Technical Information
Malicious functions:
Searches for windows to
bypass different anti-viruses:
- ClassName: 'bwdavpdzuduviayppjivzbgjbskzuqczjq' WindowName: 'vtdhpetbpnpkjjemhrgyfgqbxpaticxlptaxc'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\nsl2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\Math.dll
Deletes the following files:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\InetLoad.dll
Network activity:
Connects to:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'cbdasmomuearjghx' WindowName: 'qeylxktzujbhgmqjqdxchougzpyz'
- ClassName: 'tzuljvzyahcekmkdfgsonoqxdonum' WindowName: 'zdripwwxmmlgjgygu'
- ClassName: 'odpclegusznvpofnrodtwgmxqqcuipomq' WindowName: 'btwvrypwriuuutjwlafjrxnjebgm'
- ClassName: 'gwrzcptrxrmhwgqyny' WindowName: 'kahockbfpkcikzslh'
- ClassName: 'etmufmhtabkzxhoh' WindowName: 'lxhxtlkphxxorcpayrwpxrifhoitk'
- ClassName: 'cjnlqpwfkrgqwyaly' WindowName: 'teirmwyyanjeowvdvkfpxetngycsrsn'
- ClassName: 'esrkjkjoqzedmxdnn' WindowName: 'bbypojmlkjiuvokcbrpg'
- ClassName: 'zgymplkcdzbphlbovrqyd' WindowName: 'qmdewfxqelyipjy'
- ClassName: 'pyfrhaznpmpjuqrjwag' WindowName: 'lznicxhvrvrrlguwhfunficbwrsxsqsomjxljtp'
- ClassName: 'tnrtdlxmihtczvmmkxurwqpodiycp' WindowName: 'rycgxasokajhuyfio'
- ClassName: 'jrovqrdmizkqqsfydgvmwmtqc' WindowName: 'dfxshkuucfobcelqlzxeu'
- ClassName: 'cikmribtssbqrjuolfllnkivgke' WindowName: 'abbuchqibmxoovopqr'
- ClassName: 'yorjvbhrwrkkgmoyoscqp' WindowName: 'aatybmaixfrbhcptgepiy'
- ClassName: 'wrcklyphyamfjot' WindowName: 'vksruwuwwpekpjjsmqpkytlps'
- ClassName: 'mmmedaxwkkumxlajqdjbprnbwaeur' WindowName: 'wpprteiyhymhsktmhoodpevaknm'
- ClassName: 'ezdxqkpooxgcprschfkrmlojzyrbveduwba' WindowName: 'glkabusbjgzqpyakiwnxmjhopi'
- ClassName: 'fbxbyeyzdboqiccls' WindowName: 'bylqzcfdhnektbixnojyoeh'
- ClassName: 'tmzvjxiqhkyhdgtdsjbrq' WindowName: 'wsieguvlgdenffjathmzwgcuogxsmqzvxq'
- ClassName: 'abtrzonsutibmrzfcqhbpymsyiyxjldmlczkbi' WindowName: 'rkzilxunmjbxyzi'
- ClassName: 'adprdcrawfnnumuysswklttl' WindowName: 'fxmlfzjhtfwvbjcvo'
- ClassName: 'omkwqvxibhcaraymacaiaeerqjvq' WindowName: 'dacnfykhiivejsotmforzrqzgf'
- ClassName: 'rcumzcyquesnbjexbymxtacmagevrzzrq' WindowName: 'ghtnkznzyidjrtdnuojhfmmbfantqlccfnlat'
- ClassName: 'qduszkhhfztmjfetsxrizkrobkbukfwfaxp' WindowName: 'swcpjvfxgeeihuigj'
- ClassName: 'xumhxmmadtndwvcrkvfkqxqnapt' WindowName: 'yfaszloxzbaenbnic'
- ClassName: 'nbfvexcovpjfbndyxaetzjdtjgypgkbsdw' WindowName: 'wffffnjvvmftbixknlrlufodotdcztpec'
- ClassName: 'mygnoluujymyxzaevfmopsdjucbmhennlglagv' WindowName: 'hyguplkwyzoiwiak'
- ClassName: 'lzfqhaewqiyooijtmxzbgqqheyhtfgybprc' WindowName: 'gcmnsxtyrsipjtvnbagsvzyuyxn'
- ClassName: 'thtblferiheqghtixywilu' WindowName: 'xholehswftxrkownqnrjelbinhpydkkvll'
- ClassName: 'empzfvklwyxyhepjzgpxhzpintujvvhagynbg' WindowName: 'unjsvqdwllhordwackavqobwwfkdkqvnxrkvjlm'
- ClassName: 'bhjtwhjddqwwaivfdewonbokfvbdhwjy' WindowName: 'xwtyrjeutwlpebrxcmfxnxqfrdzurrclprxwe'
- ClassName: 'nhatusclqdcjigkbgujcufrlatgmshnd' WindowName: 'sgvjundzghdqkvtxokegtyhm'
- ClassName: 'rqwjsrcmuhccnnvolkzcrkxeaqqlmsy' WindowName: 'rvxtplgpsuolgucukgtporskuplijoawhbo'
- ClassName: 'pvsqltzotuygxrjpnltcikcle' WindowName: 'xbrcuufgcwutmwsac'
- ClassName: 'rqckyonrnoibyqbcdjwgkbsovb' WindowName: 'bncfsoljkpzzchnfhufgvkrziygsxhgmxesvxyn'
- ClassName: 'dwhhbdccngqnenucicnapjvsyelosvjv' WindowName: 'btnirpczracmqhnrfawglnv'
- ClassName: 'weeohfkhhzsgzaccinyzlintbgrlnliuxsdy' WindowName: 'xvecbtgkzebwtlgqli'
- ClassName: 'xswyeljlclomkct' WindowName: 'kjdjwakwnvsbgzysorwanwzdrmwvhrsea'
- ClassName: 'uvgawrvktqjrutlxqjayrnrpzczsfdbyivqjgz' WindowName: 'mrscehjvnwisvjfyvcfomxx'
- ClassName: 'wrtcwfpidvltbpytkxrnwb' WindowName: 'iweulhlgrtzydrdznozmfklqvb'
- ClassName: 'snstothjoseehfrucoupjxfvgoehtqsofxdda' WindowName: 'uruhfmwebfibajqtvgkxxgvrjlxripztuepo'
- ClassName: 'mjhxsggmwtuhjgbgsr' WindowName: 'npanbtmbgbehadij'
- ClassName: 'jtfqzvypatagqwinaoalsikp' WindowName: 'rdtheaiiqxlguwidxcu'
- ClassName: 'mchakacrkzflynhnzopwjkttpmhljghmfhxzj' WindowName: 'izuquhkegdwxehmwrmyxhceoydlk'
- ClassName: 'kmmqdrmsoxflwfixvhobq' WindowName: 'lzonnenhnsxevodxvcnxldbhkdzzfylbhqambk'
- ClassName: 'upfbxicgbgtpojelfz' WindowName: 'hcrkepkkpiieuigkjnlrkovdmeyq'
- ClassName: 'ugvpsuyolizxjsrngqllqvghgkteqbwmw' WindowName: 'koqeajwnnzqkxucgffvkbgknkhkm'
- ClassName: 'wgmqycohzvpebgtgnbqdb' WindowName: 'dgbceknmntvmfpxxstwahrzeyxtd'
- ClassName: 'qkyycpnrjsxmxzezhatv' WindowName: 'ypjdppvjdxwzzntjpygcwoqpvajdarxfxk'
- ClassName: 'rwdmfisohgmfmizkbotlkhcbcylsbexcclunptg' WindowName: 'ndbruqvyufcpidaxqcirbgohnvau'
- ClassName: 'frsvkrwyaarziefsrr' WindowName: 'uposebjtmipevzpqsuaxjs'
- ClassName: 'zbfmjvskebjnmshuvclfikoasxvno' WindowName: 'xahejrdvmiaqsgfxmausfmwjno'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'savbbccxhhnktjl' WindowName: 'fixzlaoumzlrwzctpthsebcrktbq'
- ClassName: 'pjeyyyatieuyedtzsvzgjr' WindowName: 'ybvcreagymjznahsjkuopyoujwnnimx'
- ClassName: 'twwldblmlzewrohchmaxelqpqitc' WindowName: 'xbiiohywwyclsoj'
- ClassName: 'fptykaebqarvahqootpnmiwwc' WindowName: 'ftrzauilnqwlrnzktqxtsxeuftbklrcrmckgnl'
- ClassName: 'mkthujgqocmbqqkboulrgxlghkl' WindowName: 'hvxnbbjzyoztkagbevuwobymmceqxfqrxtqkal'
- ClassName: 'ubetkfztkgetcsenpsbbhodfqhoitfpif' WindowName: 'fkdbipyrlkqjzpyvpbrwjrwcuab'
- ClassName: 'hjzapdpletelzkakfkyik' WindowName: 'uqiqbxetxvhayxsrkopcyofllnrwpdqhuxxh'
- ClassName: 'syojnlyxjhqouuymtsbfaxkxkvpit' WindowName: 'cmukctojxstoqahb'
- ClassName: 'utnlslrymhfpnggetfprmlo' WindowName: 'gcpyiphsqpvedbzwraruzbhniqxtmufrz'
- ClassName: 'capnpxdwoobtokxwvlzgddjjjhjzjpoya' WindowName: 'xgegpbshaavwslfxykcfziwp'
- ClassName: 'dvatgaemqutlrumeyi' WindowName: 'vnyzkxelwfpxcemoulgiae'
