Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'oburzuudhofqedhglobwqoizhrqjb' WindowName: 'xhlicxcxawyeopyunojmwnwtvu'
- ClassName: 'pfpmfxiquhgcpzautvmyrkb' WindowName: 'aeptfwpokwajmbhdpopirvvanmq'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ujbzzyotlwlcezemfmqphytv' WindowName: 'ebrsrjdufsoebjujgncmmefejucpqvkum'
- ClassName: 'nttgydysthipxycsxvnthqnoks' WindowName: 'gjtcilhfmwtlotcaihnezyzttvvmctmiwmvtd'
- ClassName: 'fwtqzhbagerhxpy' WindowName: 'xubsjomfxrafwxypxylvquzdaoulecqzwnyom'
- ClassName: 'uqzjoyfiwdkvijrts' WindowName: 'xmkwhupwuvjtalighinmlnjgipuqccssxlqflg'
- ClassName: 'iffyjslhxdoatxkzwpnzggg' WindowName: 'adpcxutrgiibnfexbixtoqulig'
- ClassName: 'ejkudkixnbyireiucfgtnth' WindowName: 'lyyfahrtcydzgxrcrbsrxdpauvh'
- ClassName: 'fyyunhyhykzbscmcivblptfxlaxjwsolcpd' WindowName: 'fwgodwgameuuzjipeynazpojvzbk'
- ClassName: 'wozyxdfoyokmuoifsqqmwcknykrcjrvjjamh' WindowName: 'cxlkgymhjtrchmfktdedhggrc'
- ClassName: 'zvwebtdzqaogohhga' WindowName: 'hzdzoktvlfzdbwjjxid'
- ClassName: 'xhssftafbdaluxxkmkjjuuwdxlbqivzng' WindowName: 'csxwiozibovryvseplivqibi'
- ClassName: 'aibyakcrroektgmqyxdtkbrkuovkrc' WindowName: 'actmljyevzxotlvgrcchf'
- ClassName: 'lsbafhjvgxbiikdvvbta' WindowName: 'gjinwtvurowcnyphvsbfposelpnxlamvtgg'
- ClassName: 'oeomjumhqowslgboskmyigexwcwsnhw' WindowName: 'yrxrwizdyaggyhiksltywry'
- ClassName: 'gryivqslwdyuspkw' WindowName: 'atjlpsawvohxczqlges'
- ClassName: 'yupbmesavtbqoscmdpegnprrlxkmhlyn' WindowName: 'bgoaytuzuqbbhlzvhrtrj'
- ClassName: 'nyqgzlpperbvvofldemblzciecuvlanh' WindowName: 'ftgjnmnnivhynnnq'
- ClassName: 'gfctywmikjnewwfvacgmedxcvfmuidumqjegui' WindowName: 'nepaiknejqxgsdqyuujuhjmljoofo'
- ClassName: 'kfkzzaopynqqsedpijgltfligf' WindowName: 'oloxgtcxbmjaavqbffvseuqblrmqoelof'
- ClassName: 'hjyssifqgufhwlz' WindowName: 'olvbmuzxjvbecrg'
- ClassName: 'jhtukkpvykzayhkqzaylzxfc' WindowName: 'exetkxfldpexixxbcludkavtwsjzaxrkektzbmf'
- ClassName: 'sntxfkbsllwxtfdgyrylhvsa' WindowName: 'saeysqxdxzcaqcukzisyouefmhtvycf'
- ClassName: 'vugspameuqzotstqvcwqfxoqjskp' WindowName: 'gtvnaiqaigdeouqmqxnlgfmox'
- ClassName: 'mrtpuysixsmcusxtovnnwrvpbmjgal' WindowName: 'nfemldfbkbrzwcfdnx'
- ClassName: 'jwwlohpjrsljtjfaqtwgssjbfhnpj' WindowName: 'ebvtbhyhrydlaavemtprtbihslwuvwgofqeg'
- ClassName: 'ovhnvvxvahblrvqewfapf' WindowName: 'zyfynjyqakhrowcmjstkpcvbyfo'
- ClassName: 'gvpgiyabjjvgfhryvbqolozqbwojhftazghp' WindowName: 'cnygwxwvzqfdndprfhsjbaepkiktj'
- ClassName: 'nejokozpufxefklrtanovabnkcksbvumwx' WindowName: 'caemvpmhahswqnnlkdcva'
- ClassName: 'vwknwclrdefjgjxauidjltsjiivxo' WindowName: 'tqbdeyhbyfwaqrjxxpnzbwrden'
- ClassName: 'hwfnhnoxhwvmmschbfphsy' WindowName: 'iyveexjlfwafifqe'
- ClassName: 'czrataowgweyvjbduqjcesupseegb' WindowName: 'zjnkeypujkisjunksummygi'
- ClassName: 'myiwyydsoznwzazeodvtsegvexkixvyllrklm' WindowName: 'epbypdaeuwoohkeujzsprflntmxfhtsqdsq'
- ClassName: 'jzgtfbjecbkuowfvdabiwaddu' WindowName: 'yejcinceffistswzow'
- ClassName: 'pyfupdultziywnkvkfywl' WindowName: 'neityyfpohmehharjywetejkiicqtmadzwc'
- ClassName: 'myizjgsrywomoleonftymcavwxqfqqnzu' WindowName: 'dmliglxnwmvvjumzul'
- ClassName: 'zlqnvogzwaobsczzwgbhtwsskbx' WindowName: 'bdwerigrmqfcieldrczxzcirhjhefv'
- ClassName: 'llofzaozjhgzphxycusgsghxegge' WindowName: 'xmyrnweljeiiiugolvzhcuuaoovkcvmjzuyz'
- ClassName: 'ajimlvffucrnpsetfjrenbwenjyvro' WindowName: 'rwcvmcxcmazplifpgjdiyj'
- ClassName: 'nckrmzwtnevgomglozgraguas' WindowName: 'eyrszyycseabzpphqtuawvyxf'
- ClassName: 'dqggkntwrrjxwfpjggnuown' WindowName: 'ucxhoujougjzpngwzonxfeoktgemgfm'
- ClassName: 'llwzkcuunkdxtorrroiouiffitujolmztex' WindowName: 'ggxatkrhovppgfffgknai'
- ClassName: 'vzywrswrvugpfquzerk' WindowName: 'odzrblwkrvihgjwjldevitnaphambddkeg'
- ClassName: 'xjbalihfbqtkwzkdbqpsqquvoxiizkkbpkbf' WindowName: 'thaubpwamnsndwvcatzuytquztzzjemffqlhpoe'
