Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ctzewjevldbixilfftqkdwufaepfjoemltzenov' WindowName: 'cjkdtptrddwjbvcsidgbgpnownhc'
- ClassName: 'ybbmjwqfhnwwvxqofqfpaydzipbrrjfoj' WindowName: 'ieqegtjouameyhihpclfyu'
- ClassName: 'srdfnkjxixuoaxgkrqrqlygtnxdn' WindowName: 'wufoffqxfnzmpfswlmckqikyhlrtkuovqoy'
- ClassName: 'zffgxzlblihbysdqoucyajpqnlapzwmml' WindowName: 'saijsxuweftcbxnfhzxurx'
- ClassName: 'rclgidlrtfgrgpc' WindowName: 'biqdrvvhtfahtlcdqabpekfxtmulzpkvil'
- ClassName: 'fiujisyftmomhwgiggbhhzqccceduhyquknr' WindowName: 'xkkuyowyckoxeqvxzdeqzufqvdqjandvymcf'
- ClassName: 'zhwqitwewhputyhtvdbrnkogmitlnoyvym' WindowName: 'smtmovmkknfkwtxfluw'
- ClassName: 'itgpfgwqszsgtklqltdvgqcatpcetc' WindowName: 'dqvqvxchscsyksaqjibooydwamlrtmwfomd'
- ClassName: 'tuxpmdqaawnlivnmymit' WindowName: 'zqktrzpnegnuglbriorupb'
- ClassName: 'qxajslwlddlykukncubrzpqg' WindowName: 'cjfgqgddjkfblrohreoadirxrmd'
- ClassName: 'vfvddvvsczshfbzmxbqgubvqs' WindowName: 'zbtveorcsknpsevuihqkmxpkhilg'
- ClassName: 'sgsyirykjlgjhchkfrlpftsyhekypccjwjflhc' WindowName: 'irrhzkceravwiiarbcjkb'
- ClassName: 'jvnthjcqyibhwsbb' WindowName: 'kifxwisgvvjnfimapweg'
- ClassName: 'wdloscxrfuyvbvfjwaxezrkkzcnrsfir' WindowName: 'lvodbbumctxoiirdvupzcamtdsuxlb'
- ClassName: 'ricjjhqjewgvtrke' WindowName: 'iszjemlckdqejyvkygeivsx'
- ClassName: 'hnwblhrbcqugjlw' WindowName: 'dkjteuvujyewlaxlzktaafmjpfusykeapj'
- ClassName: 'nmuapjvqkbwxojedgzourzisdsspmbnkhtuybr' WindowName: 'uwuzybcnugqkwdnciklsejcbftudclucfbcpvql'
- ClassName: 'qmbkpnuhumeyoivjdbln' WindowName: 'mniobfhhzupmzchcgrwkbqqizm'
- ClassName: 'swjhzsukccdmccou' WindowName: 'wvziibubsanvzmzpbfm'
- ClassName: 'gvbtilfndyzofwpzdpuehtzyjftvzrkoy' WindowName: 'txldlmmyewpbvucuioxzxjkkvd'
- ClassName: 'jtyqlvovkygttivucpzarvardsfcvis' WindowName: 'gcgefbqxkgrfiszzgfxriyauxlvtwvaivacd'
- ClassName: 'agrjxamuymkjlahiefhd' WindowName: 'caboifqqcmlpcvxhpmzosespabtzjifp'
- ClassName: 'szyosnzhgaqucihabspskoesaiqzzqx' WindowName: 'stebrvktmfacplljtpaj'
- ClassName: 'ufvvitprmzreypmvprfvrmj' WindowName: 'hfwkrvkrzpivwlxnpvyfpyemkhbgbd'
- ClassName: 'afgjflngqfjhrgisexznlia' WindowName: 'wnjtorgsjvcmongyepadabaiyjuvse'
- ClassName: 'mzhfsuwbbywkmwvzcyhkle' WindowName: 'nzanjyocnheslbzyhivnxnbidm'
- ClassName: 'kgcdmtczdzvdswmzn' WindowName: 'ongrlteqciyefocrgyazlrdefb'
- ClassName: 'wfdnqpvjdcvrilfxclbcmyzznnobyqzvjsq' WindowName: 'yikeyixmnputidekpxfsmtgkotjsvv'
- ClassName: 'lhxycztftsuaqjktjhiaauvsajbixrmujwq' WindowName: 'kppswixcekmqbbhbeishmwzhkksezbkrb'
- ClassName: 'gommeysizmmmllpkfydvwtxttiwxtqrhbxyik' WindowName: 'bptbrskpzkgxixuefbfzspb'
- ClassName: 'qgbwlbazotijiwvjum' WindowName: 'lzlzpdhtwvigcwvwlfwtrxljnzespkksg'
- ClassName: 'eaedpydtycfyctzmrryoenljieumewo' WindowName: 'oreeymhziuisdkwhpmrfyqxkljgpap'
- ClassName: 'kpknthlojjpbfiapqwatzarotpirequgsdyxu' WindowName: 'xveefcxgmlttnhdkycnzphdxrqnsvey'
- ClassName: 'uyqxibtmlednmzrjvnkcgbtjqnlhzbc' WindowName: 'dhhwfvevpmsjnaatgdbyzkfx'
- ClassName: 'wcjrffwssxddhvrwbcpbgbrh' WindowName: 'xyfedbkrwwnttckturovsparazyepiyxfymi'
- ClassName: 'vyvvjazcimlyuoa' WindowName: 'idjraqjiethzybozu'
- ClassName: 'yrgpgzmdryjpxylrmcdpuepjcshfq' WindowName: 'qxwzhtdhgshfywobttdbqcmjecgoten'
- ClassName: 'qlxaenjdfywzvkumzzzfpitltfjyaikwteemyb' WindowName: 'jcsxydcxwfesvbbxshsxknqtsrw'
- ClassName: 'kdvjtriwdidbvilgqmjefvgqglqhy' WindowName: 'htzhzeepfkjigaavkaqxersxworzso'
- ClassName: 'hpyggzbrsbvldrvcklnpmmwpjysaigxi' WindowName: 'poqphrujfntyjkdksapnyqlxvjtvoetivkhws'
- ClassName: 'pddkmsahvpketchyibvntdvewhuopukuoqvtor' WindowName: 'vdwlpqqwvjaavxmxotalimmpkl'
- ClassName: 'hjmgedjclwyfngwdcmpzmpxioelwnzr' WindowName: 'kcuzttnlrwebqdyhjqwmwfh'
- ClassName: 'vkvjdfredkgfmegtnyrgyuoq' WindowName: 'kphcsaxszmtygcgcd'
- ClassName: 'ysjdiybiofpylgmyazjdhahci' WindowName: 'rhfacoderxkjgbciygdwglotfkdhpxjbg'
- ClassName: 'olaynjmvbfjgkex' WindowName: 'aoggofljyatqzjalgbnadgqzexieyrihrkgd'
- ClassName: 'epkbufimtfwnmlyxsw' WindowName: 'taqozktolopwzjempihihrkgahcsuyouhrko'
- ClassName: 'izutrqnwppdicfssqjhmwulk' WindowName: 'usnzerwdqbdvvnshcoycviea'
- ClassName: 'xozwethshiimedpzu' WindowName: 'piduescbtggdphuhmotvma'
- ClassName: 'xlcuqiwicsjlwvdyoil' WindowName: 'gunzkmwkxlnwzlac'
- ClassName: 'xecslyfaiztzadminjoygnlmfaxaeqtzjt' WindowName: 'wlltfljkjncaukcbjxzczptk'
- ClassName: 'kdxbaisslmpyzjsdesddhcbsiylzsfnye' WindowName: 'bvjlvkwsovalkiunmhfxzkfmqclvlw'
- ClassName: 'nibmomddhtzcmcikbhkrxbsuftsul' WindowName: 'trpjxktqjmdxqptzyjqadgstvcesgqq'
- ClassName: 'xvdepsurvnpfsrzbtlgurpdjr' WindowName: 'fhppxixdmqxacabxsuxpuwebxvoag'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'rnfpoknyvqxnxlwjeplmuanncguwul' WindowName: 'elebiwlpyiyrdtqcu'
- ClassName: 'lunazfhvbyldbbvjrndrrphiajbr' WindowName: 'zffwkcgieiawkoxblbxrwhuuxtxysupete'
- ClassName: 'nwxzvhulsemnozyikfogqbivrwlzd' WindowName: 'bejwzcqvdjwwntazcbyqzhcrpmuyevfjdzz'
- ClassName: 'kztnyetkvnwnsruxiepolvdroggsrlzuhepkydi' WindowName: 'ceagaeovwlzemlo'
- ClassName: 'jjcbrthtogutylkawd' WindowName: 'raudcbjgkigusenzslfusyjymlfw'
- ClassName: 'yrubebqgbkuofxkyeob' WindowName: 'gpftibmrxzjigwinsqmivmjghmrpkz'
- ClassName: 'vejpfyqbjlccuxycvqeaht' WindowName: 'axwzawadedovwtlsqsgpzzrthyjgnsadyyz'
- ClassName: 'zkzmscajlapjrhwvzjcqygoddqihujbdfqiolr' WindowName: 'fqudigzlfnwfmxakpcpouymtylyfxy'
- ClassName: 'glgpxzqinarrwuqqdlazeoyiewo' WindowName: 'zbnxgaggwlkioqg'
