Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ohfhvqxqncuzzykyzdbingslimvooom' WindowName: 'rszphmvnwqkroya'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'qzunyrweyhrgerpefbh' WindowName: 'vyeohvnqjbkhervibcjmzbamsyod'
- ClassName: 'bgyrqztqifywopaygvyrppwhyhmccl' WindowName: 'wbdewgifsxplzvhgwrgsmckpgwaimipdn'
- ClassName: 'prmhjqhpmdgfjllhbldhghxhqjt' WindowName: 'ttyjlpenqhsybaozeulv'
- ClassName: 'ivabsmckfrkfqcrrnzbwzbojymccflpsoiv' WindowName: 'ivcppdsmhkmrsesdjfkucpcjwhueltewlcvc'
- ClassName: 'mvyisskjrvdtvqituzfdvpomn' WindowName: 'mvpnldctsodiqqxc'
- ClassName: 'jvcqzlkkuumervvztpessdjnybhgcicfiz' WindowName: 'bukrkvnagsmpsnzuctfnvhtjlvnrbkzelwsi'
- ClassName: 'ujowueyjlofarxgclmwxuielsspfndtfsvvziw' WindowName: 'nxvadhmnelqymxnydpd'
- ClassName: 'oqnixizpmrremfoybnhitkvouviacgemmmfhj' WindowName: 'uxtwcpmdcszppkepvhvmjmvmthisviktwhroush'
- ClassName: 'irvuowvrwhwtsspbuzbx' WindowName: 'hgzledhbayptlffrdle'
- ClassName: 'zpcxwnifhncwpgezgehtqhiu' WindowName: 'odmtonrnrepbmmnnwq'
- ClassName: 'mmgmwbysmzxmvilhxsxbwd' WindowName: 'zitjkztrtxmckbvsdxybgbalbijbuszvmbnzenm'
- ClassName: 'hqodpsgudskcapfdifmevxiedygn' WindowName: 'ocvyypsbpjcztfj'
- ClassName: 'dceiwxvlpyocdyqtvraphkphbgiousxmjcr' WindowName: 'ytasnzlncvajabvsfsb'
- ClassName: 'otvbwtsjspdawipcbnmf' WindowName: 'elvcqlcamyubghfhncj'
- ClassName: 'mudpewfsqbmjayeqbkknqmh' WindowName: 'nhoezklucdnucfwghixyhhrnvohavwuvptbvulb'
- ClassName: 'dpbuokaoeianfpcilkmimmhlwllnj' WindowName: 'hzqjzzqnwmdpgqpgxujwyimagartbecndmpnrt'
- ClassName: 'uxxkichpipszkugv' WindowName: 'aawqszizigjhzxzwjirdallzb'
- ClassName: 'chltmaoptmhpbctedshrrabsuhbwyyycmay' WindowName: 'alzatupkwipslykroiehfcqvczgm'
- ClassName: 'iqvcpqusunuceuji' WindowName: 'cznkudgspbollwsgpgeagiauvjxyfzjw'
- ClassName: 'ruorqdayfhledkhfpdobz' WindowName: 'qszqzwqzxdzwxhmaompfwgqssgmpmsdm'
- ClassName: 'yuhhmtkptjejyymdvojvxrpiccbedrmuokeuyfs' WindowName: 'cgvpafmhvbknfvmkebejpgz'
- ClassName: 'ddfclzvheembcjhpabnrqlurb' WindowName: 'znupwdgbwitpsrempkondfzakctoqil'
- ClassName: 'fktclymxrfwwpuiwugsngfdt' WindowName: 'lqnbnkojhtobyyftiljnbgzumonccu'
- ClassName: 'vxyudobwqdmdrgjebpzkwzegzqlzcrvlttvtoi' WindowName: 'oqnfvwyhdtfsmuebrmamnvefnmpwtiogsns'
- ClassName: 'jsgtwblqaudsacgkehjto' WindowName: 'aryfmybfhkkptzktuhsqmdppndxisqdalqirf'
- ClassName: 'uorqsgarzmgvtkguwgvfktjrkruhb' WindowName: 'ejhedkopewwkhdec'
- ClassName: 'ebrtlpcefxwiuensqqbjxfsagpx' WindowName: 'egfqiseyfvuldiiacgaqw'
- ClassName: 'iitlxenbidmgsquxlqghbcyyadmrxucp' WindowName: 'nkkwcthfcjmqejjif'
- ClassName: 'wtofcxufwnnitzdtsc' WindowName: 'ioxwshqhwkapmaklkiwtapmepkfeovs'
- ClassName: 'jdrdqvcuqvwgetuhxyyfjyubkbmjeptsmxazh' WindowName: 'wckptmgwyduqeyorjuqlxczkhfpf'
- ClassName: 'ooflbxcpjbdrdlnnwxw' WindowName: 'pnzzggwsyktqtpzamqqkikpc'
- ClassName: 'layzqccjxodhovcrhagaytkxgzayiuwdl' WindowName: 'qbjvfuprkmjrfjtesirlsdvaptxmfxoedxdwp'
- ClassName: 'zuwudneidforjsfm' WindowName: 'jkcunoupfxiyqfjwgjvnurxjw'
- ClassName: 'bekuwkxvqmspvmk' WindowName: 'jwicvucyzvlaqrthgfqhribty'
- ClassName: 'yfwtjiabyxcpvcuvegdzlhof' WindowName: 'ptsmcccnprhzjygdvidufkormxeuyxatvmojbtb'
- ClassName: 'bberpmgruiduaynrpbxufkfh' WindowName: 'xezwebojglnlgtrutfqb'
