Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ujegkgxtheysgzjwnqtiwzqghrp' WindowName: 'wsaziikkgyvigsibxokvigtyrdatigvn'
- ClassName: 'ohrtzqgybgeofwx' WindowName: 'wqihkvvqtjntvmmmftle'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'juwktnpapkzalfeekxf' WindowName: 'mycjgxrdcwgqykejkrziwnrqlmmdls'
- ClassName: 'redtrwyrzfhirwnqzzbyqjiqhrcliwto' WindowName: 'oazrllxnawhevxwqhbtzzpgwmfuckxixiwzvsz'
- ClassName: 'jedxrdvbopmfhkwjnndc' WindowName: 'zrvhfpsvacxbvrwyjlwyykjeyl'
- ClassName: 'vcgamrpxaqrkhjtfykgwnpaxtdivzw' WindowName: 'yftskfvxyuicoghiwixakiayetosh'
- ClassName: 'ihbodmloeieraffr' WindowName: 'moxslcljbevymjwjmq'
- ClassName: 'lguxzwqgtbmkzotjlrdjxrsqvqog' WindowName: 'umrmqfgjvdcluatkr'
- ClassName: 'ebjngnqquigasrvorezxsitlbjmbdmwmqgr' WindowName: 'xgtkacxbxbsiijytnxlwmhcrbid'
- ClassName: 'ntqqyouovpbprtpgpeezmnlthbuatx' WindowName: 'mayzguroanufdukcycvxvbukfyiopzmeocesxjy'
- ClassName: 'yvosefnzoeyomkdatitbxwlgzmhlktxkbpuzlk' WindowName: 'kgqhqbbknescrihlyavazpjjnrqyigesvdwzjvg'
- ClassName: 'ohdzzsvgjvzhtxcjimhhtdfzo' WindowName: 'dfcaxthkzymfptynne'
- ClassName: 'lybqyononsyetwzvg' WindowName: 'kxxobdwijlwubxjusadlswm'
- ClassName: 'dbjwachuaazedymwlnu' WindowName: 'mndojfdqvgkrcqmledgnugeweyaglqdngvusbrv'
- ClassName: 'xqnolnwdcdmsoatjwtcynkqchrvkywivkrr' WindowName: 'ntxacdladvqdeylairvmmepanxfxytqeox'
- ClassName: 'vzdhrhtzptkgnjlz' WindowName: 'jnqdupzrvulydbvrajkwcppntncfdjwckcgj'
- ClassName: 'fzjnobonqnaiqquxlwdivwrzybrvlwad' WindowName: 'vdalcqfrizmdsyiltozcfqrdqwqxoyzldkk'
- ClassName: 'wyvpojqncjmupemccje' WindowName: 'enrydnsvvtbxellfxyfillof'
- ClassName: 'kckwxjpgvupeuayytswsyyboaksddpubjgqmhvx' WindowName: 'hdejxkptrlurqdzewnyjz'
- ClassName: 'xcajzvznhunrnuiztqexhikaecbqiwlxoungorw' WindowName: 'eurscbazssqllhwoyxklnmcrowtzpxucqq'
- ClassName: 'vaudxiamdqppchcjkdpxgomyefibrodimwtwb' WindowName: 'jkhmejczbgimoymt'
- ClassName: 'rzdqfnhrahfyobkoexmxjukjumlloybtomk' WindowName: 'bsmlvrljatjvlrdpjccxsauryxalfddnfissyjt'
- ClassName: 'eaiflktpjvxuejmqmddcuuderj' WindowName: 'fxezxxwuypbfyjkksc'
- ClassName: 'fjjgnhhocvupwkwislfwzzd' WindowName: 'vevliazmliyytytajnbsxaowjglnxdznfyqkb'
- ClassName: 'puzbxyibrocplqvjlfrhvknsxdpmo' WindowName: 'bjxazmhfervjocpxcchtoncpnyxaink'
- ClassName: 'xcfoepoqfquzxzeooumksnmb' WindowName: 'bianqucwpjvtmujhwpbbfa'
- ClassName: 'vgcapkekarktulioomnldjlbqlg' WindowName: 'tzeinuivvrtwatqhnthkbrmfsjt'
- ClassName: 'davzcwmemhshrounrydmhhgyl' WindowName: 'wysbyzwbxiipjuqjruavmj'
- ClassName: 'fvzlepxipswswrhkjxcw' WindowName: 'mjqmfkutedkltiqalsnkgmldjncna'
- ClassName: 'naojgcsbvdwpkprvzaedwbrh' WindowName: 'fcjpvbufnsvfslepkzanbs'
- ClassName: 'lbwjcpetbvrxykh' WindowName: 'hfzicqhbxomyyboxpeffytmyiburxhdqw'
- ClassName: 'anafpicgdnxaqqxvo' WindowName: 'oiesafwwxaldpuyonjzkhdiakkiuaxotmiq'
- ClassName: 'rxotinbmjuzsutuvf' WindowName: 'qmjemiugefeknlbfhenagxgsgfdzt'
- ClassName: 'zwaeekrglbhlkguqqlcbkhixguryxsgjzn' WindowName: 'bptqhxauultklwzkvnnl'
- ClassName: 'zwlouyrqupwceduh' WindowName: 'ycfxldarxcncieeiu'
- ClassName: 'oixzxaylpsjnrtf' WindowName: 'amixevokgkqlevlyhgibzeeejpwehzr'
- ClassName: 'hzrtkioshyaidbtnxjirdjpceck' WindowName: 'qlvouzfqapppnoyhlqgbfkkbcfzbgdxozrsepmx'
- ClassName: 'czlcgkdmdsnuvvrlelfubpcumrbsyeqroa' WindowName: 'gwcwcearfctgwbbnxvj'
- ClassName: 'blytthpbynpggsymgpqzurxliwc' WindowName: 'diqmpkjfsryxqwbzp'
- ClassName: 'fpmlmgzepejeozebkhddegelmamms' WindowName: 'ocbshfehcidaanauxuldetgjfhagwenbsfl'
- ClassName: 'qgyllfkqqdqkacospvoni' WindowName: 'gnugutdmixdmqxiitehfym'
- ClassName: 'pjtrykhgmhwovvmvysevomnfl' WindowName: 'uvdqlstklcuzhcjymxh'
- ClassName: 'doqyipwerfeqsmhlewirrvafehsprbeyzf' WindowName: 'infsfuczmjlqfevkqc'
- ClassName: 'qqvqmuqndvujtekzungdwtkhhdp' WindowName: 'obvfcptdcfdtadyzb'
