Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'lfasrygyauabmsk' WindowName: 'sbxrnktkhwiuclmmgtidtqtsgmqp'
- ClassName: 'nkvluygesbzxpabe' WindowName: 'jbpaxuexiaxtermn'
- ClassName: 'esjfpqojvlevvemhwszgrgstxpcjczqelwcov' WindowName: 'eyckttfwzhidnichxucoafektniricotrvgruk'
- ClassName: 'rtfrihlevvkfjeqzpovwglqmufyhvifazwgj' WindowName: 'uivkyvvvzuazpwduxj'
- ClassName: 'oqlaxonwvrwhlexqbppkrwdxaeelzhywcqbluin' WindowName: 'eksowixllylctvdplcokdjqkbpgtqr'
- ClassName: 'xjemiotjqljhiaznlg' WindowName: 'armxjivpxmjzrmxowtwudnrbnbqsjx'
- ClassName: 'ftwhzhaqgdbkbixmekksbzavmylcfiyzqghuq' WindowName: 'orhpwtvuamojavfggibct'
- ClassName: 'xmkgvsvpuzwrkubmrfmajycmasiqpuzdkq' WindowName: 'rmnwgmubpalgoeaivujlypvacklbaqpmlkjrv'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'axqjuaaojbhmcjt' WindowName: 'qgopvmlzuwmtnhjo'
- ClassName: 'pnowaiqoefafotprj' WindowName: 'ubxqoreihulwvuatcpnziptauazhzferaldx'
- ClassName: 'xxcpkxynxjjiyfogsq' WindowName: 'sifeisoxxpyrasyqelpmtosylwpmwseh'
- ClassName: 'yyobsxdzwaphttmrlnpnkpmigltydcgcvrlif' WindowName: 'xhyzqxroaaqcbtakoedqkhenqpis'
- ClassName: 'txedgtbmdbflgvragfsxjwseovobsztg' WindowName: 'gvfzqswbhqgyjrwljgrqhnoozjtqtnroz'
- ClassName: 'ubnzmdezqbcdyoruvso' WindowName: 'jimclsvqbjhgtyexjvdznq'
- ClassName: 'zpctvjedejyjnfuzbmsvbmcqmkpdknhn' WindowName: 'julhuuawqprkemvastjhrvzqtfgbzrlzxcjzdx'
- ClassName: 'wmxucacozzhpdjpimxpedlzmjxltyxjzoonjr' WindowName: 'lsuwrzsqkxxszgqnpdkinyx'
- ClassName: 'vehwzfqgzxmmxddooxdvcjwqtsn' WindowName: 'rbwkiipfykcbwhut'
- ClassName: 'mjlglddvxjzyqvxedppbroilgjjihef' WindowName: 'gafhjqastkrhytrzfkpligbtaquyrk'
- ClassName: 'wqovpbnfzxshimetzqtairiknao' WindowName: 'gvubzcqsmfbueevrvqwzbivpuhwaixrzr'
- ClassName: 'jsktbdeavonvvaxhaerkncyfmmg' WindowName: 'llndseyfwmplsapluwlfecsrztifocbbso'
- ClassName: 'veryeniazuhllknjaj' WindowName: 'pszllfucnyadevshwlybbjcxcq'
- ClassName: 'ajxwgjqesbyasxfooi' WindowName: 'yiqvaheijitidrnqkukpybcxtwycw'
- ClassName: 'stayurhgauxrhzweieriwiap' WindowName: 'wqgnsufslalkbvyvcgxxxqhqweeeyxnwvxy'
- ClassName: 'ualmwdkieulvdjywrnywte' WindowName: 'czkcbetuedninnwjamyzzcjzjjpyvylbbli'
- ClassName: 'ichbjhtpgvnsxsmhfak' WindowName: 'gxestwvuwzdufyastxqjauikva'
- ClassName: 'eqhmtvgzbwpywukqgpszjcrebekkwnpcjckar' WindowName: 'jvvidgmcwtuvsim'
- ClassName: 'ugdouscwtidgerivgznyzwtbkulcr' WindowName: 'vdosezuyaszvvqoscfbdvoj'
- ClassName: 'gmubpuldpaxakudzeepppmjxitfxjfv' WindowName: 'goikshvxyyxguulfuvnyobyhqtojjfuokmw'
- ClassName: 'ucdjmqehdprmjgpvhcabljuxaxggmzwm' WindowName: 'bombcyvvgijxrpdmspuilxcgyiiqiikwf'
- ClassName: 'ktfenqzvqeixrsfadtumrspvqzjknqpsdfuwpt' WindowName: 'dwvszrzpfeqoaqjhljowzuf'
- ClassName: 'xkgacrfihexlhdeimsulownyly' WindowName: 'tkoyctxvcfnockwswjqxywjelxx'
- ClassName: 'sebkhzgqfhpgueaxnsgethebijouuakirvzpuwe' WindowName: 'qsuydytmnxseztzkotgkh'
- ClassName: 'trprboxerxrxdyxrcvstzaknzcsoywvedpuxvyj' WindowName: 'mjebtggyysfoyrbsmgalbjwpmdbhmehdibhm'
- ClassName: 'fkhoxiyzybnaiuysbvqjnvvsbaostegjxvodsq' WindowName: 'rwwyqkmabftjtyydivtctmloh'
- ClassName: 'mspgxennayakjrgjmbx' WindowName: 'wddciefbbgsufdadzzbpdvlxmivv'
- ClassName: 'hojtvvmxposkmlfo' WindowName: 'nwrdnxbcbikocht'
- ClassName: 'uadwgegeapmfwbfjtacygipznzfv' WindowName: 'lfyxmrektyqxrnhfkmihcuakguehzxynmbdajv'
- ClassName: 'lcethjhpjqzsxfjxsvzdaxdjmgdzvb' WindowName: 'vptflcphcdrlcddeegxolwuymdabliu'
- ClassName: 'qtrevmunkwvycryyljmeykifmfunha' WindowName: 'ewplzsgvemzdfrmevhnuhbpy'
- ClassName: 'dtvqmkaizfnbxzhuakrgpolazdcdmjxjwfgsrd' WindowName: 'fijcbizxpyyngnitkjnewcnjqddcvoofy'
- ClassName: 'pqwlrxwlompgyof' WindowName: 'oibojzhkgsxlwlfznchsslozcvztczuvqhuqr'
- ClassName: 'ofrrdvnhnjjuwtvlaussgcnxsovpnw' WindowName: 'jtbprgtghhtxyzosxclpvkcubopez'
- ClassName: 'nzhglpwsgqnwxvtjiqejzkhvzdoyqprzd' WindowName: 'zwhwcyhhsmujxxx'
- ClassName: 'ivanqlsdbdbhcwzp' WindowName: 'minmmweoivdivmkdg'
- ClassName: 'mfmtsvlpyfufhgfrdnj' WindowName: 'jzdkesicsadpgmtvbxmabpnmqsmetkmwwpkyh'
- ClassName: 'dqemqfnkxyodaypkxrhzyesihftglfxdwuakev' WindowName: 'sqirxbyzyukahuorwnpwoozgfxiavrlyfz'
- ClassName: 'doqdrbdimajrwrlzyttrqnatioxdoydkdpxobiq' WindowName: 'jsqfzudencgclicmojboobdgxtcaffdzr'
- ClassName: 'sxjxthogiddrnqchjuinu' WindowName: 'dedbqumroiqwkguhuwljbkrdiwygyhgcrozjd'
- ClassName: 'wnbhmfopyfhdjtxibkl' WindowName: 'ngebubtbowozydtaxnpw'
- ClassName: 'hqtlkhbshvhmdsysfous' WindowName: 'icewifclmkhgnackjsxezzihvcpg'
- ClassName: 'eojlmhxdtpbwgnaqmzpozjibteyswpnke' WindowName: 'bewoncvuwwrmgsq'
- ClassName: 'dvmbvhfnezwbvpsulvf' WindowName: 'eyusgnhhlkonpkhlxlubkchusbmopetgymk'
- ClassName: 'tzjvckzaotawpikejhroopnsxzhlvimpvdvahx' WindowName: 'jnwyenyqrcmyedrfcrupvtryfkfjzfveytqcg'
- ClassName: 'llqxxjziukxfcdtjtjwvgklkvmoak' WindowName: 'txknfjymfxbmqamqpacndhfankpqjygz'
- ClassName: 'hacxmuwhghbwjzuiqecpuhdacxesolavgug' WindowName: 'tjuzvnusgtwfprubyn'
- ClassName: 'jzrfyhgrpqipyzbaox' WindowName: 'lsgqsuyjceglkhgmsytucghij'
- ClassName: 'yzrypkmxfprhubjbxkrskzqjzkutzugne' WindowName: 'uqtsgewpuntcsjwgjva'
- ClassName: 'auekhedlwxtirminclt' WindowName: 'nmmeaktnkopfmnzne'
- ClassName: 'zuxlxskunrunwpzxdjefuuocrwch' WindowName: 'evubpgenreemgxhdhxgmuxpz'
- ClassName: 'wahqczulbpjabrfuotdoaruqhiqa' WindowName: 'tuxzjcyudyfyhfosijqjsajbxwjnr'
- ClassName: 'hwcqglhmbvpishtwd' WindowName: 'rklpmdgynfnmkfpdlbsyaraecnrxyxlcfkldn'
- ClassName: 'fvvpbhggwibjtohezljnrpczvlknxcmsdd' WindowName: 'mvvblbritruoacxdkzmcefwrhdv'
