Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jnxdypdstkfbetezosvsoxfleicjbtebhw' WindowName: 'jkwaruptbvkurhqvfrselzjanqrpsnfh'
- ClassName: 'bedvluiouuowvwe' WindowName: 'uwzbvjsosotlgiaaiwsitolowkwyovdl'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'tclkcghuwsytnonhe' WindowName: 'mdbaezfytndwkncnj'
- ClassName: 'vhoxsawejgzjskpwwoazpllfliyu' WindowName: 'fothkmfwsrbtsgigpspuhlaqshthejv'
- ClassName: 'rrgttqavyzngjyocezabssrotmtglygpr' WindowName: 'izgaqywieniptvqkwxxp'
- ClassName: 'vndxopixsaijaeuiffrzuhexilqgovg' WindowName: 'xqfcbqevlsqlnjwkvarj'
- ClassName: 'anhcrvdvvbhlwvvxitpdgtozdrkvz' WindowName: 'rpcajbknqgktllkzwrvskwxhdgzarkov'
- ClassName: 'tpdywicbgupgqmawj' WindowName: 'zbnbbhsmnscrzdqsjnkfrbmbcreogly'
- ClassName: 'kvbtwkxsdufdgdxvlkcbqdbqhnxyihogv' WindowName: 'zydwjuhdnxiltafwngpv'
- ClassName: 'uhsgromevpgpaxkibrgzoqsorpunk' WindowName: 'ijirzjoaxbqfjrrawix'
- ClassName: 'ijnfgiwohqcjqmfwzlgbxwytkjabwlhxbwypvd' WindowName: 'auharvvomwsfjgc'
- ClassName: 'xhvazhbhrbcmtmjoncuzhgiqamjztrpxzqcycb' WindowName: 'yqwiyiqbymqbdlbid'
- ClassName: 'yrbbmsokyfccwcwxtjcvnnyncsfkgcgxbyjcfgd' WindowName: 'gsydilfxbdkjrwtokdbzbdhbvpvkgigsjigvxi'
- ClassName: 'arsprggvfnnvevnfmjhethsmmfbjswcdikmmr' WindowName: 'njxaxwxjnxieesrppjev'
- ClassName: 'vbhchfoqggtytymoiwnnomhxflxia' WindowName: 'jzcwqehzerdlhoozhjxskmdbfuzxhabrbcd'
- ClassName: 'oppbyhmkflmdlbaachjpyclrfzzu' WindowName: 'puuurcumvomnrjodhxbqnt'
- ClassName: 'gixwwdeequxprhkghjirzvpenyrzjzoe' WindowName: 'impfnsnwcyuhsjhwfmkvwisvfpsiykzq'
- ClassName: 'sccofvhuznnospmdghh' WindowName: 'cshhprtyssornbdtlahckmbwezkscecbzja'
- ClassName: 'xgqnngproqkghaxthythosih' WindowName: 'pkhmrtsohlmegxfhjrwjmehlsxdsau'
- ClassName: 'mipntytjbwxmnydqrywxbgwundzstdj' WindowName: 'xpaveuhxwsqcnrwpikkqvdsiiyimczrnxg'
- ClassName: 'bjxdiwqbybbklcnvlaimgjueeudi' WindowName: 'dmbnfnsyhuhbftlfgwqxvqebduytzbzfhagtwqk'
- ClassName: 'zcyymffydxpzijxqapjsaziicdlplmnsnrkvo' WindowName: 'ifbpjzpxmiawaccmmfaefqrnebel'
- ClassName: 'epldxsvjmpavnaqg' WindowName: 'mpofkknqfexodvwfuwtmbsszqdlxigcibxnwcz'
- ClassName: 'mavqdswpkltlpbrukiysejbfkakyyumxi' WindowName: 'hrrrpecplcliykszxovxiplntvjlpzaxifblfdy'
- ClassName: 'tdklsioyfgaeflymrofbtf' WindowName: 'lufomnmucazedwxffqqsqpwsepzrvvog'
- ClassName: 'mtccichoigneowzewaylayfcwbdqrgxudbnd' WindowName: 'kmoacarfvonvzla'
- ClassName: 'eajmvdheckltzgumwjlk' WindowName: 'qdfzwoxftzzdetbuwmraeclg'
- ClassName: 'idwvjvtctgzaxisgf' WindowName: 'tlgywwpbzbmubbffiwqdqtrbufefhcwyqdy'
- ClassName: 'xxtddtwuhvqlywqpptpdeafnofqdmbbobqqjp' WindowName: 'givpzwlmuwavyjiavizf'
- ClassName: 'uqnfgbyyycdmsqstldfcpkldyxtxlw' WindowName: 'ewtlwugjukokpmhmjdxhcxiqgifh'
- ClassName: 'uosxxafhkmangxzsgiodxnsxene' WindowName: 'gzoumadyhdpuftuzkegcwyngnxtieysjh'
- ClassName: 'bjgapjmjdnovetouom' WindowName: 'pqoyzhiivagzfgqdggxjeyijyhwstomasncms'
- ClassName: 'kdzmlxiwfjxifsckrckiugxibpzwhzh' WindowName: 'sfjxebsezfnegww'
- ClassName: 'cjgbvlkaykyydpyzixstgbalmblhpdp' WindowName: 'tzljlhycoawarmhtinfezeojnaxppkkzomcgv'
- ClassName: 'yndancoevdtksvffaqafpdkcldyqbsieh' WindowName: 'wipxxszjafjtzlgkejrqpbaj'
- ClassName: 'yrbawjgjmeldnajzf' WindowName: 'wrbmphkpubdifsamevmigrsar'
- ClassName: 'dldnxcbibvkbfgznqeyvqdqcxmambxvzoknywz' WindowName: 'kozfzwsedyittdow'
- ClassName: 'xgwqqrrcrayxuwathboqmygaz' WindowName: 'mrcrfzywbxshwbijkzqscvqjtejhbqugspeqy'
- ClassName: 'klankjzeynzritumcnnlsvdlyzzxtxelvuel' WindowName: 'ydlsmkqrwxngtgeqvjoimalnekhor'
- ClassName: 'swyyrlgydiuatwqywhizuzqdrwaqestpro' WindowName: 'uozdhglcfseqaotzbidxcgzpilnby'
- ClassName: 'npufzrluiuitzoptyfzngropknvezeeswj' WindowName: 'hzirkgvaoaximwpohpkitmlqoykexahccjze'
- ClassName: 'hrvzosxbzycluujreihitvyu' WindowName: 'qgjuevjygyxipsssh'
- ClassName: 'euxavxnlojgbxzurcxkgfcn' WindowName: 'lfmgntsfqqlvtqqz'
- ClassName: 'dwuovqcigpymnaelbyblyupygmpflkkung' WindowName: 'oawvsrwewycqeqlqkqgtnjuwydazyikp'
