Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\InetLoad.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'lksdkyhxgohwuluxbcc' WindowName: 'szhmhfmyihrijqcoswhfwyctjaylq'
- ClassName: 'mnquslwtscgxzqdaioarxvvgqxcot' WindowName: 'vlmovgscymeavlyauzcixjavomngifayxane'
- ClassName: 'okmkzlozyszfcnswfouhomytpcftkeraepg' WindowName: 'citszyupftwtydbxm'
- ClassName: 'bfumbgwfbgayjpykfrdqmyjskyccwkfrhfgmn' WindowName: 'xezsgwrsjitadkirametvrnamhsapblp'
- ClassName: 'ekkhfxevxihfjdpagt' WindowName: 'ghwkgxttnqiekuzfdfsq'
- ClassName: 'mmxlqwrfmpuaxndhfqyxmezozsztwwtbilvm' WindowName: 'aispfhbptnzgmdpdmrxrqruwsggl'
- ClassName: 'krqtcdraynhfinapupivilx' WindowName: 'lfrbowznbnhdlbbdkvlyackdtnegibvoji'
- ClassName: 'xfaawydinbdzwzcvchmkl' WindowName: 'jmmkaixdeqtbabuuismsmizyytjyfskamcfd'
- ClassName: 'yfatntnyhwnxtwlqsfktchauuknhmz' WindowName: 'zvjtzastopfaeqdsifrd'
- ClassName: 'vjvkwrymqggnsmbxop' WindowName: 'yowuocohhfhercywonvbvlsbkklfk'
- ClassName: 'oetukqomuqnwzqfghg' WindowName: 'eongmaunrhcywrzatfiblohrwmlbmtflgil'
- ClassName: 'mxjbhzgefdxbzmprdcximrwttqwthoc' WindowName: 'wrklksnbkxsiwiouldytugzwobfbogn'
- ClassName: 'yyoyktahogdrormzsprhwehfkqscuscbsk' WindowName: 'cykiybqxpviqsqanbzetru'
- ClassName: 'ccrvhdqphguhqylruxarzjkjzukq' WindowName: 'mtfrqdvyrznfyceglpwppiuhobwyryprxc'
- ClassName: 'bnswyvwerlulgovxqmjxxvfxeacyvpns' WindowName: 'rujwlmjquyimizpfdbnopdjuqkckj'
- ClassName: 'lbwvgnadwfpbgmnpesitbsulgkr' WindowName: 'kylaiplozuagzbkipwtsbsdkspm'
- ClassName: 'jdxfrpeyvavlxpveeiwqhxtchchcregugbcmdbv' WindowName: 'ntzqeeqdedhfsxfhmwimxqrkablgqpugws'
- ClassName: 'gtlhokyliwiaetkikaafbcrldtc' WindowName: 'dfsnuorxvbvsoqpvzg'
- ClassName: 'zbjzokgopezzvtjbxtbbho' WindowName: 'nqrfupwrhnytiynobycfqixchddmhkvcxjtz'
- ClassName: 'biyjgzujcdxbjvjsdzagtrscjungoefvyaddxc' WindowName: 'rfgnzpbabwfycazukslhm'
- ClassName: 'rqaoifuqxfpvytitipiqhlkonxvdsmxb' WindowName: 'vedsfkoitvswpzojbs'
- ClassName: 'amknotjyuctyxfiuodpmkeljslvkvrwehto' WindowName: 'ikqbfbxlfyvzwgbtypnwurraetsrhqp'
- ClassName: 'eummozsunfghdgwhrnqrqt' WindowName: 'gejouxnnfkhfdgywkxrvgdmtapmgnw'
- ClassName: 'ykxpyypaszdprluevmflumqiqxenhdwcozmd' WindowName: 'kyfmtkpijyzigjpenuuolynayqwp'
- ClassName: 'zszrpbcslenxquwwdlpbqyheqlmscdtjdcs' WindowName: 'emjixkivkjilkoijyrgyngwgykfggqjdk'
- ClassName: 'mdwhnbgqflqpmifkdkaxvhbvnq' WindowName: 'uhtkzglillicbvwousbceefur'
- ClassName: 'iejxzoxhbnydjjsmo' WindowName: 'btoonwaayxhjfhek'
- ClassName: 'njjzhcdbogpxwnzcfuiyqiogucgoulymsssw' WindowName: 'dtgzxnffbwnitszlnpvm'
- ClassName: 'fizyvnsolrbgzslltyvhrgqv' WindowName: 'eymoozzfhfliiuxfwtwtabzbgjbkh'
- ClassName: 'qcifofyudpfyhyjcnxddwwpwwtakygzrd' WindowName: 'kghjyhxeliaaqkvybgnzevlqduwvcyqzxduac'
- ClassName: 'uhswuxqrzucwghfwuoobuo' WindowName: 'yrpywcwnlumbihagjhlsprxzcefrhl'
- ClassName: 'namglbqarqlpecknmlpycmbmzxlefcnojg' WindowName: 'cfdsjtkqptelgzsh'
- ClassName: 'fglidppzhdqbrhonyifnqg' WindowName: 'sbflmccsjsnumgjkssd'
- ClassName: 'ekocmzczbcissvjvhhnvprjxhmkz' WindowName: 'nbcbaqduxoiuxptdiyu'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
