Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Desktop\Internet Hao123nknk
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mlyokxngwpcgsnfiwfjiaineqrvdoocu' WindowName: 'fteijtowhuerdrxmckmmvvbbetzegmvrbtutnkk'
- ClassName: 'cvauuzvrbmkmpvymohqvuvkxbwwcerumjmdvx' WindowName: 'kpgapydpcawyqbqtpxyn'
- ClassName: 'brgjhwiesesxnyjfpnggetziddyehe' WindowName: 'qdbdfvrzgswraekryhitsjr'
- ClassName: 'bparrlwqmtupbjslzail' WindowName: 'dsnrzcmlhiwfwrslwoadcasm'
- ClassName: 'lurggjtubwgkoubvknolutmzglkuca' WindowName: 'xmxdvtcfsaswsjmjrgfxpncwsruyybl'
- ClassName: 'vdufkrhrrtfxlfsgpbaibkncmaxxjxkmd' WindowName: 'nypsuapiykzevrfp'
- ClassName: 'fluejyqkhsfycowzzgswmqysxkcjzbul' WindowName: 'okzkbzzixoqdibuecdtwqvpxek'
- ClassName: 'dipbisbbgyqywedcvcugrfgqorflc' WindowName: 'wcabjnkruorumdaoenllbjdacbfhoeougxcqudy'
- ClassName: 'bnalwpdxomkzzwfjxyszbqmjywjxifbedrtba' WindowName: 'vagopzvrgjcnudenoawnlohgfenwgrgfuxu'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'qriltgdyqwpiojhdleahwqcli' WindowName: 'eierkvpspzahipdslljnpcdznba'
- ClassName: 'vomdodzbcpcfrwnwphgug' WindowName: 'cvezqyceorhuyexhpkqfb'
- ClassName: 'jbxckyvqtvbbjyjk' WindowName: 'zbvouionspffnqudaxocmgqlvtee'
- ClassName: 'wmonsqvckvgoqhajrxmkv' WindowName: 'xbvenwuabtqoayazmkiudhgouqxm'
- ClassName: 'khwbhdhthubjzhgwbiusqjsstitfwdgcq' WindowName: 'gvojnftzwmydlnz'
- ClassName: 'ohxkbnpvursesztzzkxcfcvxczujzn' WindowName: 'qcbjujtnltyqcjbzizuqqvfveildq'
- ClassName: 'zfvusubqsmkifqgacisarqwejsoxmelpyeudx' WindowName: 'splecgphfdjpdyehmfzeztlbjvfd'
- ClassName: 'mxcnhsnfufqtneoeacbhgwctdyvmtfsfvddq' WindowName: 'blvvcycxknssdjfwmdi'
- ClassName: 'mtgpanfnqxeahynanfgtjwrkkbr' WindowName: 'hkwyqcryuxnamafiwhbqmpekophchopywhxih'
- ClassName: 'wpjutzmlmxcwgpdtnoi' WindowName: 'ncqhfvoxabbaqhuvizzkdak'
- ClassName: 'zkxepuieukvyhgvskpdboksctdanp' WindowName: 'udeuhkjnprfcujkyuwbctzgxcpjvoejmxos'
- ClassName: 'zrmhgjkwusasoispebqaybo' WindowName: 'usmjrdymlisgxzyirupifpixu'
- ClassName: 'dnjmqwvffdzeivnsycnynldkmbaeuktvfcmjo' WindowName: 'hpqsnzczsxalxldzoq'
- ClassName: 'xinutfbkwswwkdeywqpiykqsg' WindowName: 'arbddsykzdgbusjkuvkfestyssvmnrqboudm'
- ClassName: 'cocnjdlmuzhhzkwljmgtxglmcdnbhijjdmgdx' WindowName: 'pealovgshlsdzdiauhlgzztaedznrdnnlfhrh'
- ClassName: 'kvibmnbzyoymlwcgvvao' WindowName: 'wbavgsgsukjgesilsisalgw'
- ClassName: 'wdwotutxiphxywnkboqx' WindowName: 'stktdvhbvmiyaztewjjeagejzhngdqyx'
- ClassName: 'uzxlhyaluoplfwteqzkjxxvzsx' WindowName: 'gfhliwmkqussupthaqxky'
- ClassName: 'qrcrgycpkeofavujyoeripemzt' WindowName: 'lwhslnaqrneutpstcuxkbzazpilqmwyqddkh'
- ClassName: 'imydizrdeyrgzcrzvt' WindowName: 'xldusiwhjvyxagkissqcclhoszgkgzrom'
- ClassName: 'sgzyzjtnrxjfnxqftrxuppmwafgtrhbayfrria' WindowName: 'khhhzyhorfjuylqcbyueatacbjxdzsuhmldk'
- ClassName: 'nmgltrypialuzxangsldxifdufirctbm' WindowName: 'wgmlxgteozvezmbzmkdowfwaowzemgjisat'
- ClassName: 'qdesinxpmprpxcxwh' WindowName: 'nsgozqdiqfdtfazbzyfhx'
- ClassName: 'awovshhneipqrgpplavqwywduvscrbraz' WindowName: 'epvjmtitegsfopbasyv'
- ClassName: 'qizzlyxaotegzojluqptdzrjilndwwhwe' WindowName: 'dzklumwgtghtxit'
- ClassName: 'zwapurhhhuvxbtbdx' WindowName: 'ziryhadtbuacnwtjzuichrfjkrruapfmokn'
- ClassName: 'woqqhhxfzoqjytnoozalunqi' WindowName: 'myxxdgivhtgriwymwxggjn'
- ClassName: 'wsclzfnbcoptzfqvubccmzdgglngpt' WindowName: 'jqsthqrwikpwwwbknzwespchmnte'
- ClassName: 'uxbwsdsbfbuvvafzvontjqrhnuzuomyqtlz' WindowName: 'jumwsenzrhyynuhmhqezhkinfmkuihiiyv'
- ClassName: 'biutgipferrwoqxrpimkbszupcvysokypygt' WindowName: 'igrhcosyvidattzsmcopkbliwoohqqinyuai'
- ClassName: 'otbgqjruyepuptoipu' WindowName: 'dayndnjdrcnfgspjqvjvmdqakcmowbutyjcjef'
- ClassName: 'gyvfdfvnuptoynvzr' WindowName: 'whambeangkmeetuafelcblaqqxbgopzpis'
- ClassName: 'easzurdqhokahjqzgymopeuv' WindowName: 'ynonuwoilcybaojrdaywwymfgrnscn'
- ClassName: 'zopgtxqxjgyqkzcwizthiyzjco' WindowName: 'dkqpkmxkovtpcnzxxwvgfelrdyqgmfr'
- ClassName: 'nlhvarzlaqtwxbzfzz' WindowName: 'jbmonttkxguucjakaywjpfddzlhcmdqertqmskn'
- ClassName: 'kxklmllxgsvjefmgfykw' WindowName: 'htwgewjczbyjban'
- ClassName: 'uveixgelfasiygczghztw' WindowName: 'yithhaclbtzbsxvrbkhnwcnuhfeixgvkkxl'
- ClassName: 'vfovnooixkxpdqkgwqlatxpm' WindowName: 'vxwkyhndrebzmlluhqrzwbjaeesxpcsdtwh'
- ClassName: 'wlnriwmkllodnsnmstbztdcmybpiauguqi' WindowName: 'yvsmufduexsguqctnlotwjvxwc'
- ClassName: 'kpqfzacwinlowud' WindowName: 'esmmhaixpkugnbfhyuwugcrejbis'
- ClassName: 'foplnmqsjqpdaiilizdyjzntmjqxygr' WindowName: 'drdfacgnqvolbsscemxbjkogcjvimcpyrr'
- ClassName: 'aprpzqyxyishtgv' WindowName: 'imfvacxxwknrqqqyhgkuggrh'
- ClassName: 'zdtiduzbigixjbmllwxic' WindowName: 'nwfjkmswlbqmbbwaomopgvbsmxv'
- ClassName: 'yxcdksijcugueyjtacrpjwxlaiyf' WindowName: 'qsyzutwbakvbfxhpmfxhfg'
- ClassName: 'ansxrdpxlyovdrvurfutzvcnfbybgljdfot' WindowName: 'ryvvudehjdsiuawtbaggunackunsjlokuorryof'
- ClassName: 'dpnmwatjdhmfikgbitauk' WindowName: 'kchiucoqztajzlyomdrysxizsjgwijxzstxyozv'
- ClassName: 'vidnesgvnjrbumzhytxpqktwscphnnvxs' WindowName: 'itqyyubrurvznsdkqrxwmputpnzlj'
- ClassName: 'eidprupvtappsvwflweykufyypprx' WindowName: 'pxapcfpjvgzxcwlxadgcujqzqop'
- ClassName: 'lftitmqtaxskegoevllsrq' WindowName: 'ttpknsdcyhzytiiapisqldp'
- ClassName: 'jndgqrbumgfyzlmhsfszeajjbaap' WindowName: 'chpmnmfiaxoieapxvdypufttbj'
