Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mdsvdtrrmchlczyaaeksvr' WindowName: 'sslwthyuguiycmqqgptfpilmhxbblcpi'
- ClassName: 'zwkavbljyptezehhes' WindowName: 'kpzoamwbtjnmonyfljxaqjpcdrldjs'
- ClassName: 'ooqjckkwnumuiifhinqokckrex' WindowName: 'anglrqfapvaspeaohzlsrqvhuerkc'
- ClassName: 'cunqjwvcbzzwtmoenhoybp' WindowName: 'fbclfavajqbwdzvkezijahdm'
- ClassName: 'kcxvujwpogcosekbkjrswftxsiq' WindowName: 'riplwvwqppoyjfcjpypriaf'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'gnddqlgohjbnhqzyoelrwhyghjawbaluyq' WindowName: 'krnrhcsdqvimprgfzgivanwofblgidxdlo'
- ClassName: 'oxdxsiktyzlfvfrqqwzfdhza' WindowName: 'qjbeumqjxpzzfdimgkbfexwfnvldrybxy'
- ClassName: 'nqsmjnboowgxdieptvfglfjxkqjhcitcezw' WindowName: 'njmpnxtrlcgeumwrgdgyrimjvaxbos'
- ClassName: 'soqwyipdrkvxmbimpecigooiw' WindowName: 'qlbefctabqvbawysxcxnzqhpgjfaqdrbemtxjvu'
- ClassName: 'olcydrpekssgobvnj' WindowName: 'twstecsxioneswq'
- ClassName: 'qqpobiqjrcokquologjkk' WindowName: 'lbusxebmkkwcunkhx'
- ClassName: 'fdchqbydpkmqzfybwdsjcapjamrscfa' WindowName: 'aezomgpajyzpswtrbsy'
- ClassName: 'wjepmevgpinqsnohns' WindowName: 'gcbefsdzgcmhxpqhqferltjjf'
- ClassName: 'xbtfuzlgzrqbnzwpxxqyjbxleroxibllfsfs' WindowName: 'enkpcjwlnbudyrxuwweiezyd'
- ClassName: 'ychqennyrwgjbdcspcbsy' WindowName: 'phbchwwsaaqzjqboszsmuavsiok'
- ClassName: 'stfrrlepdjinatlgknmuipkzlouwyznszpmi' WindowName: 'egpiadygspcjgfuuqgzqxnq'
- ClassName: 'prwbzjmbcbpnanwvkrqkesvpfwkb' WindowName: 'civltajicfrcqgkb'
- ClassName: 'iglusrbulkswnqardbrgdtputalyljremvocgn' WindowName: 'cblglooivetpdzotlfaa'
- ClassName: 'tmexbumldyjjnhz' WindowName: 'cgiirlhdojrtwsbrayjuoapryzuzz'
- ClassName: 'ofxmklrlpddsgqirmwsi' WindowName: 'jzwjfqcmqtxjtrshilwzdzqxtrurcve'
- ClassName: 'jwgvuensjzgqjmdpzk' WindowName: 'dgthqyindhrqclpipbsibcy'
- ClassName: 'gueutgcespjbqro' WindowName: 'gqfeswsxdenngjnslvowveeaijaej'
- ClassName: 'suuatnssjuixhcuyrgqvtnhviyrexlrmnkcaf' WindowName: 'oumpkjoiyihfuhphhqaeukjpdyhdrbcna'
- ClassName: 'vcwcrtxtezjgzmyhojzbqfgzuiemursoppilmma' WindowName: 'kqbduanyjhodlluochi'
- ClassName: 'isgybwjndhwirhfxmilwcqztkupyhrqxbedky' WindowName: 'auqwknkwvwblrizshtdwlghwii'
- ClassName: 'edtosqhstklcmomtawcxtlicj' WindowName: 'dsverfridgmambqstha'
- ClassName: 'nlnvhnzrqcemoskcktbkhqfzifktl' WindowName: 'wcphpdgwugxygylhlhapbfgflrhnr'
- ClassName: 'aedowtewtuyukjnm' WindowName: 'avfhkykiglbjqvegljijfb'
- ClassName: 'kdpakwxlkotbzrudmmtlcvvswes' WindowName: 'swxiebdujtdohhrxuludnurrtppijeulgehtbp'
- ClassName: 'yrtacguxvevzkdfvpwvzdazhwja' WindowName: 'awquvmwwabvkfpvncytoegytyhenhgogod'
- ClassName: 'hiuleiqnygoifdxbqkqifggagmrtplntfjnh' WindowName: 'hichccrmsfcvfcutnm'
- ClassName: 'xgscjasstezkskbperycdubbfqnelafxdg' WindowName: 'kzrlrklchtarumqcz'
- ClassName: 'mjillmrhyqgrsqytlwafcaidhvj' WindowName: 'isftkodjshbsaxnqkfydnhrrenx'
- ClassName: 'iqaqcxpznictifvlfcajtalpsbvueqfgn' WindowName: 'eicdxmocznqsgqwdddejjchfkdqzbqa'
- ClassName: 'spxjbwjaqbgiwgfoikobez' WindowName: 'bysnjnutlafmiqvw'
- ClassName: 'kdpcjdojjnuwzzaizarcw' WindowName: 'rabprkdegycpovchxbxev'
- ClassName: 'tewsbkpyrcpulnvxtzguqntahbsniua' WindowName: 'fnsldlboxejouetzhiilkopttyrvspmzhxae'
- ClassName: 'gubketqfrmpxvfvlo' WindowName: 'oqvkuntiwrniqjhsxxkslx'
- ClassName: 'qxugtynyvjvpncsnbiiehwy' WindowName: 'nqcyoexqiulurgengoypgtoroiaovwohcdjde'
- ClassName: 'whrhjurhjihawcsacncjgwgvztoiowzbx' WindowName: 'nylbucgeqgbqelqczotlbchpnwgoyibfbv'
- ClassName: 'pmtvzbeeeyzxkskrwx' WindowName: 'kyvrwtiapyvthwfrx'
- ClassName: 'qnrfnekfkqymvflqtbxkm' WindowName: 'zeryvmzkmsqpcvcuhmncwnlk'
- ClassName: 'bodwchyzdoveckspj' WindowName: 'ltwfvjrbcovstdgjuyvxddx'
- ClassName: 'lklukvmdkddqhceftuutytgbcwabdwvkr' WindowName: 'trpeicsgsdwfizkbpdvs'
- ClassName: 'uyaalfbkxkgrovvtldgnsjldnxnmyhef' WindowName: 'vwfscwzfikpzjflatgkzg'
- ClassName: 'twfdohshhppurdwfijfmyzsgkl' WindowName: 'wjpzgxumleyiyuwccmkzeyoutt'
