Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xbnuukiuomavsyvhmzmmzkfgvcrnlni' WindowName: 'eantrpuiokptjguqbgixikgggzullegprf'
- ClassName: 'mherxtmjotpqreckfheu' WindowName: 'xtarxyqkancosbwnyap'
- ClassName: 'esdwrtidrakvtjsumggqp' WindowName: 'aacbhgkkandgncqf'
- ClassName: 'tdhghexuruufrujmrjv' WindowName: 'rbebnrrkhctwdwduaqbxvuwdssbdfaiwbvzemv'
- ClassName: 'hfmwtzzbdfkccuidqqakaslrhwas' WindowName: 'unznqtgvwqnyjwsiwbfjxzyvw'
- ClassName: 'nzvpgkdxkpjmicnpjeksvcjjkiczhbx' WindowName: 'vmawjvghdmndngdqsllvsqlgbbqibdzzj'
- ClassName: 'wzshmwhgjdyppspiuavkkructyxgiuhuusu' WindowName: 'tcdxwmemrqcmbxcsgfwkkd'
- ClassName: 'uhcxzbugyhjzxlgki' WindowName: 'mbzvuthksesbnisaiopqz'
- ClassName: 'xtibbewxbgsmlqmifeghuqtlvbkliplxtbc' WindowName: 'afxbnkklwqqjmkqqmhgcuip'
- ClassName: 'xfkfuzlphrfbscjguuxftdfrwivtmilgxcgptxq' WindowName: 'sodsdzjfqcircxngbgekoypar'
- ClassName: 'qkbqibimjbrsizfwwdhugzv' WindowName: 'vxsdqnraxkixbwipnqzju'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'excbtmczdvpqyujutcmhortwvjnrmqekdugng' WindowName: 'tkwuwxkeahhcxyxrhnllkpmjfuu'
- ClassName: 'pifsudqrsdsmgekkupclfanb' WindowName: 'ipusdmwwrzftjiva'
- ClassName: 'euilpkiluidjpytqartdkq' WindowName: 'kiksvujzthhifwhvkaxtwzbmwnzxgbxjruyda'
- ClassName: 'vjvjjjqqjzwijsehljcn' WindowName: 'uecodhhhfsroyavsvgayd'
- ClassName: 'pedvpoehfgbbukbwkfqwwtaowujkku' WindowName: 'gwtjtxrucnpbabvp'
- ClassName: 'smafhrmhkiixqwtxzrohwoeqlrpmykqvcp' WindowName: 'gacxvidhojhoyfdnfprvfab'
- ClassName: 'huoqcmbwsbsalmkuuydr' WindowName: 'urmcuzsahrbmiqj'
- ClassName: 'cckpbotsfhmfdtcvd' WindowName: 'hbcdzvvyvkbljxsqruhhpsekevizssdx'
- ClassName: 'focfvyqkvifxqowxdsu' WindowName: 'razmnuuwscwyqeuvpegndtderhhav'
- ClassName: 'qrwsdjcljzsjvbhoxbky' WindowName: 'jcxnmzykttolekc'
- ClassName: 'vlswvtaegdvakjbzujygaztzjnhxjiroahq' WindowName: 'nffrseoaubqqpqlebi'
- ClassName: 'newivndmgayljbzkozkgpyibpndwqs' WindowName: 'cmbfdbyuordlpbowvqsrt'
- ClassName: 'nuycccutxdttdii' WindowName: 'awgkwsqwgryqhkzebidfunydqcyymcutnle'
- ClassName: 'ebjtqtoflgdcteyv' WindowName: 'mtxrwuwbmpbdimaviruotc'
- ClassName: 'atybrrxqxziuhkqwrwewhpyrzydh' WindowName: 'pemllxijvaoaruccizfrszodzx'
- ClassName: 'yggrkzqxlycelnjubeusrn' WindowName: 'wzsqqkjnwswgkqggtcoqoozidgpk'
- ClassName: 'eoblyjryybevtpsfwmtscchfsxkmmsbymawuyb' WindowName: 'afaqhmfqvtwlrbesq'
- ClassName: 'pfkclkniagqiayltu' WindowName: 'bilubyspdfzlekowkmnnpkynjdd'
- ClassName: 'fkyxmvxeeefohfolrkggajdalqvjo' WindowName: 'gzswmvyxwlljnfdenrhubowl'
- ClassName: 'pspobjduhoelxxqenem' WindowName: 'avtymedbhhlehhkvqnyb'
- ClassName: 'aiwdgareypfkgsdlpwxgbpfrskhaabwmtioedn' WindowName: 'ajkbrxtzugrnibnwmffbgc'
- ClassName: 'kvlsbqjmubogamafayvlyjuectiaaoi' WindowName: 'fncuvkpbvwmvvojzhfgvamjwticdnpshhdbop'
- ClassName: 'qkxaqeoyqsozatvirlqunnazgxwff' WindowName: 'tnxzngwxovrarktl'
- ClassName: 'ejcaqnedridnhojmfpv' WindowName: 'wkirmnvqfvvapvnzij'
- ClassName: 'pkxrhvtypzfsvduidcsdgqxb' WindowName: 'pkyggddneqiiycat'
- ClassName: 'ngvcvipwlguvooptxnd' WindowName: 'cfsrcdxkwlieievojij'
- ClassName: 'ermyqfdjulpizcziouqwhjuet' WindowName: 'gxqbphwiryqmabcbdtjwuyj'
- ClassName: 'mmpfomwxdglhiiuxmueadzjqxb' WindowName: 'phlvalfrxowaeirtvdghcyjxagfzylmjwi'
- ClassName: 'jcjffzczuktengbavsfmqojsfyc' WindowName: 'vygsidmpepboialrjwpiyfhhoeoejbmhydqzpb'
- ClassName: 'ssmbrdvqedoogxcepvoqhnkmvqptdxqbxicxr' WindowName: 'stnubswvdlkkbott'
- ClassName: 'dkwrisfxljnxjqywwryggnz' WindowName: 'elcoareexmnoyoxbigqgncykgkwjlipahkiivb'
- ClassName: 'bzupwstkyiqamwwaobgzm' WindowName: 'cmyttfilfnavdxvlojdwpnmnoxlkhxguugm'
- ClassName: 'lderezvsvjamzftndks' WindowName: 'hejtpitzbitpsshtmq'
- ClassName: 'jrqpdhgfhojihparqsbdmlplgiilawv' WindowName: 'hwzcrgcdcinohtheosstyhzgauiboplkmamrh'
- ClassName: 'sgsgswfrzivmiesupsut' WindowName: 'xbvbdylcqtxrfmtcgusfaywfvtqyrxhbhkaes'
- ClassName: 'bmfugcjfggebufzbpqurysvgfbsjtdebplpj' WindowName: 'uehrxeofyzfcgslpasrmpiwrxsoainrb'
- ClassName: 'yvajnavmjgdugfsiomacrnpxhtsxbsigbzujx' WindowName: 'nkpggceiyeahodndtmzaqsewhmhldj'
- ClassName: 'dwsbyyjoeerombdonqpucqmkptzywqknz' WindowName: 'nfwecmjnvwqsuuieyhoiiwnbtoss'
- ClassName: 'ddcoqpgteksnqetegodvegviuhtob' WindowName: 'iwjtkgpjxedceqvspsbmejuqk'
- ClassName: 'gwklxcejhsnkgogefgiacmq' WindowName: 'xsosgxmwmkovshsb'
- ClassName: 'jrhurkprmfakqevjdszldcmdgouztyzlqeqlplv' WindowName: 'ogefpfoyeumyrapibc'
- ClassName: 'qsavkqpgndqiqpdrzmgiuzymubazbgsbjf' WindowName: 'lzhuaflxjzpxgnhiugqmlcvnu'
- ClassName: 'zhjzwdnfnirvngswjicbnzrhpzxw' WindowName: 'ojzjhaoszwvgegeyvgmdlnoubiflh'
- ClassName: 'penmbpvkbuwlssvnjadxx' WindowName: 'ztjoawypokkbofquxcctcgiwzjiinplnkbpyu'
- ClassName: 'auiigoyjnpkdzpmtpifsdrvirpsxcmchiflq' WindowName: 'sgyjmlyvohgkqweusxccufuhooccwaalslncjci'
- ClassName: 'oshotqroeaauwfrhwoxswdoa' WindowName: 'ygepatfbegnafroo'
- ClassName: 'yvvrywxlrjkbxsdebk' WindowName: 'vldcxovrfxszpzuquvpwrftv'
- ClassName: 'fairqoueofhkfpmqtsontedykuw' WindowName: 'jyucvvfecfontfwaxgyuchircdeaovgixevywq'
- ClassName: 'ssjygttpjwepdtjfnwlstkizgsmkony' WindowName: 'ecamiljizhvkofalgkqpcmvpqfjljxljit'
- ClassName: 'uhianhvigtufwgjpaarjirlquspdi' WindowName: 'ocrrftpspznbptlqvrrkyskthrvunbxymx'
- ClassName: 'vfieolwiwqtgekjtdqcoq' WindowName: 'hqrzbalvtfingutftgwpdnupaowciwugcif'
- ClassName: 'zyqzqpjshfuiqkriwoiclwtxptqzimapqtt' WindowName: 'oitwflmotlkjakqi'
- ClassName: 'bgzpzjdosnuqnjby' WindowName: 'yvvqnjpavsxbuizjvzv'
- ClassName: 'wlgujkucrigimajztzlouahcvqs' WindowName: 'aqizfoqsradkossyqzyoghavmqgqtmmkrdxl'
- ClassName: 'rcqdeboerqzkoibyrucvnzzrqiknewb' WindowName: 'htzhhhwavhdknlmitoftxzrytebibyjanaxx'
- ClassName: 'aydqnbndmvltdvmwkedeqqhuxuosztcxehmrizw' WindowName: 'fthybojbfqufksfdhdlk'
