Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bsxgpqipglaazhuzyeusizaoe' WindowName: 'oqnoxtanltanydqdubli'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'mtzwaamgngtojnyiubtlysbm' WindowName: 'bvxthfkhztzcgjg'
- ClassName: 'zqrsfbbyifyzwdmkrnyyvathmvnjnsleubwd' WindowName: 'rzyfqkwqzjuvzdceehyspd'
- ClassName: 'nlichznqdgpgygjybwj' WindowName: 'itwhvltchtvzrxvynp'
- ClassName: 'qctwhraxaianuuix' WindowName: 'jfnnujdyzpcqoagzkz'
- ClassName: 'vbxzjhowdqfffskvqdzzhzmstaerfuwn' WindowName: 'gnvervdvjjhwyegdjuexcvhnydwqiqriorabtm'
- ClassName: 'vlidtmofwofrthfkmqjhxdfvjnawe' WindowName: 'lwoujhteoihgnujbllyhzkxuyr'
- ClassName: 'uywjcfszdvzgrgteuimhghzagzpdujbekof' WindowName: 'nssicaddgkkaymmcrihasrwyzsytivenhpol'
- ClassName: 'mteaxfgiqwsfozjfbqnfhtsryrnssf' WindowName: 'uepmmqoyuqgllikiblfwoosxmzcsxrpyqm'
- ClassName: 'jahohmbonhbceebxxwgnzqcvmxrwdaxdyqfljz' WindowName: 'qswkrtyrytnxhcsnzu'
- ClassName: 'zjhcpjanzqcptaiwmr' WindowName: 'awrvgdixdjrgnniioqozim'
- ClassName: 'enuuisdbcpeczfwqzgjvqsosnmu' WindowName: 'ywqykcbwrkokksyngkvwtzdmp'
- ClassName: 'iopdjjevylkimbtkatgkkuaghgydhg' WindowName: 'hmoovrgyoypmjdaxho'
- ClassName: 'hbugzcyhtreknqqnlidywlxveeaywllrjprcoe' WindowName: 'uaqddhxmlmhiorrlgmwbqnaoyhrovxwb'
- ClassName: 'aykklnualgsmfhajmr' WindowName: 'hooplpmipogekszugqeyt'
- ClassName: 'zblfjpwfgzlcfvmvzbsvzaeuejkilbgmssxyn' WindowName: 'naxyxaopyjxkwzmvmekqyoimrpcqppmr'
- ClassName: 'oalarioczawmxhl' WindowName: 'aknsqdgrgkilxhdql'
- ClassName: 'qpoaywxcowgtnnywsjmpaudjgcouyors' WindowName: 'qjwrjntjjovrullzic'
- ClassName: 'izgmmflujgadvxzluyqocameekelubrilqn' WindowName: 'tfnrdxkxaerhvvcshysawdvklbnpjyeoplcjq'
- ClassName: 'vzjvjkwkvlyozbwtrvhsohhozggateh' WindowName: 'xesxyndlffmluehimdjidlfbpzszlg'
- ClassName: 'kmjlowdfhihbqewqhmvvvyqznazcwo' WindowName: 'hajkrkbtkqgfgocokipdcowndabixozp'
- ClassName: 'yjxvfpjopnuuzhbbrbo' WindowName: 'mmsivxipvbhnnketktuocsxqxgwhntfnsjc'
- ClassName: 'jjmordwgirgzvflnrzhpvktptnyvhfki' WindowName: 'cxgwmwsybdcirdbgrfnpuzuf'
- ClassName: 'bblvllcgrcijzykpjxarskiyjiixnoabdhgrioy' WindowName: 'uvbbsikenvmxvyqxmajarbtwuw'
- ClassName: 'vxoacdwuyvahkcaigvhngwmizfykhqrqwjml' WindowName: 'chxqatoahaicdbulxqqzdcylejgt'
- ClassName: 'fjtengcokuyjzkpmfuzpxfdnacewsuihagl' WindowName: 'ofvzdcjfeydzsiywaemxzgjjshhlpnomsnri'
- ClassName: 'qeobbjrmehqnwyqwzlkjvj' WindowName: 'ferhzfxodrbcquxdnvbainhlxhh'
- ClassName: 'dklacbfwqghppobpjwgpezmkfqswenaza' WindowName: 'pedvdtztydrwufdfv'
- ClassName: 'jmwqsiekcykzxwmpbgccxgxvxgdehiawziervx' WindowName: 'ticdeobiefetzxzb'
- ClassName: 'ducjdgpkntrrvrzadvzlmuzgzg' WindowName: 'mmqtpnoulcvpftafzthcmiovzqcxy'
- ClassName: 'epswooghaezwgbgvveuuktiafswzjov' WindowName: 'odvbapopoukjqilpkavtga'
- ClassName: 'kcaiyyqkbjumpkc' WindowName: 'txuwbzuvzyigmoogcxelvhso'
- ClassName: 'hrqxmiowlncmzxndgry' WindowName: 'ajsceugqqemvhjosrjyxeilgjzabqmybtexhb'
- ClassName: 'tiaoyycipnwmxlccgxozjpukdifgqztcfps' WindowName: 'wxtmoudwkdlswjnymbmodgpcaxhlhlkncmimc'
- ClassName: 'kcjtbjenaqlgshpfcrsobcnkxmujimrwk' WindowName: 'hhphxcyszeocdqfrkavebkc'
- ClassName: 'pfaxtleetxehdfdoytzhxhluh' WindowName: 'uiyxtnziarhycwadskphib'
- ClassName: 'uujwtobztygsveootcmduhjbcgw' WindowName: 'efzypmjfqalajhhdqxlnvcxjhtkrazjdrre'
- ClassName: 'xswdweojsvhwukkwmbggbnpzucjddlrpbh' WindowName: 'upgezraehlvsakqvgxugrydhhsbsffeuvizzwm'
- ClassName: 'cksysrjmrrltycnedmrerhvpkaq' WindowName: 'mmknstylkkqxxighksrfqtdccpqwglghxnutjqw'
- ClassName: 'mcyysspdaqhskauhoopqcwxg' WindowName: 'tcrcsjjriczgzbyhifiiuwygyspnduk'
- ClassName: 'afqnhbnednaaasaqfgdartqfntjsniefq' WindowName: 'ziibjldugazjmtidvdjgijrcilcwtjyt'
- ClassName: 'xwkbufrnpqpmlayfyvgydxbjuhlosocjgxiqw' WindowName: 'gxowwvnzvpwdwqeanyc'
- ClassName: 'ljpsbfvwbrrnvnmegcbsyjlkhbznjkqhqnuvaxh' WindowName: 'ykwdpotkshzfzlf'
- ClassName: 'bqvhecggnomcrnxdpoaitgolqq' WindowName: 'gndzyubctrelhogbrxpkjrcgqqvqugramfvjfgw'
