Technical Information
Malicious functions:
Searches for windows to
bypass different anti-viruses:
- ClassName: 'dwdxcavpudttezudsjyxafouysfmuzznudnpy' WindowName: 'foegbparpnnbdzxivxpyoxcsm'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\nsw2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\Math.dll
Deletes the following files:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\InetLoad.dll
Network activity:
Connects to:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'hbnazqipnxyzqucmalgxflu' WindowName: 'rzktvnqpjhnxcahzsdpnmvtjesm'
- ClassName: 'bxqstqxbtthobdzi' WindowName: 'evcdlzdpzkpzgiukwx'
- ClassName: 'wwwknmekhcskathemnf' WindowName: 'cbzviweydcdxavbfkeuyxbbgfrdspwmnaecjo'
- ClassName: 'xamnwxacenwhgqmivkircypbxmqb' WindowName: 'zkbkwrdffiuwmqkrtjkbvlhmygkcrobb'
- ClassName: 'sfpktlnzakmrrzsetyfkzzfaduz' WindowName: 'jctgdugmexavmrwjgoncox'
- ClassName: 'vbwilmxcwvgtcbsx' WindowName: 'otjuxgokikrufubpsxp'
- ClassName: 'poblwkjxsewuejraaiyimnrtthwhsoyusm' WindowName: 'jclkoowuobhruldrybbaiyk'
- ClassName: 'bekwwklvjyelxzqnmsexg' WindowName: 'lvqotscvioaxrdswobyqvgzlqptbbjbdcjcrip'
- ClassName: 'fuigxgrcfuunljpdfurnbmhlpx' WindowName: 'vcecxfedlyhpiigtocbgdedhqdkeyyqzzxk'
- ClassName: 'jflmanydrnqiglpqgoudznwbqdtdne' WindowName: 'sznblcheclgzxikcuv'
- ClassName: 'qcgrkvemdvwbxlwrgn' WindowName: 'pfgcnqrogtgevcoaa'
- ClassName: 'rzshrfoahfreweykuleluxm' WindowName: 'mfeuqeszkunedyam'
- ClassName: 'kkeqtuqhpbngxvwhgjckrdewbknmrqidcd' WindowName: 'exyuatzpjrtypiuuowrzl'
- ClassName: 'dxmsjihydraajgdlkitqpgkhoqkliz' WindowName: 'gxacyjlnvtsdgnfsulasxpblkhihwofqbb'
- ClassName: 'nufdushuytemqunqodivdtg' WindowName: 'swscbfkfzzxoovnwqlgjlv'
- ClassName: 'vdrssccojmwshlpkwuglmmv' WindowName: 'djigghmfoftdvhmjabdzonprvrfh'
- ClassName: 'tgqypvuxgnpcyglhcudpme' WindowName: 'wpdpipbbyqovwvklrozmuefvhuncmmh'
- ClassName: 'ejrqnymwfdshvifplbfojtyumfeamtdevhe' WindowName: 'nsqiuczgbheciwlb'
- ClassName: 'iddtghujrykwurrjcedblhgyiusyo' WindowName: 'zscqrospnwlqthvfhspxhivdludljaomkchcmhu'
- ClassName: 'ugelxviyiczfaov' WindowName: 'zgirdqcpjienomgcfmbuzbxxwixxdmkhlnrs'
- ClassName: 'iqsnnsqaygzinqabqecmhsvjqyhaaolxa' WindowName: 'mqwuyazpicejvthyqihiqygpewhicyol'
- ClassName: 'mzrjarmniqdntllnw' WindowName: 'ahdfescedffazwdwbqkrepziixkzsvgotup'
- ClassName: 'esnmfeshksskokyy' WindowName: 'ffzgbmoflighydi'
- ClassName: 'iavslzzmffxdjlfahbqkjroxpguy' WindowName: 'pxtbbmfgjnprfznozthsrqfswzgsmkorkzsg'
- ClassName: 'wpphnqwanbahbhy' WindowName: 'fjbzrwwcdesjbecugr'
- ClassName: 'cgrchksxiqwhgnmj' WindowName: 'svwoxncsnlgzklouivydniwchmyv'
- ClassName: 'rslffebiofcasukvu' WindowName: 'poqbvggcpdokgdhfvzjibrt'
- ClassName: 'xwmldylxopmahnxaitpejgiizhgvnqwyrgshfi' WindowName: 'myefagewmhcggkrofiirl'
- ClassName: 'vsjgrremyeolnrpdqnchtcrqtvkgte' WindowName: 'ouwkymswlmnktytwhquzlozeekqppgpwsxuzg'
- ClassName: 'urrjczqtabsxtsfnkkjgwkjqhmw' WindowName: 'umdaagsllukxmmhfqgmcljcpfjdzhwjklpskfc'
- ClassName: 'ucffmtcohdhrthfsiswr' WindowName: 'ulytghdqqbbfvucnjlnebyvkekzjpssotjezswy'
- ClassName: 'vkssageqgghveny' WindowName: 'foxqbqbiqnrmztlbqrmaxzkmtbwmufhfl'
- ClassName: 'qxqbebuteufaltvckzyniwgtlmttgliacujgxa' WindowName: 'xaqjvzymtumegvxvchaarboeuridjtwhtgc'
- ClassName: 'vkyisnclkqgjfcevpmmytppcyecnjon' WindowName: 'rjvyreepkmrefmoetnnozcluiarmdz'
- ClassName: 'izyzoqypsdkdhbccbpjerunkg' WindowName: 'egsfpyskapihubysacelq'
- ClassName: 'vkznxcglywgqypueylatzgubtwxn' WindowName: 'gwavldiolowiuplsscthngzctcacygnsemgyvi'
- ClassName: 'sgdbjdwzujjehlvh' WindowName: 'ttwlvmxsatcikyjippkenybkwiukpml'
- ClassName: 'flvyivrceoctrvthzzflpuapv' WindowName: 'veshjduxhuzcmalywpjktf'
- ClassName: 'hagpbifxwkowiwgupbrqmwbtmlabxixn' WindowName: 'yazlsxyqkwfbuhahleeeheo'
- ClassName: 'tufpjsauglauydwicnehwbvzez' WindowName: 'dtogvllybuzxebiqqeygscle'
- ClassName: 'zzdhizzrcbkljmbwmmvmifph' WindowName: 'jicccjotllugqiwgavkyfrfn'
- ClassName: 'mdiuratvtahwtbga' WindowName: 'glcxsmzixqviuwstrndlfw'
- ClassName: 'xwjcqweskkssndxtdmumbxuatxofnn' WindowName: 'jlovikfftzslmjnd'
- ClassName: 'ioxbcvbyibmarnowprjvb' WindowName: 'dmffdgykfjgdhainjterbtlafkuwrqt'
- ClassName: 'acrqhpyiclmxzzr' WindowName: 'mvlfpwfvqtiddur'
- ClassName: 'tajkpfycpyxakddeajyaanlmsodqlmtsjy' WindowName: 'kdrllwcqlmkqonpdqjdhpioqmnemoiiuvia'
- ClassName: 'rkvryutuwnqeautsvacrdmhlolp' WindowName: 'qcxbsrlggwnxfmrjmonzhnnyw'
- ClassName: 'oapmaemapgqoqswlnrztpbszgmgvbt' WindowName: 'cxadjvtgeyzjkqextauardnydpuxhppk'
