Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsq2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\nsq2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\nsq2.tmp\Math.dll
- %TEMP%\nsq2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'oafkweurccjeumehosbomljifnlwqljwabvelk' WindowName: 'mmjzrsaymlkgxvnwn'
- ClassName: 'beukmssliuqvvtgnykoxnrfhpwfnbfotyk' WindowName: 'zbnvxbwnrxfikjjb'
- ClassName: 'hoqisalikmoyektxfqscge' WindowName: 'drjtopekhzsbkfnrojwekhcrhsdckuu'
- ClassName: 'vqwsnockhotzoprzpypnl' WindowName: 'yudqolgdwvkygfshtphybruoe'
- ClassName: 'vjsvtcyydmauddotaagd' WindowName: 'jharzcqbkvdukxnsjitfnt'
- ClassName: 'fqqysnagasxdtbii' WindowName: 'dvyhsqczclqfisnjfzhspvwr'
- ClassName: 'gjynhcecliovneisbbcgjznsoujv' WindowName: 'yelfnunqznmdqgjpjwonaoh'
- ClassName: 'oqjvgbhsczhjzpztpghaxw' WindowName: 'dtjdegrekhsivwegxoxzgunv'
- ClassName: 'ihwbsmfcgkssosjxvllcfmlfidk' WindowName: 'lqaddxdvgpzxginqpabzebiqkjeugfnmq'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'lejtujcnuflhektlfrnfvrmotisyqnoujdlsnoa' WindowName: 'jcnztyqqifmdglhmsghzgtke'
- ClassName: 'bxncwybqljtducehactizdcnfrey' WindowName: 'nsxuinivgoueyokwdzbzgrqntuotdw'
- ClassName: 'sfnldzhfoxxrvtd' WindowName: 'rafysvzlknrlruontkanvqta'
- ClassName: 'olegxdhfxvfuljmtuwrxofuee' WindowName: 'qtaepiuciaywwjwtzrhnpejb'
- ClassName: 'eyughnlkjkjsaedfpfkynzjienmlvzppewolv' WindowName: 'qukfuwiavqkwduwnpxzqztjdkoyuhe'
- ClassName: 'gftrgbtejoenwninbxjbwqwziu' WindowName: 'yvwvenmehtextgdwukgbnzyssscom'
- ClassName: 'bwijgmzidfyqfclxkzgvihdfmocubqu' WindowName: 'ewrgynzdgqstknqwifrnddztcwgjzemuavcqp'
- ClassName: 'xulyweilafbnarmggkrrleqgpn' WindowName: 'luqdgcdcyzdkscoyunoraullvxaoxyhcngq'
- ClassName: 'btgausdjgzgfpvlryv' WindowName: 'pwvpiyfuwswatkmpggsqryegipbeyyxy'
- ClassName: 'aitjthvzrjohzfcfkwroouepzkfsxv' WindowName: 'ltqnmprujsjufdp'
- ClassName: 'xklbqjnjhoriethnynvyejaqyqjjgcbxhny' WindowName: 'bwqophwzwvmowcqxgblytlxqeutnrareje'
- ClassName: 'mwrhkdvarqvlyrsdtdophnbtgqubnldzldfdaz' WindowName: 'vczuneaxjgagqsvxtbzs'
- ClassName: 'andehspctvieiptnxuf' WindowName: 'mzmxieibvibiqguvoueh'
- ClassName: 'zsybjwkfjdczhqbckzfayhgozd' WindowName: 'jxlwyzweefslwbtmzxqpzwkve'
- ClassName: 'mfhxjkbxxcxhvgsrsisjqxkgyafwrzavc' WindowName: 'gjvaxwoqgckkmwrninmcrwuzzzxxe'
- ClassName: 'cmhscjwopxmejsjrenqcgezthezgwctudee' WindowName: 'djvdnmfaljzdgfoapczartwrcgwssoonvrt'
- ClassName: 'twdtplukuqgmcvrcvrshnbv' WindowName: 'ktetbjbeiysuztlpqd'
- ClassName: 'tqsfxyminzesjpkynfszgpzltjy' WindowName: 'plldhbmzlzegkwwxmijjwpbasyeltyguukdjq'
- ClassName: 'oanjtjdwewvidihnu' WindowName: 'qzarowvihrmfrpmepcwdupq'
- ClassName: 'ewrjsofcrgrbnubxjuikmtlzokrpgrbuvpfragm' WindowName: 'cnjgpalumvzzlmmuvpolhlrlcmjque'
- ClassName: 'ptwwifhpdsvdmshauzttbjdsf' WindowName: 'ugerjpclkoehiqvxlwl'
- ClassName: 'nbqpsryguurygzirnsvsddsoix' WindowName: 'xsmgcjjcijwlyhl'
- ClassName: 'ftroktdqupenrcbgcnzcmlffgoeiy' WindowName: 'dwyqfyhriiuduhofjvmihr'
- ClassName: 'hhrmbhmrtibrnnuatenmzloqmookgaagcve' WindowName: 'btpadpvrmbdibmp'
- ClassName: 'irejhymkqoyiyzjqabjhhbqhktjq' WindowName: 'yfrzvjwnwqhfifnxolwpixwj'
- ClassName: 'vxgpvjzoktxgtxrybd' WindowName: 'vjnunbdtvyfxkmgmh'
- ClassName: 'tawrzfrmfrshpivzdsziscxmqjlymvuupycigc' WindowName: 'aajkwreesfjfnhvxemvndbwlwzmc'
- ClassName: 'hvjdbirxhgglxkeaqxkdkrgtbhocrnuqmoyib' WindowName: 'qigklghsipuvvhmtixc'
- ClassName: 'ljdlybezaassuyuwoahatgjedo' WindowName: 'neenzwhmhnbpgnqehbkhlyzetnotcuoaqsn'
- ClassName: 'pjugyxeuboydkshqggaufvjulmbmasp' WindowName: 'ooexrevpxebtuurzgl'
- ClassName: 'plbmiwkbdvvinvsarwa' WindowName: 'tirzskrpfbjfqnrwiuxkuueufjxugjeaaoeh'
- ClassName: 'qhsljjgzxdnmhoceqjvewoeirw' WindowName: 'wzrppfqwxykwbegpvbnkxvvqpgypm'
- ClassName: 'hfsoqchvfisvhukrboopgxthhflubmvq' WindowName: 'hlukbqeutmuvecmlvxzwvxfmix'
- ClassName: 'ixheanxkmeuqncqesffipyup' WindowName: 'yjfkkkdoplliufxnireidqkxjuaeflro'
- ClassName: 'lfwxsytxpcwjptjmhoj' WindowName: 'nifyqitnsbfcxxbydt'
- ClassName: 'ykhovlxxkutrozxzvlbyoysxgomgb' WindowName: 'xkmykzmnhfwyguyycxtujovswozn'
- ClassName: 'axttdkbyhzwcnoleygplgkoaj' WindowName: 'ayzmqheijudsqshruzytxsax'
