Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'wdupfcjwqsvpyqe' WindowName: 'gnmtvryahuxirnfqjtkpagxk'
- ClassName: 'jguyjkcyzdxedubzrlbhcyahovrelybaknpxwd' WindowName: 'akgyusuekkcpudctnhytruwfs'
- ClassName: 'rulenuyzlehllgrpqevijumyhfvsiruun' WindowName: 'plkiepsrmblibmbdsyzixwpzx'
- ClassName: 'ckjultywgjkdhybn' WindowName: 'gzwcyuvbocuvccubfeohxihsoqwzbjiyiie'
- ClassName: 'vzivwwgwctumoipuf' WindowName: 'bzvjufeboaxqdtzzvzqvmghbrexthlmuvlwjo'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ienmahkuqcdjnvifjwjcping' WindowName: 'sndagsvcwflnyoshvbspr'
- ClassName: 'tbpsuqkwtzndhwtzrk' WindowName: 'xzcyvifjfmcxhna'
- ClassName: 'ahekugfmjfnboaliyxilleyax' WindowName: 'ugiqyrghxxlhyizyuaiyy'
- ClassName: 'vgmcqeqbtowrmkejsmlzupbdhurzaxc' WindowName: 'ugwyoeqlafvizhmrzadorrtmpypar'
- ClassName: 'uepkcpzcurezayzrogow' WindowName: 'grnynmkrfkupudnmxpqjcdgd'
- ClassName: 'ajfekokniskpbebzhxbxqcqbrzmeermcjwnzi' WindowName: 'qzfuvxrtpcmwhwvr'
- ClassName: 'spsfatthgetyhpskskyijeqd' WindowName: 'sxfpszzoierlkrdpyoupntmg'
- ClassName: 'bovnqlelupwatppahtrh' WindowName: 'qwzvkzgsjgxxswbtgoyeycjzxybrs'
- ClassName: 'xflefofqlxksvkgfvuitlpjqdn' WindowName: 'ezrqpkgegfycpxprpteajvqflcgjyxvyr'
- ClassName: 'lpbmtbwdibqjhgmlskw' WindowName: 'nszcshplgrcudgcfboagqvk'
- ClassName: 'zvonivsqzvdazvfivoakrgdixbczpi' WindowName: 'wracgssroizesxobxm'
- ClassName: 'lofbjrjtpfowockrsicl' WindowName: 'kelrhelisafnlvccocudlseeqiesznqnnqnzcmo'
- ClassName: 'kiqgkwqktetlwvfybkacwlryl' WindowName: 'ukcfnurnnmclmfxpvgmyvrunnknsqtjwncml'
- ClassName: 'hyuslxyrtglbzswfwkessoolgvigaljrrcibp' WindowName: 'jkzkoogiiddzrfnbzcaknfmzhmqp'
- ClassName: 'bkqjpsbtlcmafdpqehopgqj' WindowName: 'eebqemkrhtouglszaakctokzxbidssvzve'
- ClassName: 'dtrmitjpcktfyntqcsgjqfegggfrnwm' WindowName: 'qnnagzqozldjrguyeahlp'
- ClassName: 'xsphxkjnelyhyhngibnpbapgwnv' WindowName: 'oplhsoyekehifjctfztaek'
- ClassName: 'rzsvzevunlnukicmpvdscniuvp' WindowName: 'cdipjjnfvptcyynenpnxxqfuiutwdrybnuib'
- ClassName: 'dounpzlkyhczulvzxzoywwsuphbotgxqxj' WindowName: 'wwkabvzdlalqyotuswqxxhwoayhb'
- ClassName: 'tnweebycldbvcsabeqgeqrfjf' WindowName: 'qdibmgnunyhvpqxkyrdxfa'
- ClassName: 'grldtcjhmspclimdevwxbuqrbcwgjmayk' WindowName: 'pugybdnuwczzhiqxnlvegskrdemkrwzggdsaems'
- ClassName: 'rjwzqvdzzmtoocbb' WindowName: 'sqfmcguijlmvnrekidqeeybvpxi'
- ClassName: 'ulkwqfhqfxofvdnafsczbc' WindowName: 'olfcsrwtmwrglsyvavwrnyivnxvwrtloetsboh'
- ClassName: 'bfixagmmcvhhzgrchrtkgoxtxupwerwkjpm' WindowName: 'xynyuhbsilbfulceywivfwsb'
- ClassName: 'urxuhzdkehgcypjdfzdycrflwsqyobsy' WindowName: 'ihdswtdzwamxwvwcefyrxeqfynmey'
- ClassName: 'azyvirebpwsznblgkdwjgxlijiiow' WindowName: 'rscacwhkosiqvxrgbxnquslwxxxgy'
- ClassName: 'rvzusgcughlgzrfakldusflfwgcfwhbzvi' WindowName: 'nbwodvzmyogowlyvqmxupjdik'
- ClassName: 'nmmgsfmvlirosqufwzgvfcg' WindowName: 'ucmgsphndnponni'
- ClassName: 'qfppgkddpydxjcnsnuruconoxyhfo' WindowName: 'twhobeccfjlivctrigwmmsrugpewqhozf'
- ClassName: 'uvbcupbixtjuxsekprrxndqffm' WindowName: 'vreudarzrnyfoctvukxibdrwjkmzcpzkow'
- ClassName: 'vmcpwsvseosnnxezroeuxztwor' WindowName: 'lpmgfzkzwqvumztthbkhynwzeehxtyci'
- ClassName: 'hfutvravxtypevuvpfs' WindowName: 'jnyvjshlfumxhdogwewbtxuwhwwrnqynfdfi'
- ClassName: 'suwbmvbpchskzgkgahmhgyn' WindowName: 'cyggtcetnofwgfvnpf'
- ClassName: 'enxffkbrpuhhlhjlikxzttkdbmawwv' WindowName: 'mtbkiennfqlhipxiykppqxuxvsvpvvc'
- ClassName: 'thcjwzqegdihejvccu' WindowName: 'mnxymabmjvvekiqaewbfw'
- ClassName: 'beepvtimdbxxtbbjkfsigklbqbpszbenaej' WindowName: 'qrqlzspibagmazngtiirmvqtocbur'
- ClassName: 'emjttonndbraaiaqd' WindowName: 'iuynpjweaofoujgcmxgd'
- ClassName: 'ehcfbaiprnagtzd' WindowName: 'sthzotnwmhfxldalwxkuxztq'
- ClassName: 'vbotexaubrnxecidfbuigktgaucqzeyqmtwfnq' WindowName: 'mloomrpinqlzpkkuabgrn'
- ClassName: 'xrfaqnsedorezhrkyhwsbrfl' WindowName: 'ppbelbriaoapltouhyypjpcskcbqvlk'
