Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\InetLoad.dll
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- <SYSTEM32>\PerfStringBackup.TMP
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'needyzwuupgwmlxgxjgpdvaetpvzy' WindowName: 'mcmsbmuuczotisg'
- ClassName: 'qxdhohxeyyabolnieqfrgonui' WindowName: 'bjfmwcznkqmqqewwatphukfxgxtpy'
- ClassName: 'syjbmfkissbnsqdrxpnskxcazleu' WindowName: 'vritgpilnrianlirhnyxbspaem'
- ClassName: 'bphjlyrlhuwvkvgcieiatjttuxl' WindowName: 'tdjwouaiogjmlhkizipjdszppkyplhd'
- ClassName: 'bemrtclirvcgucy' WindowName: 'fzeqwosngdqgjxwbjghujxfc'
- ClassName: 'reuatunayykslledyztdovxcfs' WindowName: 'hxckstglyrzbeqjl'
- ClassName: 'jkhitnadoxmfjolpsdjatvh' WindowName: 'oihfdibrjuaqsjgotuhtyadpvqwzdutguqsbixo'
- ClassName: 'ghqmqselurswunqmkjnmuudfssmx' WindowName: 'cyfcvcsicprvdovmlzvbd'
- ClassName: 'fguivexcastezghctcedfpedqau' WindowName: 'mmdvzeaulqkbbtddrfvsofpspitti'
- ClassName: 'bkjtowedfdxrnkmsevnd' WindowName: 'nahmgmrutgzzhgnpghlpue'
- ClassName: 'blthmzoxcbrjruxjesooqcaqxgpnxb' WindowName: 'yyjmjbbufxabinfrsnsitb'
- ClassName: 'aefgzeqxluxmeximnmdctbc' WindowName: 'vqcqmuhwhxlophqj'
- ClassName: 'cukpcxmnhllxvmmkwds' WindowName: 'wsaurybygpzfijjqz'
- ClassName: 'lzhoclpctwsiasteqi' WindowName: 'wdjkfpfcogzqbxhoylhcgohi'
- ClassName: 'qbewnfjrbbetwpigutrgegimt' WindowName: 'vpdqakpgpbgcpnrnsqvgagwtuugvdcpsjxbt'
- ClassName: 'wgiymaoijcmhgisf' WindowName: 'ywrseqlnoahevrjgvrxonjrqdupmegjupsvm'
- ClassName: 'sfkpcmftyxqwxqpkdnb' WindowName: 'luxfmakgokbbtqrf'
- ClassName: 'hnyhqfutcfkfmik' WindowName: 'eplgugdmxdtnlwsb'
- ClassName: 'kvlwplgqjvqsjofsjwzjyvysviwktlxjzynsfr' WindowName: 'xzmscgeirituustyqqfzzlwkw'
- ClassName: 'bpvljzgyeibmfcavetkniukcxwkwwkooskknh' WindowName: 'emeazkmfgxqxdqaymrfkrkmjvij'
- ClassName: 'kbzsonwajkhxjydpwphpx' WindowName: 'fvtvryudifdttqccgdcpoi'
- ClassName: 'oyofuduohovokhxpotdlsyicu' WindowName: 'zgvhpxucernbxjoocrgwgx'
- ClassName: 'lcnwfkglytmrtthrxjrooodugfs' WindowName: 'wvhdekxsqjtlikedljfbxhzgtugrr'
- ClassName: 'zdvblphteaedtstkjvlwknrkvyonaq' WindowName: 'nmzhrksqfjqxusvyyrphtcdtwwf'
- ClassName: 'dywnlogeyarzkzvbsaohhvaiylukqrrforjwuw' WindowName: 'gruarjfnxzszeymfffjobxcdpgcsl'
- ClassName: 'xbxtnvpazqyumcba' WindowName: 'dvvbonggqsqcyodxkesygemczmp'
- ClassName: 'iwpbxibgtdjozmrnsxhjwkcazgz' WindowName: 'abvttifvbhnjyakvjy'
- ClassName: 'zwutzifxenssmxzhumxi' WindowName: 'botlcddgbphbnqrfoiqkwuhcgpodsbdtz'
- ClassName: 'vsgbgyicgdrhupiafeaelqwhuzzygqdw' WindowName: 'ilscaymikqynotfhry'
- ClassName: 'rcihbnzgswaurwztcmovlbcjtpivhtkwrgvz' WindowName: 'pvfefycaxeohufmvwvacuahvwtohxl'
- ClassName: 'irzmupyfpqfjgxrzjie' WindowName: 'jzjfhouqcnfktywu'
- ClassName: 'wzawzhecsbpafsziozsujxgsdl' WindowName: 'djirmeynbwfkjclupdg'
- ClassName: 'fxyfiwqceywktulgpd' WindowName: 'wgjydtjcghnvrnmpgmpzwfrvjwjyogzrvv'
- ClassName: 'sflflzouofszvwcmxs' WindowName: 'grzulfhbyrqloxvdbkmhzsdiypoardkhzabd'
- ClassName: 'ibvmscysijmsmnepkfkuerckejd' WindowName: 'ltvmaywlasiwcjuarxrgpaeu'
- ClassName: 'uvtnhmimggsgpkqjgmhzwjcehfrcjohze' WindowName: 'uwgdpksttylwzamlzrgnosxxfmzizhooknd'
- ClassName: 'xyznptyhvpgrbsfljjamkllqfablvundtdpm' WindowName: 'tignwffivxdhetlgzptv'
- ClassName: 'ctkxoojnshjazoqxueblxh' WindowName: 'ddsveukkjzlzougcjuynnto'
- ClassName: 'sfsxlinvgfgendlphgnkgqwkfgvzbbpkdid' WindowName: 'lwhlransedoykroisqdrsgiz'
- ClassName: 'fuqssrwcjrqhcriwjbceiotlxvtndhzwth' WindowName: 'swrbmeqsvocypuypszfjxotspkbifigvlepk'
- ClassName: 'qmchmecfjttkufeslbkrcd' WindowName: 'ogmsmgokuqpdnpduogoxr'
- ClassName: 'jbabwzxzxlxiwhvtwwvxfylffoq' WindowName: 'kvytoauxhorjghzxghjamvvkcdvw'
- ClassName: 'xbmasyousiidnpuflmpboybgxgxngn' WindowName: 'ufoysgnhnoxbqstwmalovwshowpqruvqdakqhvp'
- ClassName: 'gorqkybczjumbvgtz' WindowName: 'oyjxeqwqblhcwcfhdofveyoovkedrviy'
- ClassName: 'cgghqjqljfswhzewdonkifjzckzaw' WindowName: 'upqrmvrfzuvnzjhuhwzef'
- ClassName: 'pqpwxqphiddsnzzom' WindowName: 'iwamjripougkazvt'
