Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xlxgcjhhaqrbovpqmyzfqxcu' WindowName: 'kucaydhfkmeebkapjgyqjlnrxopxcmonmzfn'
- ClassName: 'riyknkzrzscenmljszweoqdhhiajc' WindowName: 'otjpnowllzzkxzls'
- ClassName: 'tczagipxlcnougyqqekrmwe' WindowName: 'jmmtjabeeozrlnfsirzuqqj'
- ClassName: 'qxgjfhfidqsmjtaajdzgcmynmv' WindowName: 'ailoabhyaunacfyuqtmt'
- ClassName: 'oqbxpptjvettgzhy' WindowName: 'ofentmrdgrctofoaekazwuxnpg'
- ClassName: 'anrayxfzisxnvbshdqoalpzquwinvcwelhwt' WindowName: 'kpajeadbmjjcquvlvg'
- ClassName: 'kcmffpxbyeisywikiamwpthecmkdpqk' WindowName: 'bwhjusyjgwgjdugubutugypxgybieyrygstfsm'
- ClassName: 'vikahjiqjfdpzwalitdhweohi' WindowName: 'qboulykuhbdbywejmfagrtmurfa'
- ClassName: 'fkmrnxuwcdlsbhpkfljklqlpzfuu' WindowName: 'sveuktrkijldggjs'
- ClassName: 'drvuvoztbnpyvjqvgz' WindowName: 'cnupmligjsdnazfzsrxiztltrdvtnmeioisdpf'
- ClassName: 'vuumqtwnribpmqlfftquncwcfiwqna' WindowName: 'rwlervyzggqvkzaswi'
- ClassName: 'ulnpolifitqwosnhsmujuvnqcqyivjzncu' WindowName: 'iaziikjixiepqoogdvpgzknqlbyvbal'
- ClassName: 'ubywucanvkigjdtsrmdamryaorbjsgitvij' WindowName: 'vunqcybiodvqmxrjjqyhzppthnbzrjh'
- ClassName: 'qivxqqozbhmyhohle' WindowName: 'kmygwhptnfnxpkijgcpnszgdftzhldqat'
- ClassName: 'lzpqwcarlfhjxxupfrduyxzpqzhrqwbxb' WindowName: 'vqnbudnikxmkmlmopgc'
- ClassName: 'sjvuerbyfoubwekerflrkwuktg' WindowName: 'jnslzqxemhtqgnmctebhjfnunskevveycxxiq'
- ClassName: 'nsyvbjeolesjbzqgpkaadcpafjreh' WindowName: 'egnuvckzyaooccrxwhaajnkhbfi'
- ClassName: 'nrklazquacxxtynkmcdjkxrhmlub' WindowName: 'aobnlmmwbpjojkljpvng'
- ClassName: 'spexshnichkldyycqojumooqyhlrnfjqg' WindowName: 'rzliodffbznrhlqdmqspy'
- ClassName: 'uqougfrkqahgbbadspqgfvhldldv' WindowName: 'vzqxmdmiyllaeebrjqshpxlrntplqnk'
- ClassName: 'inqmbechlyvlrvsbamlatcldjqbvifeu' WindowName: 'dghylgxhdzureokeoclsaartmeliximknt'
- ClassName: 'sxgdnguhtzwmynybqvppoirhjmgatkcmieobsc' WindowName: 'kjgehqswdoqcxpa'
- ClassName: 'ieptunneveyqqnfoisbvip' WindowName: 'lnqcmixiloqrktpnqklss'
- ClassName: 'njzgxylcpberghjuovjxbsktwuhrrdrjvjsohmu' WindowName: 'cbbckynsilvezxbrtzxinjfrbyqexyk'
- ClassName: 'yzezabkscaukrhsuglmqtludajcbmovqgmnqq' WindowName: 'jfguosfrqrvykdwehkqpsrbtu'
- ClassName: 'valnetzwqbhfobstb' WindowName: 'abctjkztusfuodzitzhdpvivieguuvus'
- ClassName: 'whmckyfoscvvfyjgpbawhjjscuqkicnwbpjljwh' WindowName: 'thzagstbdpxdjrzattpf'
- ClassName: 'emzyyhpxfhrnmhxiqvvqrtfyprskilwramywt' WindowName: 'qrbnjvwsaidkoitqzmwraikmynxum'
- ClassName: 'cmkxdxrlipvupzxpelwttgkmuzpbnuryynp' WindowName: 'artafgcppclgzvfsbpygwqfmvamgs'
- ClassName: 'zkaojxgqtvhsxiuzscunxdekmtlznccsojnbbk' WindowName: 'lbfodkhrgdxdzowyrolzuiglflktxcddua'
- ClassName: 'bmkncuvcfeajjwquheglftol' WindowName: 'vckivdwkoezdwcaiymqfjwqxdetq'
- ClassName: 'ifatjfebrunnyuuspmvdg' WindowName: 'znqivugwtbehdvcvhmxefwccaeojs'
- ClassName: 'qqsmkvnnxtpjeklmdhzgmcbpopcgmrv' WindowName: 'zupnpxdaofoyvnrx'
- ClassName: 'gwioqruvkgphahchnfcx' WindowName: 'kyvovyemwdbogxivsyiuppeniqqqy'
- ClassName: 'ytnvtozovpybmkzenkpfniwbcqsohmbmhx' WindowName: 'qiorvcutbfuktznyzlybemmasmtnfpmbq'
- ClassName: 'nltzkjeizskbteqfnrmnme' WindowName: 'gxojcfumtmguobhoouwy'
- ClassName: 'esnrtchmspakxmgwt' WindowName: 'mdekelxmosceiuaqawulqqfaki'
- ClassName: 'qesmesceeqyslprqiwnkn' WindowName: 'xqkqknttxcwnunjjdtpzxnppjsvan'
- ClassName: 'ohadiudwajbpivi' WindowName: 'rnebvxonwrhwnhqxstuvqsmem'
- ClassName: 'uadnqkpcebyfvnm' WindowName: 'hkqaryqwphajynisjentwp'
- ClassName: 'rmneoiloqwgormlciuimsmaqrqvamdmfbrbr' WindowName: 'ztmfgmcmohxfvzdxificpiugspkg'
- ClassName: 'ylkxtrloinmzaktfrcgrrwmlygtcecj' WindowName: 'plahztbbfmyciwkhvp'
- ClassName: 'bmnonhrfbaqskzblkwlcwavcppkirzubmipf' WindowName: 'ojhkzyzohcxopkbpirghbjxelnvkbvlwnx'
- ClassName: 'dgvosmijwjntzemfvzvyehaxxkzmrzwdgfw' WindowName: 'semhxstlqaznnflndrv'
- ClassName: 'bfyiuwhuzjgnjithmzspqc' WindowName: 'ycobmixgjrogimwykcrx'
- ClassName: 'nvtqknupitzipdtdwecotwvuysysllwuk' WindowName: 'bnjehlbummkrbtozquyummh'
- ClassName: 'sirsvzpaqufvudvcrffgjoqfnkxpjvyk' WindowName: 'hjeuyvedokdeqmeafp'
- ClassName: 'lwpcuixoekavobsjszzka' WindowName: 'yiacoybcsyiihsllcv'
- ClassName: 'qgxsvoeshtdczvacmuvwsxrtlab' WindowName: 'tymzeembypygebmyvifwx'
- ClassName: 'frpgajsjycvxxnv' WindowName: 'trkjbiiorwszsdbbhmvmvk'
- ClassName: 'dyopdtxruyqyvtnqysdma' WindowName: 'ktcnmgecawjezpupqowbklabhss'
- ClassName: 'aktxtdqcgqttikzfhrfioxynlvwngdttmswxt' WindowName: 'jaevpiptbxpvyaziqsaqesixadfmogbmmjmncqe'
- ClassName: 'rhrqhakxnxncfvimnpsssvlljbsnqizud' WindowName: 'lnoxixmmhqoydrywumodrekokvilg'
- ClassName: 'imqrptwgnvryxnrvqvqwpreeftufdinrc' WindowName: 'rwypzixyoudrvhxfffvpgiekolftkzt'
- ClassName: 'loqghhafjevwipcylczakkebhjstuakwjn' WindowName: 'scwkciqnzatrjdcdxtigprdovxvgoyhymvb'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'luibvigjaoqmsnpgojiowxiqflafjfxdwvfybyq' WindowName: 'eadvfkuggwobxrvrjhbwewdmci'
- ClassName: 'iopmrqxfatcdupifvib' WindowName: 'jyktlrxzhqftrurbindep'
- ClassName: 'gspnatdyiutktglfhpedc' WindowName: 'cmcshowuxtfexkcnl'
- ClassName: 'svhvfirijnortiylftimwutvcwizm' WindowName: 'rpbumnyoneqjskav'
- ClassName: 'eodvvoqprbzzldaqjxwyoadxcinecopmck' WindowName: 'oyhbcirflphldofqecwtdeffdogpcwkxnig'
- ClassName: 'pdcjsntpbtljlxkprzwarjlnmdrdix' WindowName: 'blongpqrncohqbablhsozoumaulgczrelbxjgq'
- ClassName: 'rgmduvnivmjggkgcgighehphwfkuxaupulfo' WindowName: 'cvcbsnyrgzbbfaulsgatbdqvsinwt'
- ClassName: 'xitdohremmdfhjpik' WindowName: 'tynqaqcpgapftmpvm'
- ClassName: 'osgpfsacisjpnxeuhynlgghipizuafhlqucmwxu' WindowName: 'ujpgusycfeyxvxa'
- ClassName: 'bgkjkxuvbgbicxiltxfcly' WindowName: 'mhtstywbbyhszqyoye'
