Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dgyrmuiixokvbxaixuiimcndxpewjgbinefu' WindowName: 'ghdtsqccncaqwkkizpzhnbuatokkgbjiixm'
- ClassName: 'ckgvqdiladblffewlsebxjizck' WindowName: 'weazruzxiopqcdokpiqfposzf'
- ClassName: 'remmfndimttifzrtdqzk' WindowName: 'vhkzzjvgvakrtjplbganwrbg'
- ClassName: 'qzqyvrnxqhbydkmkzm' WindowName: 'mqdjqmbtfdgiophdthokdrdophfbhjbzijjj'
- ClassName: 'vldjnqadavbcabpaeqelourggqcfz' WindowName: 'uqdfbegsfgtqgptukhaxuqqa'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'bbzhwhqrpstmpyilysqgtzh' WindowName: 'kwnqxgofaurmmtvejdhjcjmrvv'
- ClassName: 'pkairlyingvsqsnrokefzxrmdmlcot' WindowName: 'tqxgelbgynvirebodvoio'
- ClassName: 'latdygyqoqllvjlxywodcdwgpfuq' WindowName: 'zzuxzgrteqdgtlyihtavzcnwzgi'
- ClassName: 'fkbcrxlekkambjvokdzs' WindowName: 'gtrxypdtkitgjtxlpz'
- ClassName: 'tjgfgnjxjmaatvrixivxytcfvqcoxzetcqac' WindowName: 'pkxxlsrlmnmhuqla'
- ClassName: 'bjxbyszfnlcganyzmtsqcjejvr' WindowName: 'wrzpkhjtlqggtns'
- ClassName: 'licwutnpoobcgyrr' WindowName: 'djnqjjxshepyqzmjlokaabgpierzukvbfoai'
- ClassName: 'nsodcyflrmdxnflrvbsp' WindowName: 'gnmxcuudrfmvwcwfiu'
- ClassName: 'ogzwjzhbddwzcbtcevwbxoqeyjvycpomlzl' WindowName: 'cqggggsqpkgeyobnpbgjgaqpcsw'
- ClassName: 'zzvdfplaopoecah' WindowName: 'mrcgzpwibcuvejhizj'
- ClassName: 'gsajadsucelrccxovduzwseawtrpxhmmwmsf' WindowName: 'szhgmsbgahykjrwcvnlnebosgp'
- ClassName: 'hvhadwxstrfmfmkcmayzdbjkevnfyz' WindowName: 'kkwiduursyxeglfpmjadttdm'
- ClassName: 'igaadvxtfewynvmebi' WindowName: 'efhajmgavszmpvqvilduwltrbyezuhrz'
- ClassName: 'djgdvfjiqmbxbsim' WindowName: 'yzrkyljqveveavunnaszblkxedczjrlgott'
- ClassName: 'ffqynembehylbdagotscslzltiwhcdoz' WindowName: 'dtwbonufdvurfsfamqomsoszzcpg'
- ClassName: 'wjxfyszfwzgetjdyuyibcvylxdajrxj' WindowName: 'wqpkkjjzogaaqsnpi'
- ClassName: 'vlqahnszlxlsixgnkfljesmx' WindowName: 'htjdspddtegwygzunnddgtbcagfehuqekbpk'
- ClassName: 'bsabwwkgrctsvbzctpmaarafpwdhbsvmy' WindowName: 'smtxlrjdhvfgdxphqptndoqar'
- ClassName: 'rhaggbzogampevhqgsgmkewuvotvaakqw' WindowName: 'jhtnhfqbepswttncf'
- ClassName: 'xicnxrvqyrudroeajp' WindowName: 'rmyaryjhbggpvreomgzhynrmoq'
- ClassName: 'zcnfvfwqcjvaxyizciottqlbslesatkjrlneq' WindowName: 'gfhzzyrffggcqmbkj'
- ClassName: 'gntrpvfovkfsndznofvwfk' WindowName: 'hipvvxgtsqxatimutarbekqsetzyfxncugmj'
- ClassName: 'rovkdbffbqvpvoedutk' WindowName: 'eagxhyomfndsruklp'
- ClassName: 'jznczdtqahckbutvdsgynbzdi' WindowName: 'sfvvzxpasebthrxtpgorkanxnemer'
- ClassName: 'ueyxmygejoewnycphzjujrxedwbxvvweim' WindowName: 'ohmvllelfbqlitfeacrwpktdlsnqdacwpfnn'
- ClassName: 'bbjisbpnsskhtnvxqagqvld' WindowName: 'urpkbmyhrwuvblwfbisbktchokve'
- ClassName: 'gvgadfksipoyisrvzpimolijhxpdmpgscn' WindowName: 'lfzjnseqolscxcvvmbtuwanjxsym'
- ClassName: 'odhrspdmgfucvumupgxannxlpvkiwfopooxuy' WindowName: 'xymngrpkwtcrjppnbomwvsncbxvbvazirm'
- ClassName: 'ptllowvtqhhdkxivruvphzkxurmiehmzad' WindowName: 'ynhvpppzarpmvhfoztxvdxckndsveqq'
- ClassName: 'oufxrtwrmzwbjipfaj' WindowName: 'ahqlkpgwjztpvwrduljhm'
- ClassName: 'ehixsiinoqwgkacoctbnokjjxhwtatbuzt' WindowName: 'fogrvkjysxzbqztmgstqimgy'
- ClassName: 'ajrsrblzxbzsfcihjdmxpylqzretdeejqtm' WindowName: 'pjjpcedbwrrqyvskplyhppgpixgkxrhewxwpa'
- ClassName: 'nudbdrxhetloonst' WindowName: 'aykvqvgzgacarpzwzeiqqjjaofq'
- ClassName: 'ukikntkrsgcchhurtgbcbqvs' WindowName: 'nxxkidpyzcwtggsmznzbourbbifb'
- ClassName: 'pouctpbginbnefmhpvjrrvnvdgjxdlpzmasgac' WindowName: 'otfmfhmzthibnmzeypdqkqysnxyfz'
- ClassName: 'wpewjqmntszidxvyumfyqe' WindowName: 'avrglxhnjjdelalfrcotsfbwklsbaiqp'
- ClassName: 'lcjnqsvmlihkuexzcbirrtumtcji' WindowName: 'nnonxrxcqzkbhnaq'
- ClassName: 'sacdzwzqyajuootbuhtfmll' WindowName: 'trxxgflrhuecjabwkpawhdu'
- ClassName: 'xihqhajnzlueuttsivsoqctljjsvnjnv' WindowName: 'wfmdrswtfawytpbahgbmgsqw'
- ClassName: 'zlnlitiruxlyvctdrtmhb' WindowName: 'sjrlsrjdyscrhjm'
