Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Desktop\Internet Hao123nknk
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'gfudrzpawqgoowjycziooqlhrtzcnl' WindowName: 'xgkcxkibxiiboedkmw'
- ClassName: 'swftkkngoshlqtxshirr' WindowName: 'vsplakhxxhttjctxsis'
- ClassName: 'evpewkbhyswewadxgcwjlmwsirtnhhcvpx' WindowName: 'tukwbjvyborxyuwpqsmouxoesak'
- ClassName: 'yxnbsjuthwzaidsqlinmfssbzkxf' WindowName: 'peljbsujescgmakvboefnpffrsnirkr'
- ClassName: 'soskoyluczfxjrfgxwskreiwgp' WindowName: 'seeihelhwxuwpjfyauasqaukoszztqpowzvdnr'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'qlvkicckliwfxitmx' WindowName: 'gxmpwqgxxbgymizcbhhbnvyam'
- ClassName: 'healjxtyaluljopwvjvyxqeplyqtuwjeofpt' WindowName: 'sbxsozjpdwznhwye'
- ClassName: 'ylssxqrnyglzbabowipcwrxlsyqgo' WindowName: 'aazclyghtmtxmsizopcxftomqsaeholvmydcyxl'
- ClassName: 'ivtxhuqiaxoddyjqkgpm' WindowName: 'bacxmzugwxblmbrfuhybccfwailscth'
- ClassName: 'joeeipvkvnxwvfwfv' WindowName: 'gudipkrtvhpfxlbugbrguaakmlecudj'
- ClassName: 'qoxjutfzzfawmksmhduclmwjo' WindowName: 'oongvngfaapierjogavblhrfk'
- ClassName: 'kizsltldokxaemvmel' WindowName: 'bhaobmndyfpjxzvujwvkodv'
- ClassName: 'tipouiuubzhizupverzvzbdkelefqt' WindowName: 'wctlvvkqxpnstroyfuikzqomsixzlskkxdzfu'
- ClassName: 'rtjdogycsywdlsuryowhfwqrywodopjle' WindowName: 'fhgdvpeijmvquxdo'
- ClassName: 'lmwjochjydmqzljfrsikyfhsnvnkx' WindowName: 'drfqrqhdygensclsjc'
- ClassName: 'tfuqripahshzilgmvjsjnbqwldeaghhwdodzmsk' WindowName: 'qgzibrjcljsadvmqssqtec'
- ClassName: 'iemgcdhhmgedgjfatotk' WindowName: 'hgqzwpahrqillyyhuqkccuewqjfeiqtq'
- ClassName: 'dzjqyeffjwujrduhwxhtcokrmzfer' WindowName: 'vidvjdbwxclhmbzlbvb'
- ClassName: 'svalbqvawrzeljgtxnuxzbivtmswgyw' WindowName: 'jdmfpnbltinyfczu'
- ClassName: 'weladdifbpcwcnvqxjuhhjh' WindowName: 'mlguadtqmlfonwqhhdiyr'
- ClassName: 'fjyslqmlxlkuboorzekurqtzutfjwu' WindowName: 'jxluujzpfrbaxllqdqtvmdsbvddwxrgdmg'
- ClassName: 'suiqfubgtrwhvqrlh' WindowName: 'dgmpdpygthtccijneowhuw'
- ClassName: 'qfoqwlkifkggweopheyqsunvfzyu' WindowName: 'qjkayryrhxpddavjzz'
- ClassName: 'mhvtcnrqbvppnjjoddxwkzqpmktlpotqlxwpihe' WindowName: 'dykuzffxwuaqysocllkgpvekuxy'
- ClassName: 'nxxuykqvojkkkld' WindowName: 'veclyjabskisknvdk'
- ClassName: 'iujgyeyregwgidkzvxmozqeipczgskmge' WindowName: 'pehascigakzuevatbd'
- ClassName: 'eketwhqikmnxjpjpayjbpwgoxcb' WindowName: 'yqzuhvmhtqzjxejnsydxwycqxmdeih'
- ClassName: 'vsfbwkzhhvxonrccqpblpsbus' WindowName: 'ixljkmwpsgxsngxoeaxnymnwndjkjppnkhwwt'
- ClassName: 'yrvsrigbnxdgsnrnzjqecglbjxfela' WindowName: 'civghosjkjtizontddymhrwzgqxvmpbfduay'
- ClassName: 'qibeawcssedvjhdnfybroqshrqmzdcyvrtxoj' WindowName: 'dlbtexiwvbzaytglfseyhrlyjcin'
- ClassName: 'efqkqmgmmraxomaxuuosdtmmpazj' WindowName: 'zgkexhhdkogxhsxxu'
- ClassName: 'tmegtgcldfiyiwufbwvlh' WindowName: 'tgvkxhaunidfhjbjx'
- ClassName: 'qfdvuktbzjfzaegjfqgaxvrismhitijzitlm' WindowName: 'gpekrybbibjsaoymruuxhmdqjgocri'
- ClassName: 'yprjnohxaoomykrkbbrjqrbgqazmmfl' WindowName: 'phlsitlbacvfrsoudvntsnkxtegjabfzdpahsl'
- ClassName: 'tlaneppmcmnnxnelenrqhti' WindowName: 'flpbksgnktgwwcwudlwebv'
- ClassName: 'zlcenygsndxskmjkniutj' WindowName: 'jwprcyzyjdjasfcwkuwdnodpzvjzxgivhsnn'
- ClassName: 'kortlarfvazwjqziuzwufljvvw' WindowName: 'hbdfxnqqwzbqieezgub'
- ClassName: 'kfmexjojllakkhxlteijtnbdupywrralqvqba' WindowName: 'jddjsbfycisynrcuqfjjkwgcyqyezbfckjuqlk'
- ClassName: 'vgopwgnuifmquqftfkru' WindowName: 'hpqclbwpeiwqjvkxnboakoakytjj'
- ClassName: 'degrszwtydzuutrttv' WindowName: 'rpbmxtfwwdnfucaksehgcmuamhdisaedjjw'
- ClassName: 'ewlnmmcttcvqxwqzab' WindowName: 'faaqjymjttllxooxkbrmcoqxymnsaxnjow'
- ClassName: 'cnpxhjbrtzwcgiprcgijuehhaagsvxg' WindowName: 'ukbjkitaihupcrmvkhfyaqnqyyrro'
- ClassName: 'iujmfdaunmhcykuaepxvuorb' WindowName: 'caapoagwtudtyvumfqdttiqauqeqkeh'
- ClassName: 'bfvdetxdcfodvftpccnepsm' WindowName: 'gkpvrsvqfndvwtlljapqinhc'
- ClassName: 'ezkrxxewnmqlkfzoesrfwtrevf' WindowName: 'pywdsdufpmwuqouraqysjptj'
- ClassName: 'yngpuulmebaxsrqwo' WindowName: 'sigtpbjikkqbsntjbmqceulcshiijwkbxrjmnor'
