Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'yjenhaoymrzeljzoikmngxarypjn' WindowName: 'kpvnvfqhbgvttuzsxztfrbjvpyqavvifhlxq'
- ClassName: 'rojkgqneydqtfzsuzipcrviwfqoqizqnyiubj' WindowName: 'pjkowytlrfgkjotpbm'
- ClassName: 'vuawzzmeapdlhrixqjsmlxitkjmlvpqrysio' WindowName: 'gvbxsumpwaaesumtdbcbezmstphlczbsmljjo'
- ClassName: 'wumkdzovloxjvicqisuotxkdnmwybrqzv' WindowName: 'ndylkffmrkdbytzyqxxtdbzkyeqfsui'
- ClassName: 'rlbcrrypouuqyzjnooiedzrubjq' WindowName: 'ixuumtdsppdekme'
- ClassName: 'rkucsxnpbttzwjvsfijj' WindowName: 'uwvcicjivbvsfelh'
- ClassName: 'uwvsjgvfrrkurmquqcggu' WindowName: 'unnrbgbgcbwxldcuknkzhheirnizylol'
- ClassName: 'qiwevktppobfapjdiryqbzuly' WindowName: 'yfwmnzdvpemruyrosjwv'
- ClassName: 'warjtojfjrxwdlhkfwkwacjxmuvshsgykang' WindowName: 'gfacvjacvzcmsohowqagcpvpctlzqftngzpd'
- ClassName: 'yokyrkqzsrvnluscbrrfnrxkkvawjfbckfpo' WindowName: 'tebinmhcoksczxwwcbpqxb'
- ClassName: 'eljqlwpqxcuxmzprv' WindowName: 'rgsmbpolbrtxscxdbdpcpdgwe'
- ClassName: 'qhgekxbgerakoffhfppztfprlgzwtqiaqdi' WindowName: 'nxkeqxwlchkrfonkchfjqoqqueiegbcwi'
- ClassName: 'zzdbdpzdcmbzcrtfwertjmdqdfawvbphak' WindowName: 'mckbxtlcedwgoxcmznojuafptiktphncw'
- ClassName: 'muqkoqndwpljgzysqgxnljizwqyyswh' WindowName: 'pqzvqmjcglgclfilmjo'
- ClassName: 'ijspupoxbgcvbutertghxzjausqifjicb' WindowName: 'lrzsusbtpvvbttkixzqxgutkizfgzse'
- ClassName: 'xenochrdetmuplkqtquwviahtgwgterupfl' WindowName: 'ocjlfndpnxnpzrdmfzggaswnpwcchxvskpevxij'
- ClassName: 'kloupmyhlgeplrysuobowycvmwtplllqpbbm' WindowName: 'wwlihaitlcgztxhixgegjejyjplkbnw'
- ClassName: 'sbxuapptsocjqerajmuqodpolkovmjptoxqsp' WindowName: 'qjqryggiytzrvjthnrplqtnnjpsid'
- ClassName: 'uesgzadymtorlautiwqiqztrytgdgu' WindowName: 'wklkbtzfykqulbmthzg'
- ClassName: 'atffodoizzkntflnzahua' WindowName: 'cxdnhftexbwwubzkw'
- ClassName: 'lkrctclsfcbckpsetvivgknozzqvbfy' WindowName: 'punejmysancclxeysgjkxswjc'
- ClassName: 'gyjfbvlfmpqmroxpopjykfoilxre' WindowName: 'pkpyviuzknatromqendbyvctrdxurnlzgtt'
- ClassName: 'kbpcxklqxqgykowzjnlocmzh' WindowName: 'rupcwftsupmgbdhlshkc'
- ClassName: 'hblqmokxnycicezdpwaopuqtqhypzrwjquilnq' WindowName: 'lcqtnldoxcxdfnraacwievnuwemgpsuvptmybm'
- ClassName: 'tmgujdmconlnlqyjckin' WindowName: 'clbuhacdvquexoozhr'
- ClassName: 'yutvyeorfqostxbubmq' WindowName: 'wkkqyzonexycxvpvpcx'
- ClassName: 'dpscovihsxhrxjlnhsdmnqycf' WindowName: 'jljxkutqbhhbkdrrsghawkejxrw'
- ClassName: 'vjqoyplrwifkorgxaxeetir' WindowName: 'pjzffvocakjtigipjdikejoffefixv'
- ClassName: 'pyzufljhsikvfsrhmptllvrtdogecvyjot' WindowName: 'mlwykngrbtttkgnuezytivwwqp'
- ClassName: 'lptiydinidmngji' WindowName: 'qkgmwpkccfgjzqeaokxowthgxgdp'
- ClassName: 'oasucaejizwizmggeozrncfcvopxnm' WindowName: 'jxqwxdxtfxgotymwxqjfsmbsypkrzzpctgfytm'
- ClassName: 'wspdfmfpeyizmxjectjxfah' WindowName: 'mwmwxvquigqlbxhoelrdsobikzpmzfvc'
- ClassName: 'rllmfhzqqgjvpyodrscprokmsuhpzv' WindowName: 'cycvydmobrpdrnmkly'
- ClassName: 'zykncpgkxoojtapwbwcdjpg' WindowName: 'kmquxeavcvakdzvk'
- ClassName: 'bgsrttemmtkmvtrewslaprxeeptqpwtgsk' WindowName: 'getcznyecybdupmiccsc'
- ClassName: 'lthbpuytephgimwmlqbbyf' WindowName: 'pvxmiktpcuhxwtuhogyssmomdbswreyxbloiz'
- ClassName: 'jwpxczqsxfnhaaohvzhkoodgddhhcypfimzbr' WindowName: 'bmrtasurtzqglparhhtaio'
- ClassName: 'bfliopihblbejdjsyhiuzivxmfvaqiauogotes' WindowName: 'tpixlazwezliehutrupiepdaddqjiogljcwsgrm'
- ClassName: 'uiajlneepxwwzggzsezw' WindowName: 'eblpvyitxcwbmydimmkuodzvyzfhbyl'
- ClassName: 'emfjvbgqgbzvpyxhmhurriavjkmckpseqqs' WindowName: 'mpvvnwrvrnghqryvocv'
- ClassName: 'arhqwjeueiedlyijkueva' WindowName: 'rmdaedbfxjjyfeecuxokcvnf'
- ClassName: 'tbgukktsrudjflfogcvhwkoowdxwzroiyibkzak' WindowName: 'luqoatkyjbdnrmbpkvsbwoddmoteuwwbqqrs'
- ClassName: 'gdmxohyzgwecoepouazehptmoffp' WindowName: 'onjctssmhjnseyl'
- ClassName: 'rxcwlxmkzhpaylvkzjdfrwepowgeeqmxpkmjmf' WindowName: 'mrddmtdbgsnlrlduyijhzhjuszvxofqcmcexm'
- ClassName: 'znbozulzuwayftnseolbjqjlisom' WindowName: 'ooqsdzsyqwwnmoovxkfhqhziznqayrpf'
- ClassName: 'mlejoxgwumtbcdshqwqau' WindowName: 'trlwsfoqnxrflzkcbzgljpbfqbjnzthiyalco'
- ClassName: 'iiklgftimvmuteocwjupdgeu' WindowName: 'sgqlullboszsfghugcsxdoznjynhtnpswtgd'
- ClassName: 'lsfruxhtkpiewxacxdfexttzotiajipudnicz' WindowName: 'nqwlsftphmlyuyqqgj'
