Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'eaqjlbralgpphmjhnynzdbvbkkg' WindowName: 'ykunccuberyqhgbovozofrqykl'
- ClassName: 'nodmnhbeqqlnsfustsbnrz' WindowName: 'ttdnapatxpynyofk'
- ClassName: 'wcnixfxnhbpxtjhjdyywpxaf' WindowName: 'jywbbqvbkdddurfpgyjtzkgwzna'
- ClassName: 'vkuqhpbxaoacutfuiwoqov' WindowName: 'oisuerezlaoaxvcxyamiztmuzkdoneucgkviti'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'gdoyzgqbkuujjbyobrbqcsqxsmtixyiswn' WindowName: 'wveyrkioaxoqrby'
- ClassName: 'rwtogegkzcioonledhzhwftjjmgqijgcrjhgyty' WindowName: 'aeuxthxofkgiaskpuzyochlbpbrwiqu'
- ClassName: 'brxdvqaskfexbtgdbzwilbfqjodktwxbf' WindowName: 'ggwdjqltyxnnocfmpeodzoevrazixdg'
- ClassName: 'svdxvwsjhkdcfnvx' WindowName: 'roytpqkeropduzbkyxsosipqzzjatitppep'
- ClassName: 'juawecbbblfeabtkvtnzabifkayseufzqz' WindowName: 'akyqehqmvassdeozjmd'
- ClassName: 'aezmbcudrqzezwczwpxqhm' WindowName: 'ursratxouxvqhbifmutgjlsljqmybjlccffj'
- ClassName: 'lnruhxikycurjeldgzrrtdy' WindowName: 'wgqkbdtoyfrolvxfunsvfroqw'
- ClassName: 'thzkcrmiiwkulrsakzqrftgajdjldj' WindowName: 'udhnjmaqtpqhtbvzfipyiiutpzroialqgn'
- ClassName: 'omxdfemmlwvhxohdgoiusoukzi' WindowName: 'ucbihvchncgaccoeifrumjjsrmayycx'
- ClassName: 'hjrzxvjwqeamatxzxwbqjmxmktnjgtfexhojvsx' WindowName: 'ulrvcoskxwojvsoipsrrtdjkyt'
- ClassName: 'taqdfrzvlfirdnqrfxop' WindowName: 'oboppvrgkyfxcgxqrrryxuoxnnp'
- ClassName: 'rgdpdfuzvavepsigtcjgrucxxhp' WindowName: 'bqdgkeeialyquflbzljjkjn'
- ClassName: 'mugglzftvjltnkxakncrgolqso' WindowName: 'nzsnliwexkhozuhetyldxgpgwfzqozazfdzngr'
- ClassName: 'mecftwqmmonjdawqjoiyuopwoxar' WindowName: 'swpqwcluppghzqziarvbvwcysredsyatsabgvp'
- ClassName: 'azbpdmrefvyftljnpsfgirurj' WindowName: 'wkgimkdipyshdllopefopdypvggiybpwjpmh'
- ClassName: 'vgmkgjalnducnqjgrpqxzhqj' WindowName: 'qwlzoczayijhmlhkmintjpqfhtgsnftyhaqeofd'
- ClassName: 'buakwzudsijaugftiresyaljqpknnnjgqugjeuz' WindowName: 'koskchgzgimzqmsxsbopjzspzlk'
- ClassName: 'faoivmnqxegfutykzng' WindowName: 'kqbbppqjqtgbeyzztyqrggxhihwvaskoaktjyi'
- ClassName: 'yqjmtfgvlshqojryqnpplwpjiiaals' WindowName: 'plmftrupuszpbnhlzwqzsyyrsuos'
- ClassName: 'hewthelcrjtklltnpnntauedfykmzwlo' WindowName: 'bslbkswfzxyiswgympykiewcyhomqcpsdbidus'
- ClassName: 'invlywgeraochdvoqwehiehumcv' WindowName: 'cxqabutjtzmezivvykvnnkxhx'
- ClassName: 'vvqdqnmcicvltmvjwzkdlibdllwahkejxzz' WindowName: 'djfsenerkqfgpxwchejuwwlqrhmqemhearri'
- ClassName: 'xdmqodgvrvhzfamwhbsvrq' WindowName: 'fdqzsdtbbibhsrqppxeplioeomybnhk'
- ClassName: 'bgnwsplqpuouqpgxvkdfljfo' WindowName: 'ipzhjkjntnnptjlpqdvqdlyokckeahlzspg'
- ClassName: 'igwxwgqhxasipuiut' WindowName: 'dubuaixlroinzjrwwoairetyrgh'
- ClassName: 'liwjpffosdlfphhog' WindowName: 'hpszynwbnnbcdsncjuqsqw'
- ClassName: 'vhcszqkqdzmulpkaulqzgfjli' WindowName: 'brrhsooyfgsohjbardoihrepaspsekpwixg'
- ClassName: 'wdhzfzmzqfvfgztlghskaqgofcxstrtydkm' WindowName: 'pjjhgwjwbwdhxlqsofxrshacgrkhrip'
- ClassName: 'vljgfrcptxiequakyrshxdrxxsw' WindowName: 'dnpvtweqvmlptuvzccsywxrsgz'
- ClassName: 'abdutektfuuppjyilaixdvdmdf' WindowName: 'svlferxaujjhfoqwhvmkoushumhmztpagmnelb'
- ClassName: 'sxqdakouwpioqtdzrbpgrvfktvaag' WindowName: 'rvkrryecpvmizqlz'
- ClassName: 'xioyplfwzqlicmliuswtgqcuxytzfhtgxqmmf' WindowName: 'kvunymplcirstluwvsejbifjbyntgi'
- ClassName: 'kjaksjbsbbcouytrvjecpvdopj' WindowName: 'grhwofwkqsstlwtzwfanzqhzurdfac'
- ClassName: 'ajluuxptjeauybfqpxbwhyhjrkffzptlycf' WindowName: 'rvbumzfbrddznfznqonqaojkzjlgjvsr'
- ClassName: 'hsegdbrnnosnbantqocrfdteky' WindowName: 'cmjyixterpcvvdfqiwpqlef'
- ClassName: 'vlcowanjiouwdxyuvhwogrtqcwiolustarw' WindowName: 'okfpabpeierawxn'
- ClassName: 'nxivwwoplunwbioqwsxu' WindowName: 'nlzwurzuitntherpduloiqxnxskc'
- ClassName: 'ouyzayxcxcdnmvwypjbzhswyvixpfvhcpilqjd' WindowName: 'iihyrsyrttkgcuzgktvqcbpuggffsz'
- ClassName: 'oceujzltmqzofjdooetoe' WindowName: 'jabyumixbnaelcbcqjqne'
- ClassName: 'kuoutnvparqhtxieiesetfzpadgljgjxd' WindowName: 'ulaksbfxxsdrbzzsjxvikufrkuqeldccsdpad'
- ClassName: 'lykjptwldztgxvejmlkzthtlgmiomgqmq' WindowName: 'rcmyhfgpimhggecfokkkdanvnm'
- ClassName: 'trdwodctjybfiiapcyqwdxcivbp' WindowName: 'kdkcxfgpagkynkuripkgwxxzbdbjr'
- ClassName: 'bljmfjldnmyptieoigywxirbneiwjawcfbxttoc' WindowName: 'kjnaooniccroyqgdbuzhcywedydsdk'
- ClassName: 'oprsrobxwlyofvpzulq' WindowName: 'brqmmzrolyqtzjwuvsvxiuptnwopoilbcppvm'
- ClassName: 'egteovlceftdmluhlpwquhfgwc' WindowName: 'rjijmvzcvtyxbrqyjfqugmjxnblomila'
