Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsb2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'vdotgoouiwxfewuetydgbpojyf' WindowName: 'boewwdlcqrxgjzcz'
- ClassName: 'krtshdafbkapnymxlwdsbzlcjptiltygbm' WindowName: 'voojqhvgjyqomhtkgtbu'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'pijuhkanxvlhbmrbs' WindowName: 'teagepkcwygejxotmj'
- ClassName: 'mibcamxtxftobeevwarttrduc' WindowName: 'insgvriqvnysehjdlhmy'
- ClassName: 'aousfsuugtiddtqxjyplksohtxepyyxqmfgb' WindowName: 'iztgdiznnndwhxabvvfmjzypqp'
- ClassName: 'wysaqulukjdsfbb' WindowName: 'qstekwaptkunrqavcbtuwwecrbukuyztva'
- ClassName: 'ybqearxrxmcpwyuwwbmrpvwujjgzergjemzoih' WindowName: 'xqbczuwwfumbnbytctibvredxankqhtnsycjex'
- ClassName: 'jdpoctciivilpsadisgnbkswnwn' WindowName: 'rajnpsbkwugebuptqwf'
- ClassName: 'kwcmplfacvgyhgotstcxmnkxcfhknivtsgfayi' WindowName: 'txrmgypqkhxkvxpczqiadkzpqunhpkwgeko'
- ClassName: 'lpbegepxnkhhjstgztjkofwqahz' WindowName: 'thegulacazlfmkwzrmfxzvasi'
- ClassName: 'uyoibpvowzzggdkzmrzvxyxoczxbajwxifs' WindowName: 'nvhkdcmncinonaqltlkqadyaixudbzkuuqfsg'
- ClassName: 'iifuyvxcymneobsswndqboeycnpllxixculfwyh' WindowName: 'qoleqjjwhflljdcduyvhracylyfoyarvvopa'
- ClassName: 'dqebbbcxovnmdhzbgwqpdxvbheajqx' WindowName: 'mtljveitxaojprbfooomxqddvspdfnk'
- ClassName: 'hblzydgcdgpivmmlnthnemepqvyzbskc' WindowName: 'jokzvddaiecfcgnhttcyxvnoqyuxxod'
- ClassName: 'mcvrsiganqbydpnogjlgqaydzgfifeabopclg' WindowName: 'xwjyjkmbqdujsnzxzclkplafglloyjknwciie'
- ClassName: 'dpxmxatlhdmyozgujonpadloybgpxu' WindowName: 'eybnspoticlqtrwdfzwsbckpanxr'
- ClassName: 'clglcbgucbwyeinmlqdtdpiulspierfriufrct' WindowName: 'nfjwyibfhvqfcrlqjspmyrpx'
- ClassName: 'czlvfqspmicquuqumoxq' WindowName: 'fxbjjpejmgcykrtultgy'
- ClassName: 'cyvdkadqesaedsebigungjixhwb' WindowName: 'hkyzxfoxalfgzaoounbqhvrddbmsxzzzyxbqoj'
- ClassName: 'htbagubuqmngpaxaeyxa' WindowName: 'fzyamyxkywygiayczevpek'
- ClassName: 'lujxukdwwaldnfhqyanffotjjfgl' WindowName: 'gqofusacjijigmygqxrgywyqkuyoehcasf'
- ClassName: 'hugoaipvuzjiryedyzgkfq' WindowName: 'psirtxxrebbyfejy'
- ClassName: 'hvhfkhluepetyvsysyvceyzsxtznkkvvthxqzeh' WindowName: 'ubhcrsekbvfrngstv'
- ClassName: 'uipfmytlmlxaymyxgcpazwfukcvznzkaefcgj' WindowName: 'pqepmbpfdkjuutjedfxkjg'
- ClassName: 'knqnylgfeojkchhhq' WindowName: 'yrjihumnnjagklcpxamxzybkhjpwqzgqei'
- ClassName: 'xmpwtilkkvzewkypsjh' WindowName: 'xebdhbauwlkvzqfdqpqfuyqdd'
- ClassName: 'gzfxthfczcddbutchpmfs' WindowName: 'tlseqdwonceezzbxxbpzkexpqlpssclcbtoxnlm'
- ClassName: 'pnugglihoahbpyfeafunh' WindowName: 'rojvertxexpbjlic'
- ClassName: 'tzchtxmciygguxdnxycjiptdyigllmsbjazxeb' WindowName: 'xrqjtjiaesafhbewkzdjpcxzbsm'
- ClassName: 'xukllhhxlmepkkamxgltdytpxabzgeow' WindowName: 'pyetyjmmbnknxryudxifevnqdeswltrlyxn'
- ClassName: 'genvpwjkoppphbsxhxrqzjgeqy' WindowName: 'hbobztytfzvncgbnwezqcgzasodcvlg'
- ClassName: 'rslctitypulntpecqgswxyznzby' WindowName: 'inpleyuymxfnhnvsmkbflouvbujadwjwwm'
- ClassName: 'sjbrrrczrydrkboktnub' WindowName: 'cbxsyhpbzbqxomsovumchnx'
- ClassName: 'wfvvfwxajfqmuvhxovdarsszysgmsoilzy' WindowName: 'vwawatutgxpcnuageaogjewona'
- ClassName: 'fuzufhpkrbkowqhfrnldva' WindowName: 'blictkpblnruvxecyz'
- ClassName: 'zkjqdikaabhqhglyjurlsdaxnzjungm' WindowName: 'zxwpqqhkfvlsioueszllifabcombn'
- ClassName: 'lgfqqqempkyavbmgzfzwwohlkaaixbeyq' WindowName: 'uggtkldpijttkloowhmjghjbhngdzvncjt'
- ClassName: 'zbrxzsskzkirmqhxinjbamenia' WindowName: 'ydrmypjlqukalljxnucaveazfahdajcr'
- ClassName: 'dcyqhilkcefaeepombiqyczbswmoyfxiztz' WindowName: 'ankuqlxrjzbomlbrxbyejiun'
- ClassName: 'rvosyisnobhxzjlkpdmwgskpeha' WindowName: 'xprlszlsdsvezwtwvbwpugdmzrgeeiqpupp'
- ClassName: 'gphjdkvqdonstkcn' WindowName: 'mvviopgbsfrvbwrawg'
- ClassName: 'oapvfmmurnuhmngyj' WindowName: 'reoupkuqprxntaophditupbkqpnnyznkaeycfu'
- ClassName: 'gprgvtkoatikrxetfywftqeoyitwmmynqeizacp' WindowName: 'boeveqthliybmiziecgcrsosmmiamslgt'
- ClassName: 'lbjtfrbyhsyoshisrwlgcskuhbdbf' WindowName: 'udrlnwtxlgarqeinmljvk'
- ClassName: 'twfimghacaxnayrenvnwtcvqjttwwnzihla' WindowName: 'zgvztkndcveaalecbb'
