Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nss2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nss2.tmp\System.dll
- %TEMP%\nss2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nss2.tmp\System.dll
- %TEMP%\nss2.tmp\Math.dll
- %TEMP%\nss2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mfewzlfhdmkvuumaxzfuuvzdbyvxnmozop' WindowName: 'ezpwexkeeymqqmcapyhzawfjbf'
- ClassName: 'crrhfptdmpxhcuahjk' WindowName: 'jiighqyficzqxlojuit'
- ClassName: 'ffrsswdcmdwzfwphh' WindowName: 'cakeiwwasbsknqnhwli'
- ClassName: 'drgtrdvvmxbbtintf' WindowName: 'veumsswviizdjejfjmrtxazlgyyqlmisbbpctvn'
- ClassName: 'hbftemfzhwtlaexxl' WindowName: 'vtsrztztitaycvztssiieo'
- ClassName: 'yqlaowguqewvvoktdxlkmnw' WindowName: 'qwsxautmirspaqrhoqx'
- ClassName: 'seleioraijhceqvgfeiulstlckdns' WindowName: 'mwystgzmzwtxzwaqeeik'
- ClassName: 'jefhmwvipolyinlsnrjlimrpqqgwiqimsdatxi' WindowName: 'joplfxwqqgpwklrjlkabbnypryypyhvisiqfmih'
- ClassName: 'gzhlnkdltbumsbub' WindowName: 'xvysyippumblhzuhoqe'
- ClassName: 'fltphchwwuzhdsoqikr' WindowName: 'ikbhybzzgftwzdgmoatyoq'
- ClassName: 'fxeziksmuthtlgnnwfiobp' WindowName: 'myyekksjaqryufrsxvfaasiyuuesxakxierpsa'
- ClassName: 'titmhezdzzbjbpcuvfjkoqgwpnsofeowhwk' WindowName: 'wzjzziurrlrwwmvfdr'
- ClassName: 'osvfzcvcuqcmcqjelqc' WindowName: 'isvfrfhtzqlppmlzjvwhgoac'
- ClassName: 'utiiobfmkycwxkpgdypoxfbqoyn' WindowName: 'dnqfhdtjchfppuiqawnmtfvumcgbj'
- ClassName: 'udjginxgulxzuwgf' WindowName: 'ttdobesvwzuotzwoonjigkjmk'
- ClassName: 'tcpffggaapkmhtyidtimbjeeeqaxrdynivfvxnq' WindowName: 'ojvjbmmdajfxmxogqtjawfkfqmipooyxlvmhcaj'
- ClassName: 'vstmbirxqytihbeflfpbeq' WindowName: 'qqnwdeskcspwhnipaoeclxv'
- ClassName: 'dbmwbaelskthdskn' WindowName: 'qzfbufcsvicfvhfaamyclnqbdm'
- ClassName: 'ouxyhnathexqmhifwnbsgbzmjsh' WindowName: 'klhbzzgnizbusngrykmezcvtjhoyvx'
- ClassName: 'rfpggtlvuugohqoqmaadtegrfovsbsbirt' WindowName: 'yygmizegndhdvfpxhszvpdrvqjihlnz'
- ClassName: 'oqkxiswwrpscuefobkjwgjihapzj' WindowName: 'qyvvagsbfriwrudybhwltllv'
- ClassName: 'dgevqnslxuhtowdyhqetkqpwdwdsxhqtwnexcjn' WindowName: 'kbqwvrqbbdotcll'
- ClassName: 'onbbzhauwoubbenbhbofh' WindowName: 'skkjjxwcxnrfozvmwnowdngilrcfynvmsbfot'
- ClassName: 'rowgkhmzrsnycywzxgtdkxemfjatzxzudm' WindowName: 'vvfqdnrnonlflhppx'
- ClassName: 'arituuhcilhuqykohrekboxcglrmjpx' WindowName: 'qseamsrvngzatsftulyuszhjtsvukr'
- ClassName: 'zyhurtkawmhrtciivokvksbedy' WindowName: 'nxblhzkxfsogaiwyzkz'
- ClassName: 'bszrdsdnzgmtjvchmareylzclmhyjlixclf' WindowName: 'mstlmpfmybbpxnebrtlmyjkmpwesqalcxxh'
- ClassName: 'lwabkqiiwfrljcxrnqsjvg' WindowName: 'prwqzxlweuuwjxsutfjnsaejzr'
- ClassName: 'hqiqprilcednxtectcsxhkcenvhjygzbidgezi' WindowName: 'gpfnzquodbyttvvzrsoiwltwp'
- ClassName: 'vmlmbllptgcocckmjbnmamdyk' WindowName: 'hxtrkcfnzkamjlmsssunyngzw'
- ClassName: 'zgzzqqoidzbwobkatcxkoqqkjrsa' WindowName: 'vxyutshlddtliewolryipnjxu'
- ClassName: 'trbqbnsfrnvsgrjgodclxdtb' WindowName: 'ltsxshsmoqdytnuezsb'
- ClassName: 'qlupeubuebagvzs' WindowName: 'vsrajyvsrgadfmu'
- ClassName: 'jkhpncrraagbjooxfdnakpxydekenrujycynw' WindowName: 'vwkuqdrjrjjibpqssybkirqddgdajzuanpruvu'
- ClassName: 'dujztwgzdhgirmlgnvqwtyygrhfbqusjtpmbkye' WindowName: 'cmynhpqjfhzytndsamdegasduxa'
- ClassName: 'ywlghagcafzpzdujfinkrlkemlnsnxefhmn' WindowName: 'uhrsjwrmkvaopmbdrdvetgpxtojnqmikjtsnuf'
- ClassName: 'zmamuouvpaqfrfwihljmmelqsgoosozxkgrxhww' WindowName: 'ichlycatdtdlwxaphsrawznewzubnlz'
- ClassName: 'zvfnkturlkoaxlzau' WindowName: 'pdadivrnhsfxcqxvlniefpxs'
- ClassName: 'qfvqqmtkqdhsfbhnvgtwuajzjsrwynoojlvxhwb' WindowName: 'uisxblkzwntwxpf'
- ClassName: 'kalsjnpmdiqzqvblzsnoumibuwymjphwg' WindowName: 'mjhlizyhyqvmejftmey'
- ClassName: 'wzujpxhkhaahlkzrmjqa' WindowName: 'rpnknsmbadooybpdodigmvp'
- ClassName: 'mcitvqgwkjlssrncxe' WindowName: 'phwmsztyxoatvhvqnxbwtkndnvlya'
- ClassName: 'nzvxkibxnsbgvvjnmoz' WindowName: 'qwuzinlucmodgjvl'
- ClassName: 'emcqseqqhkjhveh' WindowName: 'iubcudpfyjxtttpuxnqtcyqxtcj'
- ClassName: 'geybwtwvqqefxdbfqgfsbu' WindowName: 'cwxqhupuqnrdjzpsvaqushjeuuzrddaboxonujb'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ivfruennvfxytievzuqa' WindowName: 'raqxjibkdlhtqncncjmnxippeqdfltyu'
- ClassName: 'zawerzuyvspsvufppxfrrwqjtszqdxzpal' WindowName: 'ezncvgwcdvyuhfshpktpaqmgqshxxfqwgnf'
- ClassName: 'adexeoizyuoygikgxwhimbdzfrrsztu' WindowName: 'mryzrcaycxkyhmcihtghxzdsgdpl'
- ClassName: 'paiwgmubjukhwnhh' WindowName: 'xfwbyzsxqdenjhdhvdnmxjkdzkrfihmi'
- ClassName: 'lhdbrbtnsyftyweslkfygemowrl' WindowName: 'rcrxtncysjlsgqsbiacupkgofbiylmajgzyxcok'
- ClassName: 'xdjozaisyfsjakkcwwiwxrhjvpipqaidiskx' WindowName: 'aleenhfmquxvijpojiaojiojrksqfahs'
- ClassName: 'xbgxkrhymrqsrowdqkhkaeaitbvyjemediudfqh' WindowName: 'oeotsxsssoelqkwhfxsaiqammcskafxetygbpt'
- ClassName: 'isxtklpldyvrpdrxfhtjhcdpndwesxxvfkwmx' WindowName: 'kbwrnglyqlkypintwpoj'
- ClassName: 'ebziquhdjnxklpmlocffmekjhtwedsmt' WindowName: 'ujjnpuojckywrmgwn'
- ClassName: 'kaxpmttcxnhhijubjnit' WindowName: 'cvqisvdwsbkiakxseniqpw'
