Technical Information
Malicious functions:
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\nsb2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
Deletes the following files:
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\InetLoad.dll
Network activity:
Connects to:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'nwaojtvbzoejoabjvriqrvgnfriynp' WindowName: 'exrfhrcttcbahtxddfyanhrkn'
- ClassName: 'pwmrzbtqnfesiuerizfdhcvknct' WindowName: 'bzndezsfovnfsquqxcutixqdbmoz'
- ClassName: 'rxlslyqpjfohhaprwskxzm' WindowName: 'oyhamtivcnvrrhfwkjedafkz'
- ClassName: 'dbhrxlqowqxsereylgpootnqgcfpt' WindowName: 'khzgjokcmekaqyxwczcwxkl'
- ClassName: 'qkcqwolsisvxuyktnqlaspufllkzludgndjtd' WindowName: 'xckcnyhybbhezvtkhn'
- ClassName: 'pvmczxcmfsdmjnnyiunllmwtn' WindowName: 'elvkjoyktedflrgeywtrhkrep'
- ClassName: 'nbyckfdqjftnfsodasypghcydlinz' WindowName: 'jybciymytdtuazhizwzhhiojedcsofnywaoak'
- ClassName: 'idjvajzpposupzveyptiayzyccmq' WindowName: 'tzshptizyiqodedlpkvmmfqlbdnci'
- ClassName: 'neogdqsfbnxuqlntydqvvoxk' WindowName: 'jevnaioxtitcunapwurnggpque'
- ClassName: 'anmebqpdrropfpmgrkhezmnugovtwldvj' WindowName: 'zsbbfbkflanmikyb'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'vdztdemtqawtkvktmpqqukmlpa' WindowName: 'ftzebuynknonrrlszpjkimipcgaibisvvikdsip'
- ClassName: 'kwjofbcqkfqyzlzhuymnt' WindowName: 'bbkzdlvaingmwsghwabllat'
- ClassName: 'kpusgfosachopjoepwsdyphobbjwcdziix' WindowName: 'lnjwcfriknbitrrcbqvpiquaww'
- ClassName: 'yyvxdojmqmwelzwdgdyyglhhqvudacsgkxubhdo' WindowName: 'amupgurvsihgzuumagwsrdbbthhzox'
- ClassName: 'osfxtovnabqunnfu' WindowName: 'pozzqbylejmcwuxo'
- ClassName: 'wixevwvcrjdglcnmxohxeyuxe' WindowName: 'hmczhdeuilfwwrdfw'
- ClassName: 'dohbwzcmhireubsmnrtcucyrayeoubgqb' WindowName: 'tioolilnyoonioaxhzthchixcskaatdcvg'
- ClassName: 'xeqdmxdwoffgchssmzuornqqwhrwjfspvw' WindowName: 'llcpigqrsknkqxnoqpeca'
- ClassName: 'yxtlehqfavfinqxpm' WindowName: 'tliasnrdczvqhzoxrhlqktxoh'
- ClassName: 'ogtdhuhskdapcptdfn' WindowName: 'jmpfrsdrwiogrynselosguzawxifzxxqrmflcet'
- ClassName: 'qgnjoyjvjfbbpbaemdbmocspnwlwgwikolflkq' WindowName: 'tkzqwsjmizrjjtylohrlq'
- ClassName: 'ftikyynkwqteftlwz' WindowName: 'wxzsuezmitxxmeazsjqdzbcmv'
- ClassName: 'yycqdlnznzhhehz' WindowName: 'zanfldhqqihufepfnlxoeoxxzvdq'
- ClassName: 'didetceptixsgvyxr' WindowName: 'oshfnlchjellycjdparyrzgden'
- ClassName: 'zggpbkmfeifyaflfnvjkststhrnn' WindowName: 'zjvoczvplyozjdnsti'
- ClassName: 'zwacaeesggoddfpirjlzkvbdydbhwfxou' WindowName: 'cagwhvzjsucfhca'
- ClassName: 'cgcguonclqctpetdhnmtzccnzouqhvbti' WindowName: 'yxlidzdgxcjpdjhuaks'
- ClassName: 'nxxwcldmxtjefdynnjjitziaumkvehpertv' WindowName: 'fddfuacvumsiuqfiuivayxvjxootklcst'
- ClassName: 'psoighspfhjeymchlqbq' WindowName: 'jgidhdukkemlszxlc'
- ClassName: 'tdpeaisdxngbmkzxlzmsnudoizdhaul' WindowName: 'dyppyvaedqpsmnsgchpicrhibzemkgvqra'
- ClassName: 'wwllvkqfkpwzwlfmzhziphagtivecxeroohyiq' WindowName: 'akostrlalatqkyzxzqqgkvzszgbnfgmllh'
- ClassName: 'bwzxtcqourmhbpflwavzohpcywbfpywqjaglwbn' WindowName: 'oagfsrpfqhpfoignhkiumiykhdvpnpdqmcdwll'
- ClassName: 'fogfegbuqdxlsoyaltavlngfgztuk' WindowName: 'dnjiacfdihargciekbeeiviw'
- ClassName: 'kievkopfctkjshj' WindowName: 'cwiziupcrfnquenwonwedgfjbvsqqkcwutvo'
- ClassName: 'npwkppqipbkcogkkyfhforesvcave' WindowName: 'ftktmeyiqdictowvhwvqanmrnd'
- ClassName: 'gqiusblczizdtdcmlyaxcjom' WindowName: 'rxdrnuwafbgkseqqydmciopkbtiheusgfaevn'
- ClassName: 'ydymllmeftapeuvxxpuaepifioyk' WindowName: 'cahtasycxdhfpdccrfpromlrtcubfrsgsjpo'
- ClassName: 'jvwddtscfelphpmzngsyti' WindowName: 'rcknrawrudxorfwrfhcdfxgintnlig'
- ClassName: 'enhrlpqtkctqpxfmssvmxfbyp' WindowName: 'tdhhuyynyvherozokkcumuahrehmvytypxzirsv'
- ClassName: 'jokzrijcgtyxaaowdblw' WindowName: 'rapekpyemowkkuddpkvyymmsbhmv'
- ClassName: 'auulrnzmzjlblnbyshwnqxsqjvn' WindowName: 'kxachbgoafdnfzjncderonclt'
- ClassName: 'fodtquzuzyjvhmsmdiifzccsqp' WindowName: 'oxumnfmleiylwyrqkae'
- ClassName: 'cjvjpptpkqsgvoisupyl' WindowName: 'ekrvkrhudrusocp'
- ClassName: 'llrznyhnwngqigqugqxaniqibpxuarq' WindowName: 'vkrznlsuhdvmwginlpehbafr'
- ClassName: 'juayafuvzgkqkjdax' WindowName: 'swffbytfiuqvdeixs'
- ClassName: 'okyglucltkxjdiovck' WindowName: 'fjnsvdfziwlqrqroccfyzdt'
- ClassName: 'clnlllekvulhtvnahsw' WindowName: 'qtbjjikcticcyvnvebxcbxdfoosroha'
- ClassName: 'byctqgqqrqgrgsaxzxteayucnncomtblpevxyy' WindowName: 'fadaymalcehulrkqbri'
- ClassName: 'opqdegvyazvbnvputysgm' WindowName: 'plkwugytkuzdnrrzchnxolhlfincikltjn'
- ClassName: 'xqauynjuxrfnisjfgtcnuokatbbcy' WindowName: 'swafduvmkzimigzydxameitfguxvu'
- ClassName: 'gbrachxcqegqedyamhjqlcuww' WindowName: 'bwlwwhestqnnlgqotudhsqdxcdregwegpxmewo'
- ClassName: 'dxwqskkbhsfnsqlrojutdhosccorkleroggvtzg' WindowName: 'hvunxxdmjemgjgqvnihzxnqsohpcfqwodfzp'
- ClassName: 'fmftmibbbqqtgrtah' WindowName: 'dpcyiafrdexpjssyivixwkg'
- ClassName: 'wkdwfecpsewxrwejtojthhbwzevxadbgz' WindowName: 'pbnhjthekdnxkeltukvnwedfuwpncpi'
- ClassName: 'qgmkqvksctvgdcmfykyyicnsb' WindowName: 'qqvmbxqkvctncykhupwxhzegyesgqzrnsqddjht'
- ClassName: 'asxhglchaplthvxqmvqyusmalnemlfodys' WindowName: 'shfjmflwtuecszh'
- ClassName: 'iiotnxiriqmliyltkknoslylq' WindowName: 'dfnkirymvxkqlqjziqbzqupqbodxrhkpkujjcv'
- ClassName: 'xlrxsybnwuqxdlhchn' WindowName: 'gmlerqtqfqgbizpppkxbpzwdy'
