whkzojnovyfprejsltrfztthqng'
- ClassName: 'ggsoturatzqqrugtlhjaphuaajvbzbeszn' WindowName: 'dvdzqbdqukpqctoxfp'
- ClassName: 'uqwigcujpftbqxiqtsijwxivvwnbvncjpgtvh' WindowName: 'tcvshubhdfpinhmqlxbifysvgyc'
- ClassName: 'qkpjrzzlzkfwrghpmyfjqkovqgh' WindowName: 'fhkelwtymmmvvcquzuudjellwsnrpfzvnybeifr'
- ClassName: 'ndcwwtvefkxhncird' WindowName: 'bmbkbufhffhepsnajiegkndqxklnuwyylnsd'
- ClassName: 'sebjohqvykocwghjfrervj' WindowName: 'oiiyqsotxpkzxctteqvtk'
- ClassName: 'jvusxduiuzrrvugupysqhwrewpkursizcznz' WindowName: 'iwvizbndepdizmnlhgn'
- ClassName: 'akrakrykqjadaiczdacvpeuzmiga' WindowName: 'wpiuvpmhkzgnzswlozxuihpqvxep'
- ClassName: 'oaoopslbsjlebbjsaworfcinnpgu' WindowName: 'rhamnjbpbpfvfagmqrpeycmreulxumahv'
- ClassName: 'nvtcdlhbhgesdpguwuubxtsc' WindowName: 'ypzhsmfnuxdnyoxcegrznspsdy'
- ClassName: 'xyrdmgjxrciybrhprz' WindowName: 'qsysmilkinvuruwdjrwwcttnggzjap'
- ClassName: 'orgicltuvlonwdloaowadfrhgoizejbvclicom' WindowName: 'nwzzzlcsiyyywjhfvywakvuaihc'
- ClassName: 'nlshhbndyhgfkpvdwlnftcstrmcxjbqt' WindowName: 'ydlkydqcmbftaascpkywldqwpeqrbckvojtmosx'
- ClassName: 'jcoglppmodhyadogalhschyjk' WindowName: 'qzfdcuaabkzkbxnexyadqyejjik'
- ClassName: 'nypppmujutstomgrqoypdatumcdqm' WindowName: 'hfbavtirgcjxwtmxcscxohoqvzgabncv'
- ClassName: 'ruyomuupwjaruovqdeftnuohjde' WindowName: 'mznjotzdvhcvoguzoqdbulk'
- ClassName: 'pjyibnszelwhdlbbkqinz' WindowName: 'sdgrnmlafhnboov'
- ClassName: 'gqsosjjwoyabcvpscqmcfcfyb' WindowName: 'klutbutocsvzdnqawuhwulnhegvogteozte'
