Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jnefqdraaxitczpiluhqrlodjexc' WindowName: 'juorghvsxcmxwbd'
- ClassName: 'tvlyrwwiknewwvjvqpzibhxgqfrqjwvouybwt' WindowName: 'eultqvhxdolopqvrljywrikhv'
- ClassName: 'yxozvyezzpbtkkczrghuplpnlzzszgf' WindowName: 'ogmjpgidpsoghggoiuwdmrnrmcbdpbhwvxjw'
- ClassName: 'sssxglamqsxyzbmvdckanpkpjcf' WindowName: 'trdhnucgfwlflniwiyxmcuypppcf'
- ClassName: 'rjtwxpksfibtxdoklaovjdthvurhqx' WindowName: 'unlgeimjehlpralcbpllqpffnsdffznsatq'
- ClassName: 'eckltcjmenvlukwjnvvnjhsmnm' WindowName: 'nrbsfduguozhltxmvqhyamcev'
- ClassName: 'uwwsbqrwqcxwvmpsluyvlmvakzutkimdpxicbu' WindowName: 'ppcspizsztholympevwgycz'
- ClassName: 'melksywojaarafajtskhes' WindowName: 'kfhiithbumzanfvckzadfjgaetwhqdoppreoa'
- ClassName: 'sqppnyywblvcxudaltrxkdd' WindowName: 'qvumfejnkvbevmhnbsjjhoscaieeqz'
- ClassName: 'dptlpvbhbirlxsrovjdmwcuvkfxxfhmkhrsgu' WindowName: 'ccelubazzkfwbxaevoubvawdfgxnctcrclysm'
- ClassName: 'qsivsgyxakbuhwennl' WindowName: 'hfhdrdemxjwriroxgpokgteydssxgoxxuv'
- ClassName: 'dzeibrypacibtmgdaqbr' WindowName: 'uajmwdtikqreptzygxtulgbawnnnedeurl'
- ClassName: 'zjazxvlfgbnbzjerrsyposxyejczkkupjorlh' WindowName: 'lfigvfevddgcipykmflyovsp'
- ClassName: 'gdwhcfoilfprzbygnfqqqzalyqcewiagz' WindowName: 'nvmptlzujhyqbdsucxcfglzdycvlnbcszpagj'
- ClassName: 'hqcmpnktffbkhqowcgamfyxtnxcpgryepzq' WindowName: 'cttamtskhjjtmoclcj'
- ClassName: 'tbecsdffenpacfehfobjtjbomkgvmfzlnaaguz' WindowName: 'dvsodntmisneetfqetybzaavfjijud'
- ClassName: 'uzithzaehepwsflhxksurfvstaeohjufyjf' WindowName: 'ffdssidyktoopojjskievvmmliktktsq'
- ClassName: 'uiuqlwfzkrrxvuvpumywbo' WindowName: 'afzqfyomzokipks'
- ClassName: 'niuuuufykcncosesxpaspy' WindowName: 'zppzvifjfowhdxuswuuvpsonjld'
- ClassName: 'iszcczccivncpajmnylfpdqykfkfkazoqjhckdx' WindowName: 'qwozrvoxedrxfrhseqnfqzz'
- ClassName: 'ibhgmqjuhxbleawbgesyqkjwinvwvwfvpxbwtr' WindowName: 'ipaacsylgfgtvzodorjgrzxaybnmcp'
- ClassName: 'yxpxlzliwlamdtzcaojmbvucfgtdjh' WindowName: 'ednujnloiypyvdmddqzhjcfocmslywvqmsn'
- ClassName: 'sxsclczvgmyxsmasapwnznhs' WindowName: 'irdjvpyxakmncyrec'
- ClassName: 'adigadhrvihlzrx' WindowName: 'epxawyhztkzplrtfhll'
- ClassName: 'jrxpyvjvwjhqzouieudwwzphr' WindowName: 'uodssddfvvmcirkjdlaztppvdudwlwqbe'
- ClassName: 'ixsjlnuawvfnfuktbe' WindowName: 'sljcstdtrfzlyll'
- ClassName: 'jtienksssikyoksasioncmah' WindowName: 'tryhshicjwigflxvivbetuny'
- ClassName: 'pttcncjknkfmhtphtblperuqbjpsvozxcoyj' WindowName: 'kyqnmuixiouutfyzuzzpnxswhel'
- ClassName: 'jjnhpjflfkllfvslu' WindowName: 'lkklarqsqoeuswbqeoffikjaa'
- ClassName: 'xhywfzimvinpouyzgyt' WindowName: 'tmkcfojwjptjledoudenmpcbyfdflzqynlwvj'
- ClassName: 'fdywzonuudepbrmbbtrstxsgcydjo' WindowName: 'oegtemehzsfhexyxudiuokzxaxwipvrn'
- ClassName: 'lyuulrlwwiuokzahdndgkzliofirsk' WindowName: 'dvikvgwtwfdjzntmgolvzmofzvxdjebhivypuf'
- ClassName: 'pdhnupynpzvcwlsozbmvvhbknqzlqduvyev' WindowName: 'tpeiipytaexlcxlslofeh'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'vdhziltapuhhchuwxr' WindowName: 'kvcprjyryqzwithgc'
- ClassName: 'kiektikdqdnbmcpirgetguy' WindowName: 'flzhscvbvtwishmobvlfdrtxfy'
- ClassName: 'ibchflnxrvjwgpjhxzhjdggpahrgu' WindowName: 'zjrfmezmdvliaovtttiilqpimq'
- ClassName: 'lgzutltaoxaywbibngmzmhkpwicysrhyupoh' WindowName: 'idkhgomlvkmrfrexzcikicrjyucboyjme'
- ClassName: 'tpckzcqclhpdbgemu' WindowName: 'jyfmpdyghglnnpxzopcgjqgzonxmjdavbtervxy'
- ClassName: 'rzgylgxksjhcfyfcvklphgrdvwsytjggiooq' WindowName: 'ffdqurhvfbrthylxpqyikghyytyviwczbt'
- ClassName: 'nqtyxlnivvtofvztnswhvuhoehhjbjqloaqabm' WindowName: 'cpdndzwsdzbdidvygkkpnzrktxayi'
- ClassName: 'velhzqqpjmjesqrhsvmqmzvsphbm' WindowName: 'akbtnvnpjvtwxnjaziegbebudoccj'
- ClassName: 'cmucnbyiftihkuckatdxkgzqxfrs' WindowName: 'oxuipiccpwnfepxsoznvyccfagxohcaedig'
- ClassName: 'isnanggzekzikpwjtnlarulnbqkrswqcijxky' WindowName: 'xwepsqokdodhaclqgorgnczebmdlhghjahvnfku'
- ClassName: 'krjcjosduoocezyuzfjkitu' WindowName: 'wpvsbppywezptgoc'
- ClassName: 'psyzwbknzcoivsaborqoqhec' WindowName: 'ewwqnpulncclmvoxwtp'
- ClassName: 'vnanidnufiqsgvin' WindowName: 'ahuvzwkghfrghynynymvvxtpmltpy'
- ClassName: 'evttsdxenlxswfh' WindowName: 'giclcjapjhuttgi'
- ClassName: 'qtibhitgtmabmxfutwzq' WindowName: 'ulgvsetnmimxivffnljokcgcmaohz'
- ClassName: 'bzkibthcmwaycwrfcgyvpv' WindowName: 'vhtlqiiplbrfwrdsvkc'
- ClassName: 'flnhtbmdljqcjumjelypxmvxnfsbamrizvr' WindowName: 'jwkqdyinqjmzswaowfwhkecfsuzpfhdh'
- ClassName: 'gpyrxbbyotrzldgnznztpfbsyxkogfucvac' WindowName: 'wwvftbldlznsbduvcchofqkpvprq'
- ClassName: 'vgiflxtcthyqfudrogggcqygvyazxbyuhwgcb' WindowName: 'kzxsztpgaiyvdmwl'
- ClassName: 'kxcrmyhfwbsvoljmmws' WindowName: 'yjnuxvekeqzcmhwhsaqewfkwkus'
- ClassName: 'qtbxfuadufannevuq' WindowName: 'dmavxbaclqsgqeqzbpxjqc'
- ClassName: 'wuoyocidgfijaqdeytmq' WindowName: 'nvfevmbuermipiwzqqhj'
- ClassName: 'dwypixznfgxqcesbczlmsau' WindowName: 'oftjzpgjdjapovcvwwcxpmool'
- ClassName: 'pphuvdqcxkhfqupic' WindowName: 'gwllbriwbxoxrtgfiobqgvtjcpbgqvfcexz'
- ClassName: 'qbynimyvlswpadwekfzevxjvn' WindowName: 'jhoghpprbdnaccsfyzk'
- ClassName: 'omonkjussfkydlhqeyxxzjaecdhkupjomid' WindowName: 'tggvqojjnbxcpxairqhdawzzjekmiiinqbkhi'
- ClassName: 'lcudazezzfyoxrohdleblgjsulobzietahygc' WindowName: 'hqxaydipcqixbltmzbyqpbmlm'
- ClassName: 'yjneiuzjnnkxzzevnqblpkrtfjsbwqvrzcf' WindowName: 'pvxsokrblofsntgvzqpmqsuqilc'
- ClassName: 'rqohypcgjdovcuuucfmdsoujewibq' WindowName: 'rfdyrxcyjevcpiawy'
- ClassName: 'jhtixkujjydzwiwwsoa' WindowName: 'brbyouyithojqaajepritybikgudfgydkuuxprf'
- ClassName: 'erlvuhajutetsyacbzkmlulktspypdpsrvweat' WindowName: 'jhgughmnqlmbpntkipmwdhg'
- ClassName: 'lswhmbcvuyyjhsawkwxrelbggwmryenfmrx' WindowName: 'pwstsgdavblrnachneuxiytjdvldsvaepm'
- ClassName: 'usnsvqrzzfhhvfos' WindowName: 'huhknamahuuacwzxuypih'
