Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'fuojlygcetbcttzseofkf' WindowName: 'ydugrcmcbrvsexpfrjbuxdelmsezluqtxc'
- ClassName: 'ydncmoghbdlwnwsezafvkgcwy' WindowName: 'ttejhcvdecmxyqspqdgybdnzvb'
- ClassName: 'woizddhcaeuyetbbpmskodcteucszpd' WindowName: 'gsgmvsfeumykmoyzevcaugxdljsojd'
- ClassName: 'khabfhjwrgfkybhzmrzzuqacdjahlkdxj' WindowName: 'ccepybwbdrpuspjhaequsfeuoplkqemsoxgir'
- ClassName: 'vuidgqkgnxjgixxo' WindowName: 'gfnvjscpthugxxsgkawwasbjesupafwjwim'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'bktkuelmuqugiijrjhioqhhnvcablukrmh' WindowName: 'klwiwwxlcdhjekhjvguxlqwnex'
- ClassName: 'obkguiwdzqekiaahtwxbfeublghuqirz' WindowName: 'rvqcfisegdqyttlbhoookdyzhvweyiovwq'
- ClassName: 'zelbwuwjhwjpinrag' WindowName: 'andqvgbpcmlyduhlssqhivtmef'
- ClassName: 'vkywpbzxztgvgcft' WindowName: 'fyrmwcxrbtayqzcppbomapvjhmcbsujjgnbfbp'
- ClassName: 'vmkuhxsdqcwegkjuvejgcnvorwnk' WindowName: 'mjtywhkdaitzsrd'
- ClassName: 'fgdjuqaoexzebvqqtznergvmigzvpyycpgplj' WindowName: 'kynpdjlclthewxrvfibtysjxftuzwamsgffimt'
- ClassName: 'vsjvghgiigwqlhbunoputshhtpoqdmczw' WindowName: 'zpmrzzyquwzyoaotikqimdriwfxdji'
- ClassName: 'njrdwwelthndpnyfohhizudpwdivfci' WindowName: 'bkrwirniyoudjjdlfartguzgryrb'
- ClassName: 'rfrhgrvzenvjzrwfglzqlwc' WindowName: 'rgmudwnflginflyukk'
- ClassName: 'zahwcarfwokocwajgvrvr' WindowName: 'fbsupviqtgyejgakalrntuenzyc'
- ClassName: 'glvjuwhczsclekcfdrrkzowalgplfmbjqy' WindowName: 'gxsjkepkocqojiwrmureogpguzejwttxz'
- ClassName: 'yajnzuygwrymregtfagvsuxyfirzkerhzsqvdal' WindowName: 'jehjqupnfyrfczjptqbmfzpsnpslpjaym'
- ClassName: 'uvjonrhkvjrodfsdrlcggonkgpz' WindowName: 'cionnkdcdkfdkkvzvvumxnjgmyvqfqakfziqvm'
- ClassName: 'unzpbuwnmvvzqzxzwgslgjhykslplozmcw' WindowName: 'xrtjzhksbobmatwesxzauolnjkkupe'
- ClassName: 'hhdpyocxfwsmofqpibqrxar' WindowName: 'ozbtdpfudztghnqhw'
- ClassName: 'ndkxddzslamglhcuqd' WindowName: 'hasvfeweeftlyulegufyyesqyr'
- ClassName: 'dibhgxdxfhhrdyrkomkhzaqwkdqdtgdgqd' WindowName: 'munafzebcukwrbwsjwqidwycotwwhnnojsmqv'
- ClassName: 'updbnyyjanoewpiafsexowfmd' WindowName: 'ywcktjupaifamojvnqqqpbcvnddgee'
- ClassName: 'agilpcaeylfazlmwfatbielsmtgvtjmjute' WindowName: 'ocdnqfxawqkmvucrlasvkwsdgcgzwpm'
- ClassName: 'lzhypvbitrihnfjcybw' WindowName: 'kfvepzbtjkzbjukiupmbuphpxyifnmjl'
- ClassName: 'hhevooopmleerqszwciojakvsftlpxhcmyz' WindowName: 'ptlhbpuephkledyyzolmefmnu'
- ClassName: 'ptvqtaxvbojvssopdypiqdbghkdifnkbc' WindowName: 'mjrxfpccbwmyiiytv'
- ClassName: 'hgcdgopuajskrhjttlaibqbsnteclsyvevsw' WindowName: 'zjyugupwdnwbwbkyxz'
- ClassName: 'gchxbbetsmdlazgviotwohvqupga' WindowName: 'ksynswkypuucvhx'
- ClassName: 'ecrfpkzoeqgefugpbaqxzphmqfvdnmedgdilhn' WindowName: 'bhlbdoelvbfsnqqfwngcdu'
- ClassName: 'gvrsttpbhnwjwcsydqwvtajbrnysaxwstw' WindowName: 'gbxzbjwmlzfojnlodwnqr'
- ClassName: 'bjsxaytytrlqahglfyqadqsvgev' WindowName: 'xdhahsgzudjhyrznjtqxdjmvqvre'
- ClassName: 'erljqhdruwmfozpzeaxlt' WindowName: 'gezublcvlpdbpacncasrhutkdvekyyuvjoll'
- ClassName: 'cmclhtahazrataxhcampnfywxtyrbxzqsefsrt' WindowName: 'dpseyhfvciqgdwckmljksfgugqt'
- ClassName: 'wjkqlvsxzbbsqscxtemumytzfhqcobqjex' WindowName: 'jsvqdpoigmxryhkzwxdctasoi'
- ClassName: 'wxyqravxifthgnxkmlagpvqkf' WindowName: 'iehyadtgekabpwhnhykwqvwdmgme'
- ClassName: 'wsunfqdweiwdaspbosztiadoum' WindowName: 'hqyzghcozclvkebzemkuivvqhwu'
- ClassName: 'fctusffiydojdwyjgm' WindowName: 'qqkneqwgdujhrzfkchpxmehvm'
- ClassName: 'plnumxhzxvewogpmrfjfowmglsleveued' WindowName: 'kxzfytrvnjvortvynnvxpflxdflzqgxtwo'
- ClassName: 'ojghmcrdbyllinq' WindowName: 'iwnnhsznimlhmvvj'
- ClassName: 'cgrmccijotezsikiobynszcfwyrgqnymame' WindowName: 'dbaihmcpfdssomliequcxdvnmeyxfsqakaocljx'
- ClassName: 'hxzuxazufvkszhwrgfqtyuubjstwmg' WindowName: 'knxoosrzigpghjeidinbxwnuxlhdstsu'
- ClassName: 'lndvjmmyehfwmlhbprm' WindowName: 'imsrhelxpyfqmqkhskmkixanbv'
- ClassName: 'ujsvezgyzfwxjkw' WindowName: 'vpbtnhkbmrtgkswhdqztpamsbjpu'
