Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'vetmllehrniljjpfpwpxc' WindowName: 'joezvwrklobnyfp'
- ClassName: 'hlbkfidinzndciohhjn' WindowName: 'tbnpnvjhkxzbnypzvlilcjjyhsywnlohkhdy'
- ClassName: 'ndgvjwauvsnrutuhujsrwugx' WindowName: 'iywimheuyxctkndhlpqgpr'
- ClassName: 'geynzljwpnvzkcmgpnpbblnzpryas' WindowName: 'zyxgtpyygzrxbghsffyjaxmoo'
- ClassName: 'rbxklfesgzecwfqlbetmplswceamszjgsjo' WindowName: 'iawbrwseqiwdwlbaceayzmmbxyztycmo'
- ClassName: 'bndhvjedkabeqeqtpmvtyc' WindowName: 'izkmogzkeahwebekcqzsivpns'
- ClassName: 'qyujhaqudvaweil' WindowName: 'zlvuarxgtykpasdnlnojixp'
- ClassName: 'vwmzlljbeasctqcekbognjmackqg' WindowName: 'mbwrfilhycrnvbywbac'
- ClassName: 'dkmtpsblzdstnwlebeajybmdirctkfndskcfdw' WindowName: 'ppedpvlqihenkdhqozl'
- ClassName: 'djiyyvjyzeatnkps' WindowName: 'aslkztwfpjskxdrxfnjhyjtynuf'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'whegncsqubcvyioavqtlgb' WindowName: 'mdiuwkcdeqzjdovjkvkqjhhz'
- ClassName: 'mlbeykltontecmkuaiknszalkafrn' WindowName: 'kozswbjtxywxhphsb'
- ClassName: 'wjobwmisfhdejvkaukikojb' WindowName: 'vtwaysyzgnelzbnktwkgrtf'
- ClassName: 'mnnuxvpehutrmbnqmepmbxdoxym' WindowName: 'nnzvczhnxotdtecybrephzijjvebkm'
- ClassName: 'agtanfiplphiusjywjbfwhmswkhehctf' WindowName: 'iuldiacuithzachiiuweljpfuscqg'
- ClassName: 'eqtiwtewchgmxanqkkfvkzdslfbafg' WindowName: 'xujikkhcuztxperoopsnwnyrvqvuyryoqciisqo'
- ClassName: 'xhenasshqjytisvoxah' WindowName: 'ugqfnunsewempgygvfmsoblznnchnhdm'
- ClassName: 'vcrqwmfsrouwwwchmbits' WindowName: 'rjfwamwjazrkhgnziloylluqniwzrtxihpbl'
- ClassName: 'ybjbjtiftpnyxiixxojgxcdcgrkfhr' WindowName: 'ilcnqfdlsajzmrhpklww'
- ClassName: 'ynxsfwsdvtqditdgtrlnwza' WindowName: 'ukvymjdnvebogndmzqwmkuhmdjzdzsxtjc'
- ClassName: 'praffirjueyhopexjvbvuuypqbacsjumqq' WindowName: 'rlvrnsvzwgvneavhpspipuw'
- ClassName: 'gkrujnzexgflswsrmvmxdgyamcjfd' WindowName: 'zegmhdswxjcirdhkewpxhfuvqcizhhzdpr'
- ClassName: 'vijkgfukxmtsyemtmilrwhqyqcwaxgbqa' WindowName: 'dfcfgsbcrqvqktckypnzsbtfhmdnlahwjivhqwy'
- ClassName: 'gvukrtuonnmkpqnqvfnpwmuftymhtoam' WindowName: 'ovvxhfkhzxazhxtwdxpmabwuwnsc'
- ClassName: 'ospaxmyrwkncwzrevqmxhyxjxpob' WindowName: 'penylbiqoyzqytninn'
- ClassName: 'ofeixqdkopfswlcxkwqtmqqkhwswtxr' WindowName: 'vgmrjiyvdqlqydbrqoshwpyecictjeeivrhk'
- ClassName: 'feubzmfqpmwlnljgojfctklzyolrkalb' WindowName: 'zwbkchoacjybasizhcxtiacjpuzpcstme'
- ClassName: 'kyxyhdebuekbzrptvcniewv' WindowName: 'ryiawyxibtsmhbuvracv'
- ClassName: 'lrzufbalqvwqrwgmlns' WindowName: 'gvqzqdirtbaooteehz'
- ClassName: 'kdwuthzrvtqhrkuhttkgtlxqkll' WindowName: 'wvodktwtvxgnayabezwgoulfg'
- ClassName: 'jlxqauzwwwwnsmsjhpzvtzzzmpearyjg' WindowName: 'ucmnfdtbwsyjmegm'
- ClassName: 'wutdwpeimrjpurqqopdcupcckqhp' WindowName: 'hdgdvpimghiloldymekraljfdesnwm'
- ClassName: 'ssjdjpakmjvnxuotl' WindowName: 'wovcsgbyymzrfbtszqlwlznkdyz'
- ClassName: 'pmvdzoqwrlsjdwnrrxawlohhlbdahxdxskdu' WindowName: 'akuwauqbnmlarmaxhxmdcl'
- ClassName: 'mptlhflrkkhkuuunhfsnoqqn' WindowName: 'krxiekmtgpcccxoapllulxkaitnptmksd'
- ClassName: 'nhuqwvlteppoumry' WindowName: 'enbnjbwsvevcmoifyxpdsunnvnovxvshxax'
- ClassName: 'jwgnijzijkpocijezfmzui' WindowName: 'tapyjckhmfdirbxofkdcakfrk'
- ClassName: 'rhvjqijbfjthwyqsqojrqcptdzashbihottd' WindowName: 'wkzeblhxqbenvebivwaqvdtrcmwpq'
- ClassName: 'zuhhegbpmwbaymszoiavjfsocgitlfb' WindowName: 'ednaeochsabmgpt'
- ClassName: 'hpoafstlucpmfnomjse' WindowName: 'hlwsujiqtorszroi'
- ClassName: 'qmyncbrxbnstxhrcrgqvrvgjfgobyhg' WindowName: 'uutgxvfpwrvlrwurzuqcknzhblbntabch'
- ClassName: 'doyprgcyhubgiymxepqpnkxkd' WindowName: 'bwmfnxuurrbxaogu'
- ClassName: 'adzqeopepcsdkcrmxxdgxudeeqkpp' WindowName: 'lvcvipsnigfrhehjuiqibonks'
- ClassName: 'sjqwxyeztxyntetowrgqez' WindowName: 'baxzttjcanjoovjunlwtf'
- ClassName: 'vdxuwdikmgiuplgimxzftyoxvewspwhxrvtpvlb' WindowName: 'ixbekaksrtohyqjzasvx'
- ClassName: 'tmaxsvgabvjhdcdyigtfrubumsvnt' WindowName: 'ugvyphzjwaafrbnpsyuathryqmlrwhhuznjjuk'
- ClassName: 'tyneeubtbyoenksghrioifzkkkvywnqp' WindowName: 'yvfjhlgcvmlusiabparcbtxpzbutkuhyovrmwt'
- ClassName: 'ozsoyfwlnlssvxnfmmkrhzfqbkxscwdwylghru' WindowName: 'ashdkcqbgmetzoytinognwukjj'
