Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Desktop\Internet Hao123nknk
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'condxdcgzrkwuykmjitcaqe' WindowName: 'hgfqdmkaafnyvzgpsuw'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'dthzjdthmruakhmbynarfbs' WindowName: 'gdxlmwavcovmypcowdldvsowje'
- ClassName: 'gtqrwpenahrpolptpxteog' WindowName: 'zwqaeadlvdzmqnvdeijsqbxceyot'
- ClassName: 'pmidfezbotlhddxoxkmxnqrpqdirm' WindowName: 'myqnserrnifdxldbrupbkluyblhghwazkzaaos'
- ClassName: 'ucshuxkayophymcdrmvapixtwceg' WindowName: 'xlvzglgyrksdgpavrlcdnzfzdneixd'
- ClassName: 'cpsmtwioqrotvwjuml' WindowName: 'fiywblkxvhplxqauqnzgzkcbq'
- ClassName: 'trlobynvvdubrsxkbnkjnfmbkgnepuqed' WindowName: 'jtwhcesclkzcyytbooepjvwzgveabonzarii'
- ClassName: 'qmyytvejfapqeiavsaqj' WindowName: 'tleszhfgwkvmcptvnsosaciyxflpyasdgytcnlx'
- ClassName: 'wsdrlqpilxrnwhqliadgcbtg' WindowName: 'ctgisvolgfsnsfkhejhllxwhmtiplqfomaktr'
- ClassName: 'jjavwxfgwojoautwlenjzqsnrrclhskqoi' WindowName: 'zyteirzqidgfpccsupydririxujnkv'
- ClassName: 'beagsfbifeuluelqxigjoqa' WindowName: 'byhjdvcirahudddphxknoucoxwufjymoxajvfm'
- ClassName: 'gwwyfuvbpmdwlyhszxlklknibkxdw' WindowName: 'vggaivkuotdgyargowowupea'
- ClassName: 'ujxpdjsgakogktkrtsfezj' WindowName: 'fpvaggriqihbokszrimcgc'
- ClassName: 'fdpomqszwsuwhtqqjdekbxjfkqxtydiypmsxnea' WindowName: 'agxjveahmhzdnnqpcmwsecatrooqoybt'
- ClassName: 'hoeukubaslrqhyuhhosqw' WindowName: 'zwelmtzuajndlbobxuyg'
- ClassName: 'wulhbubjaeqogeahghmsoxlreho' WindowName: 'bvdbgtzckoaljdmunpkwgnk'
- ClassName: 'kamixyywshcwpkvqfonwofkewgd' WindowName: 'jhcxsrzckwtncmfbhduku'
- ClassName: 'ptpfsmutkvfvyvqe' WindowName: 'ydyepbvmvlmhrxbyoupwubcboutyksvgt'
- ClassName: 'xtibnkitqioghetliovoasyduajybwicalf' WindowName: 'wkkudbpvylldgocijgr'
- ClassName: 'mttgsczbkyjjpgkmaiewutfoqfydojrwo' WindowName: 'waxyscyqhntmumpjwkusvbljboenne'
- ClassName: 'ouykvquqxeiqlzjixeozbraulvpoccjwyainvpz' WindowName: 'xtttgcgsmthrzlm'
- ClassName: 'firkohxulykpjfusatc' WindowName: 'bpnzigtmalpaqknbv'
- ClassName: 'njdjyfcyqeaiaruh' WindowName: 'dpnzpdpueoulllleqoiciyiohpannwin'
- ClassName: 'ontmzsqakmffxblhtswd' WindowName: 'ffsiawnbnhedbgwzmisjxafctrzqszsled'
- ClassName: 'wtextuyljebbukcftdfzjhnnefekyl' WindowName: 'dpfwkogptdecsmrzfyiaedoy'
- ClassName: 'qducvoizbcacfcjggtmsbeswrdqcp' WindowName: 'ggyolpyodniaqmme'
- ClassName: 'oqilkqyalghcrfyrhetbj' WindowName: 'ugiqtybhdraevzzjpwgbbfc'
- ClassName: 'gbkdahyifuvxhlkqrhjg' WindowName: 'qhfpjjzsbxzhqallgwshfhaf'
- ClassName: 'vquytpjzdasthvco' WindowName: 'ckmhkralwzejwvsbdvgyga'
- ClassName: 'rqbuuorklrqloqfemzhracasraywtkmcxcaun' WindowName: 'ajssjojbesvgiyxtgkkzyanzhljebdcjajt'
- ClassName: 'wkcfdyqkbrauiqvldtnmrcjakdbjs' WindowName: 'pmierxtrlpcnbtlgqtrruqyckozjc'
- ClassName: 'ffzatijxvjapywpdrxwsknvfzvnggyjkkq' WindowName: 'soeohkqldgrlqlgcdfyzokgkhlcbeaqcs'
- ClassName: 'bmdggkfzdwdfqsmzmiksomdxuwys' WindowName: 'zqyfuhzbssssoybdjuhqnbpimhgjbqokunmr'
- ClassName: 'rrkqxyzufuezirppupcoblpppbcdrxxhnb' WindowName: 'xypdqjtvgeksyrzgbdbexkif'
- ClassName: 'rzghokpopvtcjysnwwdupzvypcukfsmgj' WindowName: 'ehdbvizabjeqvwwjwfgejfrzfbhck'
- ClassName: 'jjxfzzgrskkftqmbc' WindowName: 'ywfownbqvnnkdmeqcwlwgiwms'
- ClassName: 'depxozuneeveyolglzglaoz' WindowName: 'jqdjjigsfuecychejz'
- ClassName: 'jbzqxyrbvregpdfculcwtzhxqecl' WindowName: 'uxwytwativlmymrwqqrflnqdzgharviodnd'
- ClassName: 'rkgbjpjimknyrnfjwaxroxoroapswst' WindowName: 'vamrsulwzdescewcayuhzeuujtldbjrrkccuy'
- ClassName: 'usdielkoaqtqxkwirducb' WindowName: 'qibkrhmbzyelhyrxktx'
- ClassName: 'rbtzotmpmkwfavyjtptqbbrkzlevrkusfl' WindowName: 'ghhjrvzhgkvjjikiisjuiqendjyfilhaxt'
- ClassName: 'zpwuzjveumfkmgimgjirezqanscdfe' WindowName: 'kxqzyssnobhzeuiqvpk'
- ClassName: 'rckgrzlsxjutsudnaathmoc' WindowName: 'dzecgjiqxhyqxhhhlsumvlswvqu'
- ClassName: 'dqzqeccwpuhsgkaogrgzecbrytjnqktl' WindowName: 'lmwewqoqhitsqozvkrfvznxlevytibuzdxzleg'
- ClassName: 'grqfgwghhhozdghzz' WindowName: 'kdjbybtgauvwzvmv'
- ClassName: 'wqqbxxgqkutakyihkyzbdg' WindowName: 'jycpgqrrvnkckqdohtrwzfbv'
- ClassName: 'bcdojaohtyddbapxycukndp' WindowName: 'jwxegryfjygsditwuijjtkwtunrvrtzokfpfm'
