Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\InetLoad.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mrvvvbkfvewktygsbgxwchbtvktpo' WindowName: 'qmviojvifuwgiiawruyqlmzvrk'
- ClassName: 'mfxtcmzhfqskncedkup' WindowName: 'nhxuoyisoumkigj'
- ClassName: 'lgaexkclcmgvhdedsytbtdsruymcat' WindowName: 'daykjvrbpodspwmbiltgifxp'
- ClassName: 'zvxtoprvlgtazzibwqtgbvgmfpkxbeqnrb' WindowName: 'psshhruhueueoknlang'
- ClassName: 'nagwknhjxafyvtgtvoytmhvjnnxhplvpbynwwdy' WindowName: 'ehywbzfsfelzwbraeljvrqdvthsqgmbh'
- ClassName: 'nsbtbxtlkrnshglf' WindowName: 'dnxufeqdqgodjlucvrkgghuzddisqxqywhyrtnx'
- ClassName: 'tpjgxvxctzhlyzjcukzph' WindowName: 'bprhhjscluhgehyqw'
- ClassName: 'elxlgjweknulddmmokbxts' WindowName: 'obkdlrypglzvndlk'
- ClassName: 'puixdurevhiqloouxpvco' WindowName: 'mvzfufspjbeylvmeddhgvvib'
- ClassName: 'cysspaemryhmiptkqkkn' WindowName: 'vqvelkxjizlwxmt'
- ClassName: 'hujngxthszitqwbouxkfxhciyyazcyh' WindowName: 'iaonrqdzzwmyakuujomcldcacpgvk'
- ClassName: 'qsskcbjcilbjpdbvxtbnrir' WindowName: 'tfgcbwxwrtjzrahjyshqnengkaqigspnnz'
- ClassName: 'updgvaopthjlsgxevphtejtloycjlepx' WindowName: 'ndmotzsusuynomw'
- ClassName: 'pzadahuptjealqyuenj' WindowName: 'txbwupvbwyeqjvenfcncifo'
- ClassName: 'xzwqjyrptpdmyjzapzy' WindowName: 'pekkkzpehlowsdgmysybqzgclvvkargjjvzgpw'
- ClassName: 'kknvbqfexbtywelhxkzgowpxofx' WindowName: 'lplhplvzvvwayzdngmxqpsgffmztw'
- ClassName: 'kvpjyngqbuvcmtbpwosjmsliytwphlzddeuod' WindowName: 'oaalbpcfxaarvpsevcxhvqgxgurwptzoz'
- ClassName: 'tzrqpvmyonpzameqistdrvwqbqusqxdiep' WindowName: 'bnfieusvfuhoycawjzv'
- ClassName: 'zyjipldedyaxijhssxakwlaikaqjbgzrlxgeva' WindowName: 'lxofgsgxhfkcqrejbpj'
- ClassName: 'rprxhohkgravcezmyodvqdnosfumjyabstp' WindowName: 'ripnpcnqtksrezcnnfdsdpxodytkouhdhqgmi'
- ClassName: 'ewkkzatrirllymjot' WindowName: 'hwqaksiqnzarfssmkajce'
- ClassName: 'aiwhrkgkduhynrovdfg' WindowName: 'iybwvjbuslkkalofhlqlavwydy'
- ClassName: 'vwjhgbxxjflvwnfj' WindowName: 'tckvraseknorsfkmnepsihivxuwncudi'
- ClassName: 'tjcixgivrjvxhorrrayvezt' WindowName: 'ohzcpyffxzqzyki'
- ClassName: 'vgosjlnhkrrgksorfpnttflntwzikateqh' WindowName: 'zegzlyidkigbsbuftjhigfc'
- ClassName: 'tifnnjrkfemcczqsdqcnhoktpditqjtfwi' WindowName: 'ualighgnmylvvhjwtil'
- ClassName: 'uvpbgihnoyshgnbvsrygedxhdhyzixuuq' WindowName: 'ktanllppwqzgscnyznpmdjnzbtupuhjjwedjup'
- ClassName: 'rtkmeqigedtqrvtzgwfxlyodgfdrktydkdqs' WindowName: 'vipztrcwgsfqwifejkrgjoprpcsyw'
- ClassName: 'morbspozdiiurijbafgbzbrhbuarymyfzgras' WindowName: 'qtmbbgoqafyuztj'
- ClassName: 'ggyzvcuyysqkhst' WindowName: 'fqcsamdtztnhrfdlnxgncqnoyxuw'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ntkmsvsjnkxqgmxzkaoif' WindowName: 'lylgjfqruuipdxhuxuwgcvymy'
- ClassName: 'jjsavbiqbzspxexjhguchtmymtubhpjp' WindowName: 'sxivbwqmtathenttjrpjvok'
- ClassName: 'eovrhvskbvcjzebztfeadhngogwjjxulnja' WindowName: 'dyfgjxbucvxaxlatbwvrghkbtdzghudyzmrmcb'
- ClassName: 'acsbktmckopadijrueghnnjam' WindowName: 'sglcbdniswrqgecvglhvgvkhbe'
- ClassName: 'xhwcscvgxdkilys' WindowName: 'upnpiadgdgtcrhdriwbqczzrqh'
- ClassName: 'hjvpnmvoqhnicziuzkzbhilyvmbkvvhswv' WindowName: 'fnjkxgusxpuqjssbczqwbqrufm'
- ClassName: 'dkpgwghwyclfwyafkzwfwsbnigvbfgp' WindowName: 'olqerfskjwrrhzlqrkfdutf'
