Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\InetLoad.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ueflxzbusoizlrbsbwdjvxkrgfujo' WindowName: 'htywtudebyvqpygtuvownrloogqjkpfh'
- ClassName: 'rsiopmafirgcxcrgfvrncsqqzilzay' WindowName: 'asdycbastdzzdagprjcckfpbygzlbn'
- ClassName: 'oiyungklpnnzpyxwrptyngpyvgonalzmcqib' WindowName: 'vxkjswngvpevvrkvuiyifmueftwhicsfpi'
- ClassName: 'kicxerjspgbqhdyhdrlhoojbbic' WindowName: 'nfbeybkxxopbtptvg'
- ClassName: 'mfhxxmbvvylwyawf' WindowName: 'ybfixwpysjddorarjwnuasesqnjhynynzrfxuq'
- ClassName: 'rznhhnytvmdrkvhgwalqmztnrogptpmrbrd' WindowName: 'wjdbhurwkzedansup'
- ClassName: 'rgjvddajkfmdyxnydzcfe' WindowName: 'franooptackyecfhrx'
- ClassName: 'evbjkgxrcaovgtocpk' WindowName: 'jmbusfelekloppizeuvmywtcauceysxybpuo'
- ClassName: 'utuppylwdrodlkzsmmockoyym' WindowName: 'mdhtllixgxyvxazmmy'
- ClassName: 'lwfovupxhsuurkhxsepkr' WindowName: 'kozkrhszoozvstwylynmpnjsbalu'
- ClassName: 'zkkquzbyxdkytzwuwaholwnbccynkr' WindowName: 'rizhyhqzkcbqvffkhxcd'
- ClassName: 'ltxbhhmticbpkobafwbflbzzi' WindowName: 'pqgwhcuoooqznoucoyyfng'
- ClassName: 'qphncyhknjgpopoyokntbgrhdmkcucxsv' WindowName: 'irqxajakjrtukjtttacbxtrrjgcmgisfmqlaxd'
- ClassName: 'celarzmqhbtimuwcgbzoo' WindowName: 'landbgpxpkbfoekqygodj'
- ClassName: 'xocnraqfoyqmlombwcbidwyhmgu' WindowName: 'viavfguqfplxzcsscbshkpqewjdorjhshkowkj'
- ClassName: 'aymaozuvlgmyvhmhyqvnirzvzzbgdpdgw' WindowName: 'asoeuqnyibfxwuvgqvflqajpdeaaxexczmzpcbj'
- ClassName: 'tqzlptyrzfjwpakjsfpidguercinmkmembkdemb' WindowName: 'ztclqyzztiovswronrgd'
- ClassName: 'mifjtwnfqimcdvymhlslhawrzhcoxwfucfq' WindowName: 'twdpokpdpcpdrdpmotj'
- ClassName: 'lzifijlbdjtsehlkfsrq' WindowName: 'ibbmpybrgpdinorvicgmhdray'
- ClassName: 'kbpbpgrgzyppbgmiorgrhlsxwcyjaojlv' WindowName: 'zovveknvcdbdmaamytuizeneqsvblzgwpfbtzl'
- ClassName: 'wzkllwthodnyyupxfejzevaaaagt' WindowName: 'gawciihrhlqwepstxllfrovo'
- ClassName: 'xcinwvanyahrlukxey' WindowName: 'jyufofmpjuhxxrlrgjtjdva'
- ClassName: 'wtixzwmijxtfajbcrmpsc' WindowName: 'azkpemioskjpfcffifkfsbcwsyiaifyvpqt'
- ClassName: 'unottukumdacawarlosbrlffknbc' WindowName: 'uygyohrwdqmrsuuazvgrubdnirphd'
- ClassName: 'fglojlgdxypkbrpibvuagsxunwywmf' WindowName: 'dzimwqluhgxemjjnifh'
- ClassName: 'tsgylhqnytpbbdcxeatpmkmp' WindowName: 'zrultigasmomiqbbgdtjqkizcyvsqmguryi'
- ClassName: 'wtjnzeujqszgmdwlekfowopulmbpaoqvv' WindowName: 'lcfzmwajnbhdjhayelj'
- ClassName: 'tfgjmrefccssskoyatsbwycmklgub' WindowName: 'xvzpvflcmllyxpxmgatmlfifyjmfgfqpgne'
- ClassName: 'mudsjetzacynmnagefhjawxug' WindowName: 'ncqhxkjnqguheluiizwaqndeb'
- ClassName: 'gkjdihthznxviqfeigmc' WindowName: 'roqticcyuhpenuacdujvgxvsmadifm'
- ClassName: 'paxvkkrjbqzxziofltqhietwhvxwpr' WindowName: 'nzebdfxhysustfvkmtfgckvphckjufll'
- ClassName: 'xswfvspuifzdhuiskwppnelf' WindowName: 'hxnxtnishutnedwxepvxrxfkzdt'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'srxrzrgqamktcotvmoeftzsisxq' WindowName: 'mlionepazdlwgqqilfww'
- ClassName: 'mdihgznnygpdnhxu' WindowName: 'szdxhqybkaysoxpv'
- ClassName: 'ybpoxpbxkbhoqqxueddgtqp' WindowName: 'nmppwdshebjewzlzgaodxwho'
- ClassName: 'giwxaizvsjtgfabmmnfmtzvmeexmbbhqzn' WindowName: 'xcownouamfktwgx'
- ClassName: 'mortjutqlfahsokfqbwhhsvjbix' WindowName: 'utyvgmzrzfcxzjraowyabioukfaqrpndjjaeru'
