Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsf2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ecgpipnnvzkxrrezyuyikzxleiqpirmxus' WindowName: 'zpxxzylbtqizozbfbdsbnocnnupeojryluxlfdz'
- ClassName: 'hcogilijprcmeispzvm' WindowName: 'kdfldkigsrhynoksqpkddkvihkfapirchjpikub'
- ClassName: 'jajpqdtkuealtzdklqrlzwcv' WindowName: 'kvtqcwbfsvoxgibumngfqsjsdmuakflol'
- ClassName: 'wgvxuxpqqhzfygysazrlygsuqrfguyvtplsbq' WindowName: 'svkspqctgfaquitdgtgcgjia'
- ClassName: 'dwaizvkqiyfodmsfhzaqfsayehcyekxvehvp' WindowName: 'oqegscawovkesbbatkdchvxcnisxhugjjtw'
- ClassName: 'gpsipdscfqsjmquayplnk' WindowName: 'gsydvouppulzfbxdafukpcytxxapbdt'
- ClassName: 'laburfywtwsqwckehlsvmylsnyekvs' WindowName: 'lynnpoadrgbocmfzteudbfdm'
- ClassName: 'tvptdbrbholrkpkrtflrpsztxmluyisqidizcrc' WindowName: 'xltxubjhlarhgzt'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'qudoalpfeofeljyufwewvjsarnsdnagybobj' WindowName: 'aszcdxygunxjnbekroc'
- ClassName: 'rgjgfjbevqiwtfrs' WindowName: 'qhibqmbpxpjihgwwevgemnzygyk'
- ClassName: 'esbmomwwjupwckcwsb' WindowName: 'yojububwkhqflvbqauylnsau'
- ClassName: 'zpojubsxfiiulnyewlgfebwjtbijidfslvd' WindowName: 'egugurvctvqmcwtusnjdrmtqkxfrbfwcohkotj'
- ClassName: 'sovhhocabznbzyilwqhev' WindowName: 'xtshxndbaxylwmtqjxyqbtflrwesdzjvbpd'
- ClassName: 'egfkuxwrkdeymbcembhlaka' WindowName: 'idcffhznmbycmmde'
- ClassName: 'cvkzlspoqpblmdbidpspjnhq' WindowName: 'pwupkvlaxbpmdvzgrpbjilvenbqveolkfta'
- ClassName: 'hectxjxqzpkamswjtxnibirholoamdyp' WindowName: 'wlmwvjkunbnwpwgqjdcm'
- ClassName: 'erpapsijkabdkqhxjgrrthegenttdwlriaxk' WindowName: 'fihkgmpgpejmugsuhmbjujnlmxtp'
- ClassName: 'pwlfjldqxufkafnuyrejaydnjkwriufbcthit' WindowName: 'hnnejsszxabccijvqqhnnrxwovdrmcf'
- ClassName: 'obqawfkkjbpkccchsczg' WindowName: 'rgqxlzoplkroyuloedyryn'
- ClassName: 'yopdbecryfllbwsmnwfqetm' WindowName: 'orxunmteuaqrgrpstnqlpwqbvdaoljdxkmdwk'
- ClassName: 'pferiswksnsrgpvjuwtsddwyxegpnwk' WindowName: 'pkttpatnhhtouplsacjh'
- ClassName: 'segmlsgmbyvtandimrtcllpluxdy' WindowName: 'okbvzlzxignurmjqziegcdy'
- ClassName: 'avodxlmamdxlzhvvxeijmwgqjhx' WindowName: 'jralffgiehejfbtya'
- ClassName: 'gdfugzeldugkmyagtinjukpvtqmhgrlugzufpqz' WindowName: 'emvyxwxuafqrgsdgywxuervbbfsg'
- ClassName: 'swvlukihntgehrdtxdwfjhctwh' WindowName: 'muzciiyueannnheelnywjsvvg'
- ClassName: 'usgbhhdrqatfsmqnsexd' WindowName: 'vazzygufxrnivfzhycijjvi'
- ClassName: 'rzgoepevjzmidtuilz' WindowName: 'uwakwbfwdfafpejelrfyinxyzteypotyazdly'
- ClassName: 'grpwznvmsuurknddkhzsisxht' WindowName: 'ecurnwnaocvqrogstnyfmqntn'
- ClassName: 'yjrdzddytykkvajwjltby' WindowName: 'uixhtktnhvldomclfgsaqifmntyuksrseyckyoz'
- ClassName: 'kqjdyexvzupadhwzxfkzlfhrfu' WindowName: 'jizshosgdhthpcljulvdjyybfdyz'
- ClassName: 'jyqaikijravvrujhawgwnmydlagagyjwbxm' WindowName: 'jlpgqvwfyejstuyxbjep'
- ClassName: 'yrhrivydnuodxvkqpdtmzhqfabiipwx' WindowName: 'utishhxyngszjjrzigruivgb'
- ClassName: 'qowbvsjcapxjoeoygcmlmgixjqqmwsr' WindowName: 'vqdahafjztzelpqcz'
- ClassName: 'lamglqnzozqfwvqeikl' WindowName: 'jcetimvjdlirkwqwzq'
- ClassName: 'imdctyucgqhzimc' WindowName: 'clqljzmerlzpfzkkdgcsxujbafrikjpbcfdax'
- ClassName: 'ltiqfpsfgaylkjngbcisgabgje' WindowName: 'vkhqvxqsjpirpefzezgpqtwlml'
- ClassName: 'gsltrdjsepepbsbqxkjcjsmfpmadiautx' WindowName: 'dnfufvlelwdcivjukfbiotrfsruvzycpzgrkhu'
- ClassName: 'cguuqdneymmyitqlukbxqxeittzivctlfbmtd' WindowName: 'kvytezxnpmjbxnwfeonziohulomoyffgizr'
- ClassName: 'lxsmfskqaaxbwejdwkgfxhvimwixkfyknbvl' WindowName: 'zbepamahwuisxnvgwjvtspwbelmobndvx'
- ClassName: 'xieywzwpkxksnysfccrortbipb' WindowName: 'ozowggmgjlngispawgnlv'
- ClassName: 'uxkddjtplknapqld' WindowName: 'chpbzmhmcyhbdpgcsizmlthvrxqpsbzd'
- ClassName: 'bvnzzmpnxgwjvxrjplcfqlxx' WindowName: 'rihdoxtbcdfhdiwtxmecdvq'
- ClassName: 'njowlakagnghrgslghqwjsmpbcme' WindowName: 'daaejkhtzazzpkntpwrdspjyneedenkuyk'
- ClassName: 'zjfuajubtmtrtuapakhbnyrkykissv' WindowName: 'skpawivrgfunsrhaeisklsrowcfwydguaw'
- ClassName: 'dueohiwcqdnrxpqkpwzj' WindowName: 'pxofaucuybnaiqqolwqbvkabmkeolbpwwoh'
- ClassName: 'gzkvgnbdccqydydofxwn' WindowName: 'tjcnoqclgmldrsykpis'
- ClassName: 'udzfdzptksjguozzignudnuserzzwiridmchrqj' WindowName: 'oiccmirjspvwlsonwdkboptjpuofhsmstnxxax'
- ClassName: 'eayybskowsifnquyc' WindowName: 'fdoupibylruyutnqhvysgo'
- ClassName: 'dqumydakkrppihytlumbwmaajfk' WindowName: 'ntxhgkvkzbxppkkxkbnvmkfeuntbudh'
- ClassName: 'sacfakysoevjxrnulutvgalbg' WindowName: 'dydlvvqxexdtjkznii'
- ClassName: 'jmzqkzqjhdyotbkhzxdeewnmmsdfwdzbko' WindowName: 'wdvbufjajclkgzwnorechyxhylvuphaxernvu'
- ClassName: 'waowlcbyslvjtpmdzyhtktnaqcjmpvyg' WindowName: 'azxglxpsafdouxcihzlnleldz'
- ClassName: 'ywogqpbubdmvvfsedlugkyyuhivsvm' WindowName: 'dtxumhtccubnwqisacrzvqnxvhwvck'
- ClassName: 'csevhllfqfqpjfmvoqkjjterbti' WindowName: 'oqiupiqgyifxtsubejacdqqujyxrpstfbhlc'
- ClassName: 'jsqowjbddydjogzpltctzjzjuvrahqtpt' WindowName: 'wczdlccnmkehybqzxpgdusqd'
- ClassName: 'wqvnjdbgvhblwdewiaktkbmkikhbzksaswmfgrz' WindowName: 'gamvtrsmetexxqysvntkbsaqntdzxgmte'
- ClassName: 'vmcgotoeojotbdellxoxe' WindowName: 'ttxgrcsobpqpsyyasfughhcskgavpwijy'
- ClassName: 'pohvimeikfebiwpuviifbspwwtkpgzjxaedgmel' WindowName: 'xpswjkmxrtktwvgnlvmweubqhbq'
- ClassName: 'mainglcwejhpvzyrikvcga' WindowName: 'ldwectursprkitiw'
- ClassName: 'gqrhdqseegpryzg' WindowName: 'zgvghgtzhsmdupxcrcvfxqm'
- ClassName: 'apsgzabubyydswfhvvx' WindowName: 'mygcwaoyzedkwftxfheunxktxy'
- ClassName: 'wklmbzrxyzivyimdfvqhcgbqopfpkj' WindowName: 'epxrxsiovenyccjypydynokpi'
- ClassName: 'xjgalpsmrzfjwtc' WindowName: 'rgwuuplugnsvuqbrvlwkkvzallx'
- ClassName: 'disxzyocequfrnktvhnsnwzsdcfpigsvpcgmaso' WindowName: 'ytjqkvhxcibatnaicxtcrkifdltpthdt'
- ClassName: 'bbmpsyagnvwuvkeljtxjqyplsnr' WindowName: 'dvsnrksscosyactnpfgnxwl'
