Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hufpapvczbnuyocfxgurphdoeryctqxhitaijoo' WindowName: 'xorwtgclwwslcscnnufvlarsxyma'
- ClassName: 'zfgujmtihzvdbpemkah' WindowName: 'pjnyawlkgkfipewzvpvixatwrbrjmpargxeq'
- ClassName: 'dqpqhkfmexflnugom' WindowName: 'iininycsybafupg'
- ClassName: 'qflbmvrnejkezcrprvk' WindowName: 'nfhosmxstncmtfbvszvastcstvgjjbrm'
- ClassName: 'anhtfdsihpsixjngbguqomrkulavvw' WindowName: 'qslgqffuutbolgx'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'yyxmslhrjdemaernxuuogftsgaieqnmwmhb' WindowName: 'dkwgjhtzexuuifytrlhdvjaqaurjlyoucjvo'
- ClassName: 'pzokkwnxmpeqgzsfnxaiela' WindowName: 'adyyrefhrcpvpvkxzkajojahgblwviuvwo'
- ClassName: 'ssjlmjnnrehyitfvx' WindowName: 'dgetdorwmmbddqxdtkxu'
- ClassName: 'nfqkmzqdssryludxuvosexxzgscih' WindowName: 'cqhjvlxucrweqzaecsotyw'
- ClassName: 'czgbyoqcutshfebirzitlldqtijhlcu' WindowName: 'igosedoyegxhcievkhujrbz'
- ClassName: 'cknxprzldyszgzujfcduu' WindowName: 'iexdamqupjseivqbjolbweoadfqjsnjlf'
- ClassName: 'szmyqsvhbtxoryamseweyfdcotby' WindowName: 'avicqeihdwgbfikjaxicaae'
- ClassName: 'vfnmwspavrnsxglsflygsx' WindowName: 'rwoegubuioxrexbtwrrjghgqlh'
- ClassName: 'yjvfwaekahlyjqfysdqnxbsxpfobifxau' WindowName: 'vhkalapltezknrjfoiyshxiqnfidx'
- ClassName: 'xhkkycowclcihnadvqsnd' WindowName: 'keqysffzpiivachjsbszbjipxfvkwfsvmigqya'
- ClassName: 'arxubjynnormnpqfyycteyqtuoowepydu' WindowName: 'xailrmwobpbthwpojdqgdziyffysznqaka'
- ClassName: 'oxdlofgiwczbldrmsejwvjk' WindowName: 'ajlhruvnxtrtdxfepcogpmcvdnxcsfchnrumwv'
- ClassName: 'mttbqsgzvduixiwxmzxbjaeoyzizngietr' WindowName: 'ebsofjjpwmzeumhkgfyujzlpgpyksqf'
- ClassName: 'kyalnndkgunnlouvxvnjwpvcnhmnkob' WindowName: 'jdsrpieafzrqyjkjtwprobgyztwg'
- ClassName: 'bqqwwudaragongrsypptzggmjuesuaagmala' WindowName: 'ihwchynbdspowlrwres'
- ClassName: 'mnklptyikxhrqaeifwqcxaynnbaeuzhathg' WindowName: 'stwclwlcprdeqqtvgqpxgfpbyqcsttrfseh'
- ClassName: 'ypvhhjojbxrmcgowjsqufiqyxqwtjljuymrbhpt' WindowName: 'phkkdttfmkdnxwhugvr'
- ClassName: 'wbyajivnzrhugfictw' WindowName: 'mdzbkxheaebazrisvkkdvvvhng'
- ClassName: 'khsqeussweuwmagkraeoocyo' WindowName: 'qpnltqmdjoxuvrbcoofncngaalyym'
- ClassName: 'hpngjymyuocscvuw' WindowName: 'viejxacmbhiycriusqlrwiojijgygmdxwdd'
- ClassName: 'wdtklyuyeobixarvcseuxd' WindowName: 'gfxdukigeaobsoxgcwag'
- ClassName: 'fvskckehlxxlfyejbicacbjjqcsd' WindowName: 'qhehjxrkhcjoaqc'
- ClassName: 'hrhpfeldkbjszlcekmwyfkpmfssdqkzu' WindowName: 'lpzggvyafrsbnpywticntuzdh'
- ClassName: 'nokcvglexmwxtcsahhihxksfwqpbuqh' WindowName: 'rvbeyszqnxynygfgogeyxkavmcyysofycxkdq'
- ClassName: 'nghepsbhbilqagpyraeu' WindowName: 'lfczqaygvxfxgbeevjecabjkbuqty'
- ClassName: 'cyyltcpdzivqcrxhpz' WindowName: 'barmwgvhjprznpqemy'
- ClassName: 'saosqzkgfjkrwzzmskqqdwxwyoif' WindowName: 'zfeunsgypmzzgthbhoevfvedgz'
- ClassName: 'ejxwehkdmhjvtrsvvao' WindowName: 'dslrqcgvtdkftofuevogycyrwohojkizidjzfbt'
- ClassName: 'phaytkyyyimgwivpixcfwneucxpjvroetj' WindowName: 'llozkksstbwxhnerbryfhwxmahrucuqmbtnc'
- ClassName: 'ctmaupsfnkpgxqcdy' WindowName: 'pebekrmrbbszcymflyjokehbaxifsxqxvwfgktl'
- ClassName: 'upddxoupgixkalcy' WindowName: 'wgxhkysrmfnrttvqtt'
- ClassName: 'ygzlamxkbrhipezrbofe' WindowName: 'ohpfmcareznepggisfwdxnw'
- ClassName: 'gimkxzfbdvenqxkrpzcjrfpxtotbgofoatvduxt' WindowName: 'paibcovcndvkdjfwqafo'
- ClassName: 'hcjlhyqszmcvclppjmkxwlmnkpwuimje' WindowName: 'lfofyohvwynryucoufth'
- ClassName: 'moixkqlkpfaetbvpugs' WindowName: 'ppvguczzrxsnbxtmgaqjtr'
- ClassName: 'hduqgmrwqpioejvlghrqdbwqzopgj' WindowName: 'gbuqejzmbqciwemjxojhqtermdjgsaau'
- ClassName: 'rwinkdjjbcixqvuug' WindowName: 'edavjnkzdqskevrmfxyhhkpjjs'
- ClassName: 'ftmrsubuxycidcjprkmbikxt' WindowName: 'fohfbpsbrpjadpheknzvqluesdqahy'
- ClassName: 'lzhqwhxkhrdukswsaykfxgbvnkpcwybqxasl' WindowName: 'wmzdeacvlhxsxjrhcvmjocvckwpxmqzycgpxm'
- ClassName: 'ddcjyhxdjcmapjxtlijfmbvihm' WindowName: 'jllalihdygjfmywbugnidhcbf'
- ClassName: 'xuaehgfpxbccfgoupvvpf' WindowName: 'eoligevwesbmwihsxdhugsmmxromley'
