Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Desktop\Internet Hao123nknk
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jukesvlllyvmqhvlwurcfulmnaskcp' WindowName: 'dfanxqtpbfmvknhjlv'
- ClassName: 'qdkbfbpwesinkiroseqogkqgazdkjiqevhxlgao' WindowName: 'tmfkgtuzatsvmlflawteocmgoxdsbosbfy'
- ClassName: 'fmdpwnnmqtinebapalukhfdijopwrsllj' WindowName: 'bxqukencsixerwszrsqvnfbzfupcqdywo'
- ClassName: 'nvqfmofoecptqurblqzcrwdkjpflnfn' WindowName: 'nzitdukllpljuqkdvfaazihtcaeaswsvq'
- ClassName: 'bvdbuhbnmapqggefxcqrjxze' WindowName: 'guegcbymyhtfbigzughsdxl'
- ClassName: 'tgnmeintczkrpbzgsxcnrxoy' WindowName: 'txkssoseoruaakjafuraqdxkjvoeptevt'
- ClassName: 'rcbcmdkaqiwxwegyzcappbn' WindowName: 'hsqkjjboqcuubnvtnnmtexmqfl'
- ClassName: 'fyuguyzexwffyzhlpshsuhhn' WindowName: 'oiiovsxutgkbeszbslztjllgrdzgdhmse'
- ClassName: 'tdhxnkpxvlkvklozccyakqicx' WindowName: 'bjoezujdakvcdrlrdc'
- ClassName: 'sntrfkcyttmtznsagomstbfucutfsknhhh' WindowName: 'nnseqsyyzckdokeskmofaveckkelbsnsbtth'
- ClassName: 'htdxqojdebhwgzqdyymmkcmqhou' WindowName: 'uxffdbzgelcgahnrmqyrfujbcc'
- ClassName: 'ivxhwgvtyftdsviqgjxttnutc' WindowName: 'aqgfgdotnsyhigrptroyaypmlkh'
- ClassName: 'wrdqtbtcseqoguhlgplfhadkuhicfkyoeha' WindowName: 'ipfbzckzjvqfmiubm'
- ClassName: 'lbisxqwhknnkibwbqdwheeytyyrwfkvcmeqcu' WindowName: 'dyhrfhuksmiahwawkshm'
- ClassName: 'ynizgquqkfwgxqsivexzfmjdangkosytfzzzb' WindowName: 'xjnbxolujauzxzhzvnpcwnmmeaquwowguf'
- ClassName: 'echtdjfphnhqziwredopavxowvh' WindowName: 'uncgnkosgpdjkhtacgijamvykswboehjmyd'
- ClassName: 'tcufbkuthcvttzmtqpupil' WindowName: 'nrwopgrljajoykvxovdryhuevooerwqqsmziegy'
- ClassName: 'iijuixzntrzjzylwkyjptmgemmrmpscyalfbm' WindowName: 'ejeouarmmatijesqhozuamzig'
- ClassName: 'cnpmpedcxqexnrfzty' WindowName: 'yxihqohaywfovkvvtnuuxjopbeinqinqtebxnu'
- ClassName: 'rkdffmbfbpknqqxnjjymuyk' WindowName: 'kxaootomhgaucrnrrwushclmpscmn'
- ClassName: 'axljocyvnhnpmdhzeyxpxcfzbvpir' WindowName: 'tabznitdmjfuqzthevrjvdzlvzpk'
- ClassName: 'tvzvqiafgzitqbmxikyqc' WindowName: 'codjqhksalssgqvmxbxhavzvszczhopwe'
- ClassName: 'govllwlldbyzjbqdcobuzfybozeudjin' WindowName: 'nthqvwbfhrwaxykrwlsnyathbuoqg'
- ClassName: 'dnyapewbkypbzuwlzorrklpxqwosuqkn' WindowName: 'dhtelzhccbazyzyyqlepqfvehxghyxpxdnlrp'
- ClassName: 'kvtzvcqbmnhtktvkpchumxezrduhtnjlzy' WindowName: 'lwisdbuagufjggbkvulhhhtgdjchlnpcu'
- ClassName: 'stcinwgzxpojqosikuhicgl' WindowName: 'qcasdvgcjaldgnvbsfg'
- ClassName: 'khaofxebxhtfzzxtzzqhhzdnihbespt' WindowName: 'pxiqcmeygjyliqlgfe'
- ClassName: 'hufjnywbslfgpbujluturmckzasjnoeuyqokzh' WindowName: 'kxqmtdhdezxcgacpimofficdfajbguvsu'
- ClassName: 'ugileszvwoyjmzlmolmfawqrffixudh' WindowName: 'uchugdfobidhbekgsdflumlsu'
- ClassName: 'qltbcxfnblkryyjuxaqpjykhejzqddapyfqh' WindowName: 'bikkuhabjeevtiraa'
- ClassName: 'syzevuuzjvutpjdobcar' WindowName: 'ttbpnvaayeeecgjvvpeoeeemyrawjgbhlxxvf'
- ClassName: 'wizmakcrcfxcdxgtlwxvrfyawqcnzdqwdyrbeqq' WindowName: 'vlrrypwcqzzclmqrannvpkwujlbiuurvy'
- ClassName: 'vovyvdvbtxbfgzeauoy' WindowName: 'ourjsimyjqlfbmbwa'
- ClassName: 'zttkylbxxhmvyuhxnvzxgme' WindowName: 'dlkuvphexfnynippua'
- ClassName: 'nnwsihyleobtfwmwrihijgahlpmbbc' WindowName: 'tvfbjrryzuunusvdrkppqyemapgddpmoqtagn'
- ClassName: 'lbekixwprpxsjfhdywulbblsl' WindowName: 'ydrjaxsjxtsvqgkwrshbanjqrkieuiwrw'
- ClassName: 'vgidtdusldmfuts' WindowName: 'ivjagicpxcvfkjrtzuqtxz'
- ClassName: 'rexhbicnrpvnpofawtlkpmhpvemmqkgdmvyya' WindowName: 'aucwkzehgivvmcvuzlabkivfj'
- ClassName: 'aojehpvboublacjqonrdlpezagveixv' WindowName: 'scywbmcvbuihtbbcfmpysgiv'
- ClassName: 'kghebdjgsejushwckzjeqyyuyculmghxma' WindowName: 'ovqwooivisgoqwsnpktehmcxlprwk'
- ClassName: 'fhspbhtjfciimbut' WindowName: 'kbkswwptcppkgbygja'
- ClassName: 'hymtvhmntlbbythwmruscjynmcewhwsrbyod' WindowName: 'cddzpwxcobujwlru'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ldeiesmzbwxmnjpurgbcwm' WindowName: 'nuytiwrbvnukqidnapogcfukfesmylceueuqkir'
- ClassName: 'eioaknmlviqqdvfc' WindowName: 'dokkakrxquiphqueud'
- ClassName: 'gtnntjdltsyiegximcqvcpjxqstyyptuszyod' WindowName: 'dcrszbrsdmlcbegunmcyspnf'
- ClassName: 'nfllrnqtecganep' WindowName: 'fondiyiutbhdzoivp'
- ClassName: 'usldbxvvgyedaebnvjfmfdulmjjmagybjbghou' WindowName: 'ybzwkeirtagiviionkqwqsxovbtemu'
- ClassName: 'dvafsxutwfbsochqjfdyozzydnlkkjnhjybod' WindowName: 'akcnbdlbbgpsryfvsb'
- ClassName: 'oqgbgvgusanzogwuywhcinqwwxkmsbrs' WindowName: 'xssibchcrealraplwvxy'
- ClassName: 'jzsgkwqgawpxvyvjcynem' WindowName: 'qozbhgtvqkulzzatilaiacoashczeanigaq'
- ClassName: 'qceumvmjllbrlndjgmzqqfuzfyhx' WindowName: 'dzfefrsnckbhhwpuikkrsojhaa'
- ClassName: 'qfxsixtgfjztenujkltfjsmvpxnyv' WindowName: 'qwbpymnzeebuiigdjpnlue'
- ClassName: 'hwaihoqpovpcuyppybwgflvrgqs' WindowName: 'yjwwpmbgibhrhydcrxjoznelpacyjsespsmortg'
- ClassName: 'istdwytzcnsazidy' WindowName: 'yiqnbnmyetlbxhm'
- ClassName: 'xnogdcckjflsjczuwprsichbpthk' WindowName: 'mgcmvatcgdpbhidlmmxuekywtqkhiqny'
