Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsr2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'rvinmrdsonyhfjn' WindowName: 'xjvkmpqcdvvlmhmszfowvzojqcq'
- ClassName: 'npnlkoiqkmjctoafjvas' WindowName: 'inwzpcpidkamawfplauih'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'kbekksmmuqvntvxyxhzthm' WindowName: 'sxthiihcryiooacvjkmghgvjlhigpru'
- ClassName: 'zfvqrnjvrrbjpkgfor' WindowName: 'ibfrwwezwfyrlsfjzryepgifxnmdsdkoyxuiqu'
- ClassName: 'ttlprxndhyyhhfkajdtzt' WindowName: 'mfufulgpryophahhxgw'
- ClassName: 'musfnhxzakcejhqbghyq' WindowName: 'ndsfjshruwhjgrnypou'
- ClassName: 'jzrmehnplnfbtdqjpnnp' WindowName: 'mjfdydicjdacxuzfwfxitdkfugat'
- ClassName: 'kpjlbghxvbnrcteybmrriiqczlpnxbqjblpyqmy' WindowName: 'gyuozdwhiqmadothn'
- ClassName: 'vhrdyvsyqugnvbqwvmyjcungvitmcitq' WindowName: 'ivenfncxqraqopbtewsgioopooswb'
- ClassName: 'pjtkyfsdxtkygpqlikmygnaokivktgbles' WindowName: 'hcofoenwhbduklqlksbh'
- ClassName: 'hwgtdcyvximqdduxsqezxba' WindowName: 'zcnvkyplifsfdixkbdktarfvtdqpixxkkdbfby'
- ClassName: 'xuiaspajerhhnnqxqoobtusqrgmnaxsok' WindowName: 'fymjgciubfxbhctouxfvfpgpibdx'
- ClassName: 'xsvinxovicsavrlbfmjw' WindowName: 'veyaqgrtgfzgjnaplibl'
- ClassName: 'pqbufsorsrescqi' WindowName: 'kdxeqzvnmaigmfbqautglr'
- ClassName: 'vgdtatapglwkccsosxuopdqlgs' WindowName: 'aygazgmkysbqnhymb'
- ClassName: 'bwsrtsadkejedcyyrqdmviemxhqxwdaxc' WindowName: 'pancnvdvnlwtirzpkjyopwphszipmbhnzpkio'
- ClassName: 'wcrnjnrvawbdasvdrubaefndauzkdjrluf' WindowName: 'epdjsycugzcqpvukswhk'
- ClassName: 'phvzdszqayrcmasnbuslt' WindowName: 'ponphgstgfjrmhayxy'
- ClassName: 'tnnwieouorpcqrfngldilufstrsofnsrs' WindowName: 'vwcjweakjybhucuargnevtlikwjycorqe'
- ClassName: 'mbthvxcwoqbyrtaxhx' WindowName: 'vjjawbbareyidutaafzwnoeais'
- ClassName: 'xwhrjrwxqajcnroelmduwvrlyevjipluowhku' WindowName: 'phokkbigsrbluai'
- ClassName: 'xedgkbnoormovynftlxdzztaoi' WindowName: 'ehbldcliyhapxbxddodxzjzncahehptpeixucel'
- ClassName: 'bnhuzzwxekihxzduuzsycsqvacmsplr' WindowName: 'mdeqpmprlhoatotzremsoik'
- ClassName: 'wvbzrkomyvoamfykjphnxgyz' WindowName: 'bwatzbjiywwjpcabipzel'
- ClassName: 'jfslcbudtgrtbtwyc' WindowName: 'aedijbnftkktipyisuugxvhuinrxhyhxci'
- ClassName: 'zdoolahrjfdfcttcmphcqzgjzojad' WindowName: 'zfqrdleyzzyixyntwmzuvjptughsnhuvup'
- ClassName: 'lasjweftwwqivayxyfqyw' WindowName: 'sedkdqsjwerfkemocvtwaxnkaylvpfmxfc'
- ClassName: 'tqlgckycfrberyuzxhxf' WindowName: 'bezhtjjasevgvzcaxowfzjkvy'
- ClassName: 'chupxuyekxtupqpqdgtiqmulkjtrh' WindowName: 'tzsbnfwgabxcjmvu'
- ClassName: 'kjdlsrtpebspnixtspecduewmpmnkcmevsnqsp' WindowName: 'yavxffozsuyckhmsqjjsqeykz'
- ClassName: 'hhsdnygsjemolus' WindowName: 'vnegsaknlcddlgqffljsam'
- ClassName: 'vukfrrrdjhqmtbnzifs' WindowName: 'jwbeyczmerggrdpcfvfnjoghryxxujhmxc'
- ClassName: 'xcgvcgetlzxfuxmqnbvn' WindowName: 'nwraibxnmuulwvjjanqzwlzcnlgcduzufayl'
- ClassName: 'ovkqhijstsodyhljiweixakjptquijbaicotwou' WindowName: 'byviatufzodggqdcqbiiwgpqsuujwr'
- ClassName: 'ykcgijhvkdvxwkmjeyurpxollt' WindowName: 'qaggfmpxdpzrrwb'
- ClassName: 'flmnaxodjkybvnttkuvznwmyg' WindowName: 'wwvhrszzumzwvuce'
- ClassName: 'aovopynhmuntitwmzloyue' WindowName: 'mrkywoqgkoyyrnysrzkqlmxoqhpgddndsgww'
- ClassName: 'bmsujxfdmejjxioxkh' WindowName: 'qhftritradsfulrcrbm'
- ClassName: 'rgnmmybfariwjboqwrsxvvmrbyxazpzuitjx' WindowName: 'vrzynqatfyhreosukimyxvxmsfwp'
- ClassName: 'gpcrzmccezzyoefxvxdqctbr' WindowName: 'zxvalbptsrlxoguvrtxhdhhdbfgjqavtbl'
- ClassName: 'zybgyzpqabhuityxbahmhcrinrmk' WindowName: 'ylfdtbovhddwtfsmnfbddgofmk'
- ClassName: 'jdoxhdsuwzwuiqleu' WindowName: 'exxcvylssrbwcxcivbvxqrwugnj'
- ClassName: 'prddmzqxfgafanoqoptfhz' WindowName: 'jkvfzhvjggtmdholglckgql'
- ClassName: 'lpooqmsuzxiqlzgnywspcprkopnu' WindowName: 'cgiqlphxjajcykncwjsdoyarsbjxitomtc'
- ClassName: 'qsxxsjljsjqmrjwbu' WindowName: 'ywotckjwxieuvdugptdnj'
- ClassName: 'ouhizhdrdlwpowfglhnghpljhtzanab' WindowName: 'hcktwdhtzpltxbmozeqvygbjmypkuzsmeqq'
