Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsc2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsc2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsc2.tmp\Math.dll
- %TEMP%\nsc2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'zzmmotdjpzdwvdwotpq' WindowName: 'ysruetqsflenihyu'
- ClassName: 'iwhvdibxlzouqwcalkdbmqtyqjmrm' WindowName: 'svlccptmwfziwrdcidtslampvgbkbzqspjgsqvj'
- ClassName: 'iypbjahtkprcfvnquoeev' WindowName: 'gnzxcjlgggaymxvfuwlmubfxoflzggf'
- ClassName: 'evpylrjvvtspyzitsfmiealqiluvynqfpnr' WindowName: 'anhijpelfkqqivoarwtgmoyfrfqj'
- ClassName: 'fyxmggnozkrbrbuiabubdlrnlrriidcq' WindowName: 'aimvvekujbjnhnb'
- ClassName: 'iveuovonwkesnnnxsclzvxjqidmdasaiwwzu' WindowName: 'hpmguvzhdiojgpwisvfolaigapeliarrkd'
- ClassName: 'nogwljdmxmazhpsptzsct' WindowName: 'pcyzteoxxjapjitzodcvnzjglrpwjnscfmsnul'
- ClassName: 'fooleijkqwkzvoumppbjjrqvrqrcfzecptaz' WindowName: 'taddxnldcbnwhssxrqgffbxcffahrt'
- ClassName: 'xkiqczkmaalwdytjxjtuzeairesrpyfarrkgi' WindowName: 'zwlssfrqxbjrruprpumtijy'
- ClassName: 'fstffcdpxahmadbn' WindowName: 'tovdxlqhekzcdmynxcfzmplngiqcacytrqq'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'vopodgreqngnkmgnp' WindowName: 'oetpmxkavcayeecnobrgfxltojsenydyf'
- ClassName: 'hwaymthyxnnsnbqylvppqjwmzxk' WindowName: 'ruqeknewsmfotmfjacg'
- ClassName: 'uoubupxaylawvnroxuxqvfmvxenazn' WindowName: 'qklqykszsmxbircfgticeimrsbc'
- ClassName: 'cwqrnxdmpptmddvceulepspwuodv' WindowName: 'vhmtjnwecfsfvsdmjlosisoyvssn'
- ClassName: 'tbdwjyyvqvxxqajlxxnbwv' WindowName: 'jxaqoiveujypnhlmi'
- ClassName: 'hpvmqbinsfunimyucdtwuxljscw' WindowName: 'uqewdmyhsavfnzjkxblgpeascblmlftnujkvgo'
- ClassName: 'cnhjuyaecdakjtphr' WindowName: 'jydniwjlzpravhsvaoljtobyrdh'
- ClassName: 'utwpeifgrkxjolanlemlutkpzsxtqccydmuanvu' WindowName: 'uvbuqodzuulzqinopjbdhptkyitv'
- ClassName: 'qhrypagfnurptzfiwordpzyoacyzrpii' WindowName: 'qdiibnezovyncks'
- ClassName: 'lsjkkowljnreoidtmioxvuwdk' WindowName: 'kprrwiwxkducjsfljfcozoceinfea'
- ClassName: 'wqxsicgmwmarnkrkjktcfzwbopdzvwftdpygmn' WindowName: 'jkjltakkrzvlkkatnvtzyrfxyjzm'
- ClassName: 'bjsmbyifmlcensqzx' WindowName: 'mayxpquetscazyhptxfdcwiadgvnovyzba'
- ClassName: 'ahmxcubqvfwtwncwoefurpmxpbirach' WindowName: 'qnsysmyuuucghkzbexwuxvuikrqsmdxgb'
- ClassName: 'bfyneoplwglyiihyammvnmvqcxuiuxbufwowf' WindowName: 'mjmzexwtuewwysgglwruzo'
- ClassName: 'vzjeuwkenyvegsrgake' WindowName: 'ibsdgvxpjvnrnlslzrxtvfcrgdiyozkjpuk'
- ClassName: 'jqigrhbuxizptvjaurvajxhkexlyngnn' WindowName: 'yezvqncmdqaiosjpcgfe'
- ClassName: 'qwfsjvltwgcixbihefcvgmrnncedzvf' WindowName: 'zketuhbhbzummqqycnomyrrqnnbvo'
- ClassName: 'tonbeakryshnthosbfafwzbnzumwthlg' WindowName: 'mstrpatexgrskkthfmxmyfpsddhcxqwcmpg'
- ClassName: 'zlgelothjxjhwboigeczbeewmtdceakh' WindowName: 'iztoiwjbtelagkzqeuvdkikgjnnabzbg'
- ClassName: 'notjlvuokicqorxaykpaxzsllww' WindowName: 'pbrdihpwejzruljhqgwn'
- ClassName: 'hrdjajatrmxhmzvroq' WindowName: 'ecdklglunsnyqqxhvputytmbk'
- ClassName: 'nppuvbiagjnjszmttswfarebtflmwiactfswa' WindowName: 'plajyjvvvxbvlzguyjmmucwhxlyb'
- ClassName: 'xkmjepgksqjvbvhkcyhxnnicysvle' WindowName: 'bnwkrthrxjzamzwolgvdocnydxqjikgtpn'
- ClassName: 'npzdhzpuychuantjqivcfunfwwispbeqhgsbq' WindowName: 'zmqkvheurjhzfhighpnwhvqzgommyznvqsi'
- ClassName: 'jorijijgnhioqfnce' WindowName: 'bfeifcklmllzbceemyevz'
- ClassName: 'rakiwhujyeyytoqv' WindowName: 'pmbsnkqoeyqxxhrfqcoprmgoismlxqjgopac'
- ClassName: 'kwbgbpddgpnqwxdlnnuoctkg' WindowName: 'amahydeywxwekyqtdqcqpkedvuwmdynh'
- ClassName: 'ebaoimvyracewcekgeqxq' WindowName: 'pzirjmhatgoihfpispeufhvhypztayrjux'
- ClassName: 'nmgdplfdgkrurheetwvskutr' WindowName: 'snyusauoifudpiltfqvkjdxjcm'
- ClassName: 'mjidzcexqvueqtacwiqslkpf' WindowName: 'nmnookzsdkuzuoagudbsobmbzaic'
- ClassName: 'qzlvbwpkuvfryxxsrmyqi' WindowName: 'iruqpzjiqltgzqbxgqyysqjydp'
- ClassName: 'fjowvtsozpiusrkffmnbehaeyzg' WindowName: 'tntzzjbjmduxlqfpcfoirzgvsizvfmrtkwhpm'
- ClassName: 'zvmaqkloqkpbsfchyfmirojmznoedgrzhf' WindowName: 'afbjyjbhcbpxfompcdvigc'
- ClassName: 'pdewypjbdlrpnzaidcyxz' WindowName: 'afxjaslmrabfbyciutqlgmaihoyxjkyziwyat'
