Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsa2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\Math.dll
- %TEMP%\nsa2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'qdurxgqmisevvperzdnhwwgkbctbnvyepmkv' WindowName: 'lmsxcbkyyiwtxrijucjmxuoz'
- ClassName: 'kqdybkcdsbzewofd' WindowName: 'qviszbbqaquhmvbthdootgpgsiajd'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'besuoktmstabfhjcbye' WindowName: 'mehpjriicjebkidmjusozbfuorpzyh'
- ClassName: 'urgxruevtyrcfrnfdrgowyxpelolqlgsg' WindowName: 'fxgxrvzmjzuvhcjyamolapdxzen'
- ClassName: 'uuqkxkmyyimqlwvuvlrunnvusowwglatz' WindowName: 'vvdjmibazkfqrftqlreqguzfyrbjqh'
- ClassName: 'rjypcznwtyhkfkjaqbcgd' WindowName: 'pkkmciuidvwxjdrp'
- ClassName: 'iiqgnkkchgpmnhryecbayn' WindowName: 'fbalwuginbdckkilsltxwfvxxfdkmouovef'
- ClassName: 'dfolslilbujektqyvinfgebzw' WindowName: 'aghhqufhqgjupdtn'
- ClassName: 'ocdjhgblboxukvthnfrwdhfeqnjfbaehgejitja' WindowName: 'xyvgfgrzdxpvajbrbwphlnyuvezzzjrijz'
- ClassName: 'trnqkleqyrrlxdnysuviexdecirqhvgloktpzl' WindowName: 'tqojdnghttzmnvvgahgljgsq'
- ClassName: 'gzcodscfnrqhukor' WindowName: 'irszbwwomuquvjfyqjlmqnjvjyepgd'
- ClassName: 'zstmiikdayglbaxgenzihliendqyewjyhzikkou' WindowName: 'tsomuwjnkhwspavrljfcklmrjwkckqomhrdn'
- ClassName: 'oapzwnbbpknzunyftsunxdqryuywurabynoton' WindowName: 'egpqyniiseswxeqwfbnxfjkgybufp'
- ClassName: 'sgvggaqzglcprlrudnzjctscsjgkchktfco' WindowName: 'tmxqlrzmjlbcglbxtsswjlmli'
- ClassName: 'lfpyxsuugrpbbugnpltgmwadhhtfayhmmfr' WindowName: 'uepshpbjjveizesfmghrxjo'
- ClassName: 'eouhxmxpklzcgolqf' WindowName: 'dyegslnrripumrtzhoqdtkavqbjkuqaxlve'
- ClassName: 'yoqnlgvqdllvdghhky' WindowName: 'yiicobubfmeyvczoljdthtpvhxrfv'
- ClassName: 'komdyvpazcidbyuqfesm' WindowName: 'fazgdxwxqegnscpxqmsnnpmczjjbfu'
- ClassName: 'oimrbierkuieyjrssax' WindowName: 'hqzcnxeqmshqhcqkuw'
- ClassName: 'ipzeydvqovcghcxgxlnzh' WindowName: 'mvtrzysbbttblaycugf'
- ClassName: 'vsujmwpsdciqzfdjvdtrrdpavfxvvghv' WindowName: 'fylaemndmyggaugogyqlqeskuddelvrpnlbrsx'
- ClassName: 'gdwdbeboeyedqyeubyyz' WindowName: 'lpjzdkpxkkjxphyfo'
- ClassName: 'jfatvmnugctuhmhrxvsfqgggqojmdvbcv' WindowName: 'lwejgwbxxhfkhqtveepcovfdnqsfej'
- ClassName: 'bmlkhmhpjtaavsxjxvibnc' WindowName: 'xoqtaxitsysoxwqsbfqdmqf'
- ClassName: 'gizglptvlsqkjvqowmpnkuontifggzqlwqn' WindowName: 'pyxjpbxpwyiukcvcca'
- ClassName: 'iskgwuurxtzyovlgptkcvlzww' WindowName: 'fqftqrzypcalwfxsm'
- ClassName: 'oieyruibgutlplpfuffqwarpegslxumo' WindowName: 'keqctsqzbbmsakhlxox'
- ClassName: 'wzgtuldgzuoayhhkipgf' WindowName: 'sbopzjhkqvaylosxkbgofpydhtaan'
- ClassName: 'kvgnbkntqolxzwelnoxlifmffuavbmyrjklcd' WindowName: 'omxkeoskydlfiszvfjqlpddzrhihuu'
- ClassName: 'kbbcmvdorkkrskpvr' WindowName: 'mfjcsprvdlxtqwjmlhcwxyzoxfngohx'
- ClassName: 'urkcviskvvgphwoiwlnes' WindowName: 'fprrvfduidwkrrwvisgprhcjarfzjqcc'
- ClassName: 'axtveeopwudnwbphelb' WindowName: 'jvesjkrffmdwpin'
- ClassName: 'msajmgyrzxaimroqkmdbrozzrft' WindowName: 'vjoddpfhitmfwstgktviukdjlycpkykaccwt'
- ClassName: 'btqicrqrwkwkmkqbukmxqdlbmlgoffhj' WindowName: 'jdxtajvhrkilweuzuhmjvpspwukduprywda'
- ClassName: 'zxprddhridvczgwifns' WindowName: 'cdppvmtvfovazqveiuxzgqvfjw'
- ClassName: 'ubjwhsbefkowbsvekymrlirobsqhxahmqimin' WindowName: 'pacosrdhbklfqpvwroysvhpkvlmvikqkfvlwzs'
- ClassName: 'ampyzlwlrmveuxngrhzwnbwwrpqlogkvmc' WindowName: 'ovpbcwofghifmpjobtxi'
- ClassName: 'nhurbtyqhoexxahudgyaelktcpszkgukuxtgyz' WindowName: 'pobleqccomahezjctzicijqwigupoxfguwzbjfw'
- ClassName: 'nxsjdlfhdmwdkzlzyuwmwngoavgisqznhcs' WindowName: 'zpdmeddsgbplveje'
- ClassName: 'xzetvklbwasmadezpinevjrkxht' WindowName: 'oosdtidtfutchvwabwmqynisofrwjmi'
- ClassName: 'dltubltkjowgonduqeobdxhjvipj' WindowName: 'odedekcbkqyemglmjgcmsqfmakkhwz'
- ClassName: 'ntneadhllgjmealqjqngpkxgm' WindowName: 'rzmjfzpwkrcguphwtcwfwvvl'
- ClassName: 'bjavbbypqpbpzkuywgdpzidr' WindowName: 'cflwfsiixcujjvyqdlap'
- ClassName: 'xxlonuqghknkpmzfnt' WindowName: 'mjynfupjzcxebxmygkzhpzzmfyxq'
- ClassName: 'uxotifciebbmwhg' WindowName: 'wlqzwpkpgjahliixqgxvmzdhhepnvcbm'
- ClassName: 'knoerlfksgwaktguymdqjwogefhgcm' WindowName: 'rwirovwrojdnppvxblpitvhoehvc'
- ClassName: 'paxhothpqdizqmcrgixl' WindowName: 'dnvezirdtlstrbqxqcfodeiiowqxcfrysxjrtkk'
- ClassName: 'qpekiqkyhdavirz' WindowName: 'wmdgzykqvfgjtclaokeiheyoub'
