Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\InetLoad.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\InetLoad.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'gaeuhfkuorqsbwtecmbktfabvab' WindowName: 'pivkzroqjjodvbmvhqnspkvuwtbagtm'
- ClassName: 'zugxknajlxcgxjdqoeunnsrutvrpyovmovedeq' WindowName: 'uckbrosojtsrscjzztelsbcifrsy'
- ClassName: 'jatwkmpcopagbbjajngbieobwex' WindowName: 'ejfzxhyolvzwlwedvukswrskmoqzteteozlef'
- ClassName: 'smidbdpqadelebkbzrjfdzfuxujme' WindowName: 'tandqgdfrocnxurtukdmnkfdrtnztrnaufktov'
- ClassName: 'grxfjwhpwslxulamhvkaqkdezmneqvrtryj' WindowName: 'jlliwfoshhqcihl'
- ClassName: 'jujopwzoajqzhkmswfhvactkgyypnsk' WindowName: 'uzjbdktjekglpmsybmzrhuzzputtnoxytv'
- ClassName: 'rkujlvigsakkkmjduyitfslaamg' WindowName: 'luogkygxifpcihethvyktwektaaryxmuqggkn'
- ClassName: 'gpeqagwwnzixhtfspistgfvzaqtylmtq' WindowName: 'lxiyfhdzqteuwvfoneho'
- ClassName: 'uofshqgridpghnxjxcrsduiyqhncpknianaz' WindowName: 'ksrlkropzbmyryg'
- ClassName: 'sqaivaddhodpudrxnggb' WindowName: 'ublpdezzotgpiqptqfyygzeot'
- ClassName: 'umxovkwispmwlytrnirbqhthtl' WindowName: 'dugnopqebwtrufkbtjedv'
- ClassName: 'zevlidldtuwzrxjbowjq' WindowName: 'djrcncnhlalmjpbicvqmqhduqo'
- ClassName: 'sestrpnmpuhtzgjki' WindowName: 'upuflnxcnyrjxwspzylwevaamdoyizvtaamz'
- ClassName: 'kpenhfjhydcolcyizqqnynrnfzfifjahtboxz' WindowName: 'ceoslhkddhjyjwarutxzvh'
- ClassName: 'ngnnuuapndfllxajuawnrfctlpu' WindowName: 'tqlbepxkhacxgndqskkj'
- ClassName: 'fjursgqlkxyybjqlzv' WindowName: 'encrkklzxpyrswpybivlc'
- ClassName: 'oddjotxyjmmrnufgijtrclhydoo' WindowName: 'ceiculuqmfyymoraojmu'
- ClassName: 'zfrgazmvjyzuwvmiqwniuzqbnrhasmqfe' WindowName: 'tvcdsofavezfozubstyfufoqxrghw'
- ClassName: 'zjunwksyhleslvfhirkprztllxcstbfuaua' WindowName: 'ljyoupdneidftaptq'
- ClassName: 'xzirlufbjbiiqtfuiexogssmosrvmzzz' WindowName: 'mwvbozzcvqgseulwbonnpafl'
- ClassName: 'brqbcdnrovmliikyvdnswdnzqnbkifgpmoygqs' WindowName: 'awltwsrbsbkgzdvzthiyucoaepsnrdlme'
- ClassName: 'tzyfuwswwtxnzqkwdtyiclicvm' WindowName: 'mdmvmavgtwgvkpwk'
- ClassName: 'awtiqwmbyzfzzrpuhxnlbcaumkrfvacafrsoj' WindowName: 'ouayelyxpyupsgqfburqxzeleshzpeyjeflhqx'
- ClassName: 'ohyocpqhcylrcptbkt' WindowName: 'uftdephozlhkcxqxtyaunesjhmvpo'
- ClassName: 'xscfmkgqbutqqgosrandjwvixfaxvahwjnis' WindowName: 'rvbuujczhbxqntkahhurew'
- ClassName: 'iwxhuruaarpjzqxqiturnwwamwm' WindowName: 'cadlbiqqyqwdlxukgjrqqgxwvyrirltnmkr'
- ClassName: 'ulcglnvhbnbjrcwvqyrdmwjihyo' WindowName: 'vytxnooyeoyimmpdwaowj'
- ClassName: 'jlmgkgpfuswxkzgenlkbyvtplfiqrva' WindowName: 'itelywjliganncildvkqofovjdpmhx'
- ClassName: 'vrunxsseggghpubexszedzgpmhuyzujga' WindowName: 'tympcobsbnyqrslyihucvhxkdadfotqavtshob'
- ClassName: 'vamkrsyjzmrmasxfgptz' WindowName: 'mpdznhmcgvfemxcdxpujrluhcpfvqzb'
- ClassName: 'llfbwyrcfzlpjrehqoxgbf' WindowName: 'phwmauioafhecbjwmogealdxbo'
- ClassName: 'cptxhwegcbchpzezggotmekaswicruo' WindowName: 'nsqhehmpsdkkfzdethtdxonuz'
- ClassName: 'dnkaevbnqxzoyespthroenroawndrtbgfifmo' WindowName: 'nbiwqmzphhcbbxpdy'
- ClassName: 'blxwprtmyrlihyfdixwjrtjgpryqsayvuvlb' WindowName: 'dxnvphjvklfyuuyufzuymueyzelxvb'
- ClassName: 'skjudajktmuiyhjioldsvfpzzsbo' WindowName: 'tmdpjpmavwyizuitwuzxyd'
- ClassName: 'ekyyxzimpwgpflcdyeotqxfyn' WindowName: 'hzrxlzkxapuizyjrm'
- ClassName: 'ihqpgeqbhgghhhtkhksqmypavsv' WindowName: 'pvvlaetfwbmruklgpyzzqxyvsjmzfdaynyacej'
- ClassName: 'lpxcguzirjqpeobygy' WindowName: 'obuwelkexbympphswvzsvbqdvaccajdghbaw'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'qxnnpxhpivvdqpne' WindowName: 'nfhtrvyupswhqqrgsehffoprgmdjomijmpm'
