Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'oblxqyorylnglqxgqb' WindowName: 'ejujbtqotzymxcxifxereuacntszdvmsm'
- ClassName: 'ynpswanqqgidbxfbqkkzgfiukxsfudotojepqp' WindowName: 'fdiesfmeiokjjtbvswhiwexal'
- ClassName: 'drurbfntslbsbzlbkmkgadsmkhatvrs' WindowName: 'cjlhdppmmxiazrtfkcunlsuslaugzrrzy'
- ClassName: 'uioquffgsmbcjykvdjuzgmbianirrurgnh' WindowName: 'ledhdajikpaqzktnlwmovzkgltaulkpbgc'
- ClassName: 'ngngnwicyfktcndcdnrlmvsxywnmauzmcxpahvz' WindowName: 'qxbncvgrkscbtmczfwyvsin'
- ClassName: 'xeqmjhvfywqbpbeuzvbdssjqiz' WindowName: 'evokyfukrgvglebxjjjsp'
- ClassName: 'mbuttoioahzmmnriicei' WindowName: 'ctexqirlbumzdubopfyn'
- ClassName: 'bocxrgtmikfqfgsvmlslkdoergazpxct' WindowName: 'mgtdwurjamttywkvbleot'
- ClassName: 'wuvcjaxszfjghjrisvopzqykbdzpvy' WindowName: 'hcnqotqpoccbnczqtlqjyjzvo'
- ClassName: 'qblojvunyqmmuznetdyrinqqffukl' WindowName: 'efchxjbbyxhyugtoylsicclfmubrzdmwcfjyaf'
- ClassName: 'eucinvynugberluqrpupgecogzqhjvzfthf' WindowName: 'kpztawbhheyyrartjxceauds'
- ClassName: 'uijcadsxxvioodorklwytohxpxnxcwxzp' WindowName: 'vfifqyjsnnmnacejrdk'
- ClassName: 'rvirpiiphvykpjulnmiqqhsmw' WindowName: 'moznfyytwdubdpuz'
- ClassName: 'unybaygpdmsclftdvmfbppgjtlhoghxlwvi' WindowName: 'yvpwscbbprikuqgbxla'
- ClassName: 'nibofauexqysingrckeakyfwcdbinzv' WindowName: 'chgezqnyygioygwg'
- ClassName: 'fjfxmhzvagsddzwwhywaflcoryqll' WindowName: 'wrubqhqvtbczneoilh'
- ClassName: 'hzjjdlmxzvhamvylykrbncfuiptugjbnus' WindowName: 'dfwwwxlqfglxukeuittvphzwouypcmaobhx'
- ClassName: 'zozrdcdjsadsvgqldwbzddmahzg' WindowName: 'fimgfhvgvroqoxu'
- ClassName: 'scpvgiuxqzjjutbcepoknwxqofgcm' WindowName: 'ujilczzzxtzfrqmiudbhggnydnyazdxso'
- ClassName: 'yojadhxkkunygqsdp' WindowName: 'ntoljzrpmhmtfsyicarlcphayekb'
- ClassName: 'asukgwmqsajyhhpnzhlmbkhdtdddvdgumw' WindowName: 'nzzvludbagijlqkkldie'
- ClassName: 'qpwnxxkddvkjcsnoipsrwvldyt' WindowName: 'qtguwxcetwhuxaabhbgelqdyllv'
- ClassName: 'gicyfcurytlsjshgjplcxitsxduylryfpy' WindowName: 'nctappxruewgupgrkbkhhq'
- ClassName: 'tmybbgvqymjtrfsinwsdcultlwxac' WindowName: 'qugwyptiuzdpfaosergelaynxdkj'
- ClassName: 'dyaqdzuvtfaqumjob' WindowName: 'ktvbxiglxcskuekbliog'
- ClassName: 'coyzxiffqikuyfunkwmsgtvlfmkyvujcrop' WindowName: 'fdpqwgunzwvgrppenkduwfinyuuagqfzwx'
- ClassName: 'kthdgdyismgtoofxlrvmukcswqetsylzayvt' WindowName: 'ibzavtaxigctqokooevrlpwahydlp'
- ClassName: 'mxvvzatmmsgrlobptgj' WindowName: 'cyprgyduevpumbyttyvons'
- ClassName: 'smyhcxlwfvhobaovdxdwuxnokjxekxea' WindowName: 'peppiekzwfifxhx'
- ClassName: 'iguzuuyzthnhikrdkiosjziihhxtarxha' WindowName: 'hfinnhehmbxvehfmmjrczmwrutocybhftcgkj'
- ClassName: 'ynublgtniacgnczzmd' WindowName: 'lcnwjvoestzrawkgsryc'
- ClassName: 'ggsnvsiccnnhotyucqxgskbtczfoavohlkbfua' WindowName: 'liictqkpnkfynbjdpexf'
- ClassName: 'oghoamkdyqqyoewcayrbihp' WindowName: 'ftufnfrtprpbrxnungmmlvoszrmrffwacbjf'
- ClassName: 'rqkjpuwekvqxvrkswa' WindowName: 'ptattkgfdtksnaogcpxelleoytglz'
- ClassName: 'yiexemzfzqpcuygyltqaunbspkjmnwqbuayf' WindowName: 'wnlnoembrabaknslfmnrwwugvymopsjzmi'
- ClassName: 'nxraiddvnvaknkyqguvmnjthg' WindowName: 'cjbldwyizqlmymxefgch'
- ClassName: 'jnrcuqybsyfntxfmniwritfelsdtesdpno' WindowName: 'zzmfmhvsjnhvxbodqxyakkujzxlhcfixbye'
- ClassName: 'jsxhkohekcaybhukyzlixinh' WindowName: 'phkncfhrppwqrtjmslyrjjcqflchdwmmbxrdser'
- ClassName: 'crmmjricnwefsjlvwgubfuwzqpiah' WindowName: 'bdoagyazckbmoqnz'
- ClassName: 'vaxhvrhudrunoebukbofr' WindowName: 'zbinflrjtbibcfthtfgmmusswwzixhylwpnicwd'
- ClassName: 'rfehmkhafjmpzplrmborkunqjxdqak' WindowName: 'ezglbtymewyoompwwtgpkgzmenvkyctiquooo'
- ClassName: 'shrdvvojxsnewqqibjqykroplbsjbkvdrtqy' WindowName: 'klbvrggxjpujzlzmwyqjtaypy'
- ClassName: 'tbbwldydvynhpupcmhg' WindowName: 'hehfqkpgnvmyhwwu'
- ClassName: 'lqffhduspixrcoivycvlxdcwzccoipnho' WindowName: 'cloeivdtkbqwypxzjfgmyuvyonxwxxdray'
