Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsc2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsc2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsc2.tmp\Math.dll
- %TEMP%\nsc2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jbylwnrgkaetjqvepmfzje' WindowName: 'wctrvyvtczklywepin'
- ClassName: 'zclmidzreisbltb' WindowName: 'usfcthhkithgznpvzgsxetibdmgkjdqcjcj'
- ClassName: 'agtuisgqjaeubkyvzlmgrjv' WindowName: 'wjzhvdchplfrgzdinp'
- ClassName: 'oaduepywjmcktfnrpurbxdbv' WindowName: 'uwvsfspcmoylkrjvcfrrlpi'
- ClassName: 'toyjonagojdnjpnvvzimr' WindowName: 'soerxqdzcdheguiqfdhmej'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'cuordeorvsqqiwhsqqbxswxebisdhdo' WindowName: 'bhdrnagscycywsae'
- ClassName: 'kmlvmxknnltlkqschz' WindowName: 'exksottybimeevqmupuglsapnmcnabxb'
- ClassName: 'dpiwubxwvzkefoaxuwqqxlnkagtvlhenvcoiu' WindowName: 'amqnmotjknkwtfdqmhtgwgluayfsbjumopbprgj'
- ClassName: 'afofsomgkrntiekkdumtlijsxzqtspohtyyej' WindowName: 'brnpfudqjflcisdgssc'
- ClassName: 'krdixjxtnpskyjeblpnyzieq' WindowName: 'bbpqeofdlehgnrkakxxmiuiuaikq'
- ClassName: 'tiirfnzavlacepuy' WindowName: 'xqpaotlbzbqiwoudzwciwpz'
- ClassName: 'ifwnowcsdpwkucywtbbplndshqir' WindowName: 'okmqcclhpraajvimyajxlt'
- ClassName: 'zgwrdbaivsbmutmlb' WindowName: 'qlooizkwaarjyzvzeztzoicvm'
- ClassName: 'lmkdgzdkgdteahixfejtjvnrmrydlyv' WindowName: 'aznspqlslaiwwomowyopo'
- ClassName: 'cviakopeaisgychcblz' WindowName: 'yihtndbrberbrtgrsdfzamabv'
- ClassName: 'ergvgccwmetvxlyqsesrjhh' WindowName: 'kruxltjncoukwutrhksq'
- ClassName: 'exmzcqhpbfuuejpikywjprugpqvauxm' WindowName: 'ropwrflaungvrtb'
- ClassName: 'xknamkoucvhgpcvwnnztbm' WindowName: 'hxllyzuktksguqosoozbbhwlrvlftrwoehqfwb'
- ClassName: 'hmrcqupsimwdveqr' WindowName: 'zjiikmvbikqebmvsoqyexspfwlzubgrz'
- ClassName: 'igzkiuwghegijbjnuwascpfjd' WindowName: 'phageoliqqhecdqlbyb'
- ClassName: 'sgotqjbsvweddbduuwtkk' WindowName: 'wgfcualimbypcpgbzxdbafyzofkrls'
- ClassName: 'sivpwiggpaomkopbym' WindowName: 'egbwmtgmavlsscfsmp'
- ClassName: 'lyyxzpwlwaefmqiq' WindowName: 'smrqsgcgyaytpcvhhajgaxzbbivdym'
- ClassName: 'yfvnpftwkzqtneukjfhgo' WindowName: 'ctyrfjhkpzuwjkupnlsqqsvaplzbsmuctpkavw'
- ClassName: 'fwrtlfrxowekcpm' WindowName: 'efxifqsjjgzrivdfamdhtmyfbpnerkepne'
- ClassName: 'rxrenbmvgtrtdmawdfenou' WindowName: 'jhobhqrqchrbkeqfzwklprhmy'
- ClassName: 'gfkezzvvlrokzzedcoarkcxodrfah' WindowName: 'lhdalsoxdqpbhjhmh'
- ClassName: 'snseizuechrtmtiyftesckqcf' WindowName: 'djcopvzsryeupxgtydoppn'
- ClassName: 'fggxvqnnljjadvziodrsmdzjonzhgqsxbhvef' WindowName: 'ekkaedwhrgwjgsnbpulfwoohseidxealmptriei'
- ClassName: 'rglafzzbniimlgw' WindowName: 'hvplpdzhmlmegxghp'
- ClassName: 'yscwlvmeenzvkkypecsninmscgr' WindowName: 'mkjiddljbvelnswgvqgthnoycmff'
- ClassName: 'aolfwekezsjieprdxhfnbnufrsxyht' WindowName: 'aahslswsxdpchoykpfvckfvgzqkqebwsejp'
- ClassName: 'wiybmtlwddxpwkwmbnfiyhwte' WindowName: 'zfmxnnvtaycoewhzjwwiu'
- ClassName: 'baibooslhniapnikaynfkjvaqujsnjsrlky' WindowName: 'idvcumxsjmwrnmwpwfebqdzrttromcaxvdjtbpn'
- ClassName: 'lzgkifpdztqgewvvidbmjotynizab' WindowName: 'msxtitvrapuokuttdn'
- ClassName: 'cefxxshkncdmmzehoxikrfhmraalwdbadhogxj' WindowName: 'oqbboomkgnqepolxtnevdcgmbjuzgc'
- ClassName: 'jktascbaciswmwsxomh' WindowName: 'yedfgvlkbnfbjscahurhw'
- ClassName: 'hekolupelyzowjlelhnvqjfahtvy' WindowName: 'mikljkaqokclkddeijozmcaichiwxgfcuubx'
- ClassName: 'nfafprwkcvhymeh' WindowName: 'awjbcrbbsxzitmj'
- ClassName: 'uqlvacosuztfjnxkqgxi' WindowName: 'dznvntxxxhknyqhpuqiedvmqscack'
- ClassName: 'pdlfdcfeijebbiowqjwmxkkcafcknav' WindowName: 'wtqshynqsafrctjgtvtzvvtbrpcrluljaxnfwc'
- ClassName: 'crmfyfluukcmlkccmwcvjiqutyn' WindowName: 'svjwagxkwtiyfoxsvokkdochsxwv'
- ClassName: 'eujvfuhrrqqdknzdug' WindowName: 'uxxrqytfjruduciw'
- ClassName: 'bqkyzqgpsxjsupczd' WindowName: 'tcfewylyfznsqyy'
- ClassName: 'jwbrzpqwxaqpmutefxrcoxecfdixe' WindowName: 'twurfskernmmtgqugszejmxjrmpgzilzywfmdo'
- ClassName: 'dsooyzvzfzwbyrkkiydkqpqcpvhcpf' WindowName: 'vrblgnoxcbbegxkfoetnvl'
- ClassName: 'flouqxlhhfctxbosdnoccd' WindowName: 'bwkgcpjelrhajqmlmjjeaumlglqibaeoml'
