Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsb2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hwulmxpwajiqiihuqtzzwrxgbx' WindowName: 'kadmffmykipzficjnlcshnqytbsqjhx'
- ClassName: 'kcepmmjmvrsftyrfzmoyylwwqje' WindowName: 'krsbhuzhfihwdyuiuskypnvsextcclbpbycczdf'
- ClassName: 'zxeoezbyexqljqjdzyvopknufqfmdltynga' WindowName: 'xidqcbfbdrkstkckohhnw'
- ClassName: 'yvejzaksrnjkrwbqfljrhiwdyx' WindowName: 'nwyykqzcftyrxsjzbdbtsqfogtkdrtflxf'
- ClassName: 'dhbexmpcoqjtxjlneasicy' WindowName: 'cdjqqzgolfiippxkozlmhnxifygavjsked'
- ClassName: 'ytgchushouzbjyusgarddjpojfpmtmw' WindowName: 'xvoijyrurzfbpvogbziweirwfxglfjwazyf'
- ClassName: 'udpltsyomveuaxkzngjafjmgkfcydv' WindowName: 'fonraauuugcotwczfktepmqkhtqzx'
- ClassName: 'zilpjslalczkvme' WindowName: 'juliefhqgoyoylcpllakqiuisrxvlyaxx'
- ClassName: 'zlgwdanwnjkcxajmpykxqcpwoajudxzj' WindowName: 'gbxllcvldsoqiqslnsxydaufoe'
- ClassName: 'vvoeypoljwflqyvkujbpmpxzskquddcjfz' WindowName: 'xmrxmxzjqvxlrcivciyfxpktbvmkmme'
- ClassName: 'eewnawuwmsiqzhhzsrtfinnqc' WindowName: 'tctatnqzhmjfcekaw'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'qgnqjhbdyowwvbdnr' WindowName: 'maauzluwifzkqhtad'
- ClassName: 'uoxmljpzfjagumoejjlbvm' WindowName: 'dmyuejhexggzxsznauiqugvunfleqamefrzfai'
- ClassName: 'jlfghciyshcuxgmwbunseg' WindowName: 'toabfvbnvdyzrrszddrbxtwaxxqbpbgpipemgo'
- ClassName: 'tuiiesgcdacsest' WindowName: 'wjhqnnpnxorjfxepmkqrmfyjzwxsexiica'
- ClassName: 'ujdegzpfrbkewsmlryvvoo' WindowName: 'hppzftczntxvoykluyagszmvfea'
- ClassName: 'qzckbjcsfiedlccvtfm' WindowName: 'obcqzcsrxycowmaponlexb'
- ClassName: 'vmyniwuqmoxpyrdljuiuysgvtmgymyswsmlj' WindowName: 'zcxibffiztugkatmqchgktpypnwxpc'
- ClassName: 'nwyghqpbgfkaigy' WindowName: 'eqblcilescuplemiaxrqpootoilobhyrjxkjbk'
- ClassName: 'iyfzfllejukhwwss' WindowName: 'zixuaphxeymexwuccgya'
- ClassName: 'ltlnlvnszyzmdctwpwczuwtgymlovuaudmkwdy' WindowName: 'rfltxhwabayqjspdybwrfxojgguqbxrnvhegv'
- ClassName: 'uvqilhuktbvekdcgbengsnyr' WindowName: 'hjybpblsrpnmvkefaxnbtcck'
- ClassName: 'rspvwtrdzbgxsmjgyutkkjmtgaapu' WindowName: 'valqkzuviotttor'
- ClassName: 'eeykcrlwpvrnurfsvfxlgrttr' WindowName: 'gdkkllautlhuwygfghetteajqudmuh'
- ClassName: 'xijxetoutisfiumklkyoddqdgwttzvmsrczdk' WindowName: 'smxqrdqxetruedwmtslrthbaelqajnzri'
- ClassName: 'xonkhxfntftlllucnppvscojarhnxhupdr' WindowName: 'cfottaentffioiqnsrwgcwpdmxglznjvjhv'
- ClassName: 'tadntnjduawpekygaspksefn' WindowName: 'iflmwxqpbpdubbchozgcrvabqbslggzbqxev'
- ClassName: 'rokpvgvfjfyvozpnhnzphynrxbbhunzdiyh' WindowName: 'pjebogssudwppifyhodhvoiba'
- ClassName: 'xslzdfcuuflxpojyslvz' WindowName: 'orcvbupnffzsqxcxnbbdmfwapxmqy'
- ClassName: 'olzjllwbhohzifhkhfq' WindowName: 'isxnodpbcuhdexgpiyhcjaq'
- ClassName: 'yjgeffcryfmmgvjtcmmbfljp' WindowName: 'wugiilppubtqpdmdr'
- ClassName: 'ihfgxunsmdenredykncsasmueuepnwdvktyz' WindowName: 'cjwbuxosnxcvfdnetycxlqscsgdnonluoak'
- ClassName: 'invrphxdfhtbppcsszadhdvyspauzxeujkftwe' WindowName: 'hlyygbrakcelgtogmyrbamyejmtepiunwwzwp'
- ClassName: 'yxhcalhoydvnfxzap' WindowName: 'ihiqwbxebgjridihi'
- ClassName: 'ptbznfsxuhyvrjpheunpeaagkuy' WindowName: 'euutronpqnnafzsvnvkddoswpdextzmvlcuwr'
- ClassName: 'zafuqcihixwgjzxezejxntil' WindowName: 'oariufahgzwqlnbinylpucbglui'
- ClassName: 'uswgyfxwovlensgxgccggnitgm' WindowName: 'ziapyuqdkwhabjlzcljflcrdcejcxw'
- ClassName: 'teiobsjqvieyoqkafjclhkpohxhvvjf' WindowName: 'oyaervuxunpynpzwc'
- ClassName: 'otwwvbdopgukrjaodroelfmctkgkzvfytpzax' WindowName: 'phqgutqiljnaocwinrcmpsm'
- ClassName: 'bcrfhhuwsiztjdrivvakwhaayupybro' WindowName: 'oawgxaqkwjhojtjsfysupfqgrs'
- ClassName: 'ghdpxgtdwfyymeb' WindowName: 'maeciznzefsdpoqykiykldywrudqwvkeuiz'
- ClassName: 'pscnntqbzjcuqkhuz' WindowName: 'prafpzjzcktfxnkqqegkxbyjvdorsgdlxkjsx'
- ClassName: 'qkmowdljlljmvcpcsduqf' WindowName: 'epgalqzuhzdangfqpglbfz'
- ClassName: 'mmgntrxeunyzjiwlamohyjpg' WindowName: 'udsezhwudildqcdtlv'
- ClassName: 'iflfiierbkwsifskpoadkjbvqyxozhpximi' WindowName: 'tcebnsjjhiwezspysbxbma'
- ClassName: 'lmrysqfrppjqrlwwvfrqi' WindowName: 'dirjfqdkoeowektxqpshudd'
- ClassName: 'paqvrnmjmhxoiljxkfihdrnf' WindowName: 'gmphiayugunnojfofsnjzoliklvedbokapu'
- ClassName: 'dlakdqdavucaqftbquyrq' WindowName: 'abyylhyiqmljognfbmkhvisikbz'
- ClassName: 'kkcbmdmypodensw' WindowName: 'vaxbsejytuugifrqoagkvksgyzmgzrsan'
- ClassName: 'hvfqgsqycrdhxnsdyxblcghc' WindowName: 'miiwnqusrilgehnhlfzqayo'
- ClassName: 'mtwflpwwkmoniuqdghaybawh' WindowName: 'vbmjuwbujvhxivxzyojzymhfxnxztzelu'
- ClassName: 'scqskzbhkcvdbxxbbnyynmpdjkc' WindowName: 'nlfwomjjxzwztavylhyce'
- ClassName: 'hbqlwrmqkjutoturnsmcfcpvxdtskerxheerivj' WindowName: 'xilzofekpwmhibzrvgscyupywzzqrtru'
- ClassName: 'ehwkxlapagbtxtbhcbygjihsypnetqlnwxs' WindowName: 'jvdqrygubmfcpmtxtnkjesr'
- ClassName: 'opppuuwpxsmhvhwjyaselsgxhakwqoqdxdxhjg' WindowName: 'wtokecfdvzigxvucjedzxkpnnc'
- ClassName: 'dlvjmfqakriwzxrcybfzpvdsahnlld' WindowName: 'lqpbsiwfxvzhqotxajmdvcbdjwmmr'
- ClassName: 'mtphgrtdgbjaobmwchlyvblrqkfro' WindowName: 'jiqpbdmxpnmhtwrs'
- ClassName: 'urxuvypifzlcexru' WindowName: 'tcqnrdhjtheyratbysxjejphpxdmd'
- ClassName: 'bwjstdtuuzyflfzxd' WindowName: 'zcvilsxsjgckujyzaowhfksoyjgp'
- ClassName: 'smaextqpuqlwjbfrqvvbudslvaeipcvgpmtb' WindowName: 'qzvtdiyhjcmfgfyzcpikt'
- ClassName: 'wuaqbxwrucwwemybaekadczqsqxttqkrr' WindowName: 'xoiuxfiadrlohgckhiunqgqbygxpngk'
- ClassName: 'cayhjkuoglrulxrcmjbqbpfyklymaogvxaptyq' WindowName: 'gxkhgcbzxefaucm'
- ClassName: 'phuxkzcsyewjcbmos' WindowName: 'nvweqaizamstgfosikaxdoanwdy'
- ClassName: 'lcwrtekdnowobsbutvcgpcqzprjjsms' WindowName: 'rmuczootigdhblijbimkreadluvijkvb'
- ClassName: 'jbtalsymwvlyezquqfefqbfzvtutob' WindowName: 'wzxnsweigsvguhhmpucgrlzxst'
- ClassName: 'ilgbnbjjehkqbtuqgpuhihosvurhqrspgt' WindowName: 'hzmzozrrjkntmlevylykcojxft'
