Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsd2.tmp\InetLoad.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsd2.tmp\System.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bjfelepkmhghizsjsjkcirxvt' WindowName: 'pcrpeavgmxszzykpxkd'
- ClassName: 'xmldtbofslednwhxrsvakbhtkdidmqqnx' WindowName: 'lwkvsvqtohzvcpe'
- ClassName: 'tmjqkgejgqgzleldqucvbtnxocoqbhbzzoxgq' WindowName: 'gvzptyysppndkcavtjfsyfobofmhnce'
- ClassName: 'nicdzpgyfhzbjzi' WindowName: 'yaohlmjyhbyfsqnno'
- ClassName: 'blrevcnutjrexxi' WindowName: 'ctrnimdzxoydzyeeywirbtwlbyy'
- ClassName: 'tbmsoutsnoinlubwteoihqqabx' WindowName: 'nzbiccgndebognoymybtwanzutuclqbkuupmjj'
- ClassName: 'mhuhvolmvnoypctrqaivimdwnglw' WindowName: 'copsbzburvijqfmnsybfbifjdyqngli'
- ClassName: 'xatkkjirglwcktrjakvytniv' WindowName: 'xzifbktldnmztek'
- ClassName: 'ulmopmutuwqgblmkannunsbab' WindowName: 'pcfflsnlvmgixrzfanqfqbuhyumgrbxd'
- ClassName: 'ffevxkicynippgthjpmnlormhfspeevmol' WindowName: 'itvagkzsrwozzknnrymsoozeloimt'
- ClassName: 'hbxzvsvmopyzfgsjfwpjfoomsnshowaszaz' WindowName: 'ptqhxlszvgomsvcwefgomrzfvcohwvkunwmqlpk'
- ClassName: 'dlhthautshtjtrkchaykmvhyicjqlwyvuxg' WindowName: 'mmvgqqxtvjygfiu'
- ClassName: 'bmfezixqnklbiapolxylvyapcinqe' WindowName: 'jjefbmvesehsrmwmvvlasxhheduxgdfcj'
- ClassName: 'xeqqjhukktbastvnfvzqqodoocezwxsyktxr' WindowName: 'kihavxehxubynvaexffpzgfzdcllbkegk'
- ClassName: 'pugakmhppfjzvaxywkilnhcblufuev' WindowName: 'cqhvmgkwqhjknjcbxyrxidblkrickfr'
- ClassName: 'vlnmwhywijkarbhrhixoxcxv' WindowName: 'fiuzcrchzrkdefavzlpr'
- ClassName: 'uoxbalhupczifzhnwpasxafgfxsz' WindowName: 'roauplqbqpgrycbujspnzbzunhhyf'
- ClassName: 'fhqsrfsgzawpswjntvmzgsadximkioquprm' WindowName: 'lzjixflmpebtxihvkrml'
- ClassName: 'lahrcsfjbpvonlbnsly' WindowName: 'ngdciowaravmnpscijybkrsypktwhaolggjep'
- ClassName: 'zswxpzfwagyblcnkmqwbgkcgpiwwbtlbmd' WindowName: 'kwvodxhauzehqkqrcqsofdjmdllq'
- ClassName: 'qvchhdhsbgrxwmyjvimkyxjorlhxbjkxdtsf' WindowName: 'rehtminecqvgwbu'
- ClassName: 'qwnkozaibbfiivukjpr' WindowName: 'hdkasgfcvtagtaterlzj'
- ClassName: 'tthwdxfiduepscsdcdohpgljq' WindowName: 'yoqxssetuggtobqtptzvzgfecyqcgdyp'
- ClassName: 'vdzdzflxaczmzkkh' WindowName: 'faybkvigfydytasf'
- ClassName: 'xegtrfhcrkvutcmsycijbonlny' WindowName: 'aketzcpshvehoxtlwzqms'
- ClassName: 'yqocpobyipwhkvpfmdttpe' WindowName: 'rtfgdyrvehqdkzuqtrhbrmxhwtrrgr'
- ClassName: 'ngfcrfshemewbpagtmucxbpmobldk' WindowName: 'lxvbplzbdmxuvmzovmijlivk'
- ClassName: 'epvxdbprzadgqlejjdu' WindowName: 'uqixsxckstpjtgzrzkabyksorj'
- ClassName: 'gclusbndvxaavsy' WindowName: 'usrevbpgpilnepysxgoizfjtizspxqcvqrq'
- ClassName: 'gyssfhoipfxubfswhcxddgetduzkr' WindowName: 'yvnhjusfcifbowpxukqope'
- ClassName: 'qxerpowmjrzfxhntlahlbvkobaxvngwd' WindowName: 'fpdyxbxfrtrmvkviwmlcyargmqiamoiqtbnymop'
- ClassName: 'ahupjgzstwjwsdyml' WindowName: 'ddswmtasqhovktpq'
- ClassName: 'jktvbsplilvqoclkosfvngvvcciyn' WindowName: 'pqurfofdochhnmztfpwauomslhigjnqc'
- ClassName: 'nprnigjvibriyaqwqbcxycolglnfa' WindowName: 'zlpcsqrdhbkyupjnbwwembyjfgzowxopereog'
- ClassName: 'inpotnqrknrnfppxc' WindowName: 'jnnmsjwwyoajhmpnqdzfmaijwupfgcymqh'
- ClassName: 'zhamfibiqicnftwcsziezkwxjimsntp' WindowName: 'kmfihtfqihqsvvjztvuila'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'voozbsjjopxejdekdjhqdapksacdars' WindowName: 'ihfxnlrbhhldtrmeppchdu'
- ClassName: 'ofhxwgifwncyroshckqopfahmceciaaks' WindowName: 'efpumhmlazflzlgrgnknsdtuhnbydrbgaqxjcy'
- ClassName: 'dnkylcgkqxbubuegyalxuvbxod' WindowName: 'yavbljhicbwwrwdejjjdmzu'
- ClassName: 'xpiezwdgkjnmusawdjljyer' WindowName: 'gglxvwqjhtbnoww'
- ClassName: 'sykhabhibvocvgycoxusquiodcyova' WindowName: 'tiwlafakvfgeuifqxeoojhnqf'
- ClassName: 'vpyekmialixaqrtz' WindowName: 'jwzojdjezbgveiypihltgoadkuctlddnw'
- ClassName: 'jjzwwhricgmuswfkemvzfdlq' WindowName: 'xcwesyygrsuwzqzjyvejjtwrnucersc'
- ClassName: 'tlabztooqxznous' WindowName: 'nnfcntkkgwzcgzwhrxncabepqnauganlrhzlq'
