Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsy2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xhsjkivpcpfbknbgjmqwkx' WindowName: 'zjrhufvtvxxbwljzcsbtaumtxypmspfcjbghkj'
- ClassName: 'jzietvncsaymziumflkkveu' WindowName: 'cxsuzpgqwjgjocwapkdiz'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'dmlhskmngmtgrbcqcwuzkjhmojwtwlzxf' WindowName: 'rwzgirsivaxsdsypugbpdmx'
- ClassName: 'ckrkjktgoypqyxpgobeuaxlwvazhel' WindowName: 'vlcythuxjvczepfeuqfdrzendwb'
- ClassName: 'payjzfbtvdvpqoxkyjfaoartxw' WindowName: 'dvpxcjyvnnqpmhqephcjcmxpyiqj'
- ClassName: 'olmxqreeajecugnzhpgjutffinvwnaubmraemr' WindowName: 'kwrzaqudkbxdhmlqhkhchezkmwtcd'
- ClassName: 'npaqocupvrptcdvnjjrkqzkkygepgmuymkdkrca' WindowName: 'qodnafrezwozprggidyqfnpnjzsy'
- ClassName: 'qgcyvjtrzqkhoogczzsemhbr' WindowName: 'jhyrjqmcywkncbboizdugjev'
- ClassName: 'lmkhbugbxexscpcecupanbavrqeplroloaapvw' WindowName: 'psbbphmhkrbisbgdbiypuvzhb'
- ClassName: 'jyijqstlvudhhafhrvoqkjxe' WindowName: 'wostlucsjuvabqzahduaos'
- ClassName: 'nzyqfjuqmdknznbjczgemelg' WindowName: 'tyuywjuzcxagaqavjuxhmbqzjzdmctiinanpoxs'
- ClassName: 'jcuykbrnbtjqoeafl' WindowName: 'ctdvahdwgywdkhijxnsilulpbrbgnver'
- ClassName: 'dkddzhwxztpsnbjqoxgwra' WindowName: 'ebiqawktqcvgofajulqxesdmfg'
- ClassName: 'wvcagyonovxpyhhghzhjucsl' WindowName: 'pzquwbcztxwxcapepgotecewjpoustkjq'
- ClassName: 'uclyhdqntkqpnzgqpqljgtfkjdbfwjmhij' WindowName: 'gfxxrluuqvdmlngzbozfblk'
- ClassName: 'xpevffifbgwemrpnavevvyoclghbbyublwvkiu' WindowName: 'rumdzuetnistsasubvvnydqcuxiqpwxlatylyi'
- ClassName: 'qxpkmeljboictndnwnkuzrxodzmrrlflr' WindowName: 'aydhjexnapmgvnbqryidhydgjbtcj'
- ClassName: 'iwncytanzqsmhkyocmkxfbjkjqfwkanduwgizhl' WindowName: 'jjcgvjplfddwuuxiyzjm'
- ClassName: 'frehchyilofuhngsmogmnelna' WindowName: 'elvmihcaelocnovdrmwyafxzkwqbgqlfhkwepu'
- ClassName: 'bzrkytadksxjommljydhfvjfwmqhue' WindowName: 'whjwohklkwaevaj'
- ClassName: 'funhojvemkomoskntkybuxt' WindowName: 'lmnjvybvisripebysewvbcsluwqjujh'
- ClassName: 'rfjmpjwltarpvgjjvouk' WindowName: 'vwyxdnbwaucukfax'
- ClassName: 'lvozvnwyvuiffzxdlbkcacgriahzgspcwwfrk' WindowName: 'qzvfzwxsitwfxaj'
- ClassName: 'blxcxairdovyevjylkinigsecsnerxady' WindowName: 'spmzldxjebciwyq'
- ClassName: 'cqtxlfjgetqsehw' WindowName: 'gudrtkfnnftqouxectyrbdyvknxvohvqu'
- ClassName: 'keeuiyhmyouofpbki' WindowName: 'cgwyrqzrpxbzuxdmafijyjigfg'
- ClassName: 'qygduahybhjiefogrdtjqvvqqkva' WindowName: 'pfwvmoggnjelswfo'
- ClassName: 'aejqrbcbwzybxmdsbnnxgdnyecubmeh' WindowName: 'kwveraqumolpzusgmatmrjipa'
- ClassName: 'aunxkmhbjceijzf' WindowName: 'jycppqijhpbbonslu'
- ClassName: 'aijmybqzgfmmxvlyjhyircsrcwgzuideictv' WindowName: 'ycsrfsryeldrhevpirkaoojcqpskjbggpdifl'
- ClassName: 'gahosdmpmacxayikfthtwlxvxcwctvgchs' WindowName: 'fxjifwqlfugdhvjkujwqtbmnfdxl'
- ClassName: 'bgzogeddbspnkbotizxhqnplclhl' WindowName: 'zfpsjccbzmsovocpkjsjpfgwamkmrvfheq'
- ClassName: 'bbrgghejgskoanzybe' WindowName: 'awobzumllbjcxtqyh'
- ClassName: 'oevcxrbzqvbzttgmtvvqawhfxpkgaduzpptt' WindowName: 'hawcinnynrrcpeqrmckmbqollo'
- ClassName: 'vxlcymqengdpbkhvmqkdqslf' WindowName: 'sgavpzvlsjuffgjr'
- ClassName: 'sanwtiptsyboogkng' WindowName: 'vgrbbjfwzuxmnwirczoxlltzqikdwbzmvstivei'
- ClassName: 'lczaiourqacihkxmgfoaztucqix' WindowName: 'blxloqczpuiqmjkqxxxzinsieq'
- ClassName: 'ffcwwxurtuolnznlzcs' WindowName: 'elqsqyvkqbawjwdsokxufonlcyltfism'
- ClassName: 'rbuozcfvzfhelabaw' WindowName: 'aseoniishynzyvzhplgyfjqsbsiulj'
- ClassName: 'rnxhbbabtatqmsnardfnq' WindowName: 'jqyeomnfqtlbiuonpdsoxodyjdqky'
- ClassName: 'spwqtrgjzweuyhwpsmydmbnimdqvxbicsj' WindowName: 'lktighprpmshurm'
- ClassName: 'enzspwaebnatoptyccu' WindowName: 'utfoztgacprxryo'
- ClassName: 'ttpmjjfclhurogm' WindowName: 'swynwecmdrcmvzyzejbkqravimqnfdn'
- ClassName: 'stzcfpoowfyidnmepkszxdgknxnuhuu' WindowName: 'dxpuejkhgsjwuoybxghowwiuyehcekuzbdpxpv'
- ClassName: 'jparthmulursskdyfoooaeiyyrn' WindowName: 'aluvrygseviufsqnugq'
