Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Desktop\Internet Hao123nknk
Удаляет следующие файлы:
- <SYSTEM32>\PerfStringBackup.TMP
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ltteurnkqkhmryyuewnsjwfm' WindowName: 'ulbjzblrgnogfrphyjecrmnxkppqqqneghih'
- ClassName: 'vvapigehkipgvlpjfcuiljrtjuhcsobttqlluhe' WindowName: 'gvjmgudxyxlczlfkvofcngqwt'
- ClassName: 'kpixiuvaqtekbwtguysitjfwdpvdksrqqlhnkpz' WindowName: 'nyyfvwzzhifjskzkfjju'
- ClassName: 'clfpqtstgrmtjhsdpouswvixci' WindowName: 'ubglcsnmdqfaalfhgrynkypjixumb'
- ClassName: 'tqseztqewywlcshxhggfjsbltuob' WindowName: 'mapmawemktkgwrgitnrcxfdfzbvlcmguppdr'
- ClassName: 'aidzapwdtxtltceqkumlzggodoylijkyg' WindowName: 'cimzjidhkjqgzddfrrfal'
- ClassName: 'cfpvreqxwjauqngihlvndnsyvhtwawizup' WindowName: 'aflyorweaatqzmmtiihfsggz'
- ClassName: 'qslblbngargdgki' WindowName: 'anmbhfdpaqijwllbpotnqhr'
- ClassName: 'topcvmldfnrzbabyjludpkzmcne' WindowName: 'ssvphptpvdwoorrkwerq'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'hdhvhyphfrbojicgyvpeiyybyuje' WindowName: 'lcijadebfsoexuestzgeuvkkomytxzr'
- ClassName: 'esqbdffdziyegvslntzlsfqxfoxmtz' WindowName: 'gvpphqgynichmaoszwckvvuotxdhfjvr'
- ClassName: 'rgiftyyjlxwrnkrhxbzchpxxqwa' WindowName: 'frhwldkjbslcquvzyduaxecqkiszn'
- ClassName: 'wfzqrcnmagmdkhl' WindowName: 'yyqphmzqmgpbzhuhlydgqyectukytsahc'
- ClassName: 'mpovlymuuvwqspkdg' WindowName: 'rvjsakhjdkghtaftlexprxyzzmx'
- ClassName: 'nvtvhveifeffcqyxoewdhzqslz' WindowName: 'gfmbosycyhvywjqdeubgylptntdmzlgjqyraz'
- ClassName: 'oqeijabgkkjjcju' WindowName: 'qknrdsjcfmjfeoopsbsju'
- ClassName: 'uwriqjphdbpdpgnugmacmarxqpnwvauwb' WindowName: 'dxvmsotlkszdwrlyyhiynn'
- ClassName: 'oxbwfkjdlvfwaddpqlibrjrtpanfjuuqo' WindowName: 'ktqiyzpfwjnqcsggsuzkifeyvjqujcqvobvyxrp'
- ClassName: 'ttxpdsqaghjkypkfbgysapwonguminhgfjbm' WindowName: 'xhywjczbipfcqjrlsdgmdwwydxiib'
- ClassName: 'nhskijafsuzoohlinpvxflbpjoioidiihbpq' WindowName: 'xxpetuqhcxuxhfemxbwlaxkpwmrlyc'
- ClassName: 'fjoleezeqrfxbnxmxpkndfumvyw' WindowName: 'adoosrchtdxecnssnkanw'
- ClassName: 'xqsiszcrvyovgzvwcxomotplmiikshccszjgbo' WindowName: 'vqxmkoscyutqfyqyeidydwbjlyidgloqdn'
- ClassName: 'gsrfaqryjqczcnigjeqzgynpunnyoo' WindowName: 'aiqjtmqostezbgeplggtcdymqz'
- ClassName: 'igoetcxewwejgkmwsuewjcnsfpzvhecu' WindowName: 'vgacctvswdmawgscdfznveganzdoirkggtrdff'
- ClassName: 'kmxhpbsdjjwiasmvhyvibistqsajmi' WindowName: 'jqbkudfcyrdxvifazta'
- ClassName: 'jbungaezpbzxihirmncwzy' WindowName: 'uxunxolupwxddrlkobmzxejtjnuipwibhbvtfb'
- ClassName: 'nebvqqgownurfvvbyenibyflylnox' WindowName: 'ndkubioeqskyzofyepmfnfrqygpouditf'
- ClassName: 'uswjixyqomvpytcaovfjwnbugvaxqkh' WindowName: 'rbljywmcbwtaxwpairzqpalcaybc'
- ClassName: 'rutqqpvwawxxikjan' WindowName: 'knvnfnirhrnuattgyqwkwvkmpuwl'
- ClassName: 'zbtbcwdjsamiibmdz' WindowName: 'fnixfvzfzzuebyvpcfkjwdd'
- ClassName: 'ngmzjyhrvudpwdyses' WindowName: 'ehpaqyumjwkijscdjepbwblwi'
- ClassName: 'kaatpgjzfqndtlnsjbgvktqapxlf' WindowName: 'clhsmpwvsjspfpyvxudwurfpffkeihbo'
- ClassName: 'oxdsakjgtfilxvnpawmw' WindowName: 'pqzzoqyiipgbyuwkbgbgfscpsrzjuhf'
- ClassName: 'vasrpkfbzeqrxxphvgmgljctyhmqbpn' WindowName: 'oxrgvfjkzwrxbwxpsntdmuedgdmmtkyov'
- ClassName: 'naeanzpmycayyimdie' WindowName: 'lvayqxhancinhqwaohtujqyozxptzkg'
- ClassName: 'nriairvjyeotqblssebvhji' WindowName: 'ghhqmmyjysimiybncxwgnmdaohv'
- ClassName: 'qpkpgvveqzrcqtmqzp' WindowName: 'hvvajzmfqpwcofhyyaflzrvhgucxwzfiyklmdxp'
- ClassName: 'tihlrabcjsfthtrvinhucfdoifpwpdo' WindowName: 'bagzzlolhrqkjfwdyckxjwwvllsxpojsy'
