Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'baibooslhniapnikaynfkjvaqujsnjsrlky' WindowName: 'idvcumxsjmwrnmwpwfebqdzrttromcaxvdjtbpn'
- ClassName: 'yyhxfvqwahesymlncrfxhsvaa' WindowName: 'vfdsihbuylayrplkbjbpeukqfiwtpu'
- ClassName: 'rxrenbmvgtrtdmawdfenou' WindowName: 'jhobhqrqchrbkeqfzwklprhmy'
- ClassName: 'wiybmtlwddxpwkwmbnfiyhwte' WindowName: 'zfmxnnvtaycoewhzjwwiu'
- ClassName: 'geixzrokxpuedtktxtduijfnenjorkwehxjom' WindowName: 'lfkfubvinvirgffwpqoh'
- ClassName: 'nkmqrwjvhiaggdayopmse' WindowName: 'eyrtxamivfasqoonocfksufvq'
- ClassName: 'tkbxfvineownhtay' WindowName: 'zjrfvvfdamujlgjuqic'
- ClassName: 'bernegnaaljitkjtbxaxjraulchp' WindowName: 'arygzeohxlsnooyhqms'
- ClassName: 'fwrtlfrxowekcpm' WindowName: 'efxifqsjjgzrivdfamdhtmyfbpnerkepne'
- ClassName: 'njelytelexkeeisuzmtpdtiakzmt' WindowName: 'hoprqrrrtavpkwgjrtbccm'
- ClassName: 'ebxnlhzgvebvupglcsbhpfkvds' WindowName: 'daqofmgaldyxbbkrpoakzkbdyxoreokss'
- ClassName: 'lszdvkmxuayoiajfwhprwmdajcczbutxay' WindowName: 'tjebmgkwdsfjrkxsecrclzhjnhnrkugbw'
- ClassName: 'wuhknzimcyvmzbcnptbg' WindowName: 'byjcgdhbtqjtlkbgyxlaeilooyayvijnqcvbdu'
- ClassName: 'fggxvqnnljjadvziodrsmdzjonzhgqsxbhvef' WindowName: 'ekkaedwhrgwjgsnbpulfwoohseidxealmptriei'
- ClassName: 'yfvnpftwkzqtneukjfhgo' WindowName: 'ctyrfjhkpzuwjkupnlsqqsvaplzbsmuctpkavw'
- ClassName: 'eqbcnkyxoyypjyiopnkqi' WindowName: 'ihrtzbactttbgrfbyqjprnkp'
- ClassName: 'lzgkifpdztqgewvvidbmjotynizab' WindowName: 'msxtitvrapuokuttdn'
- ClassName: 'wujaxemxrrxcefjxxxtyevbs' WindowName: 'vpqdimozjnevqxvzuwzj'
- ClassName: 'xknamkoucvhgpcvwnnztbm' WindowName: 'hxllyzuktksguqosoozbbhwlrvlftrwoehqfwb'
- ClassName: 'hmrcqupsimwdveqr' WindowName: 'zjiikmvbikqebmvsoqyexspfwlzubgrz'
- ClassName: 'sivpwiggpaomkopbym' WindowName: 'egbwmtgmavlsscfsmp'
- ClassName: 'lyyxzpwlwaefmqiq' WindowName: 'smrqsgcgyaytpcvhhajgaxzbbivdym'
- ClassName: 'toyjonagojdnjpnvvzimr' WindowName: 'soerxqdzcdheguiqfdhmej'
- ClassName: 'zclmidzreisbltb' WindowName: 'usfcthhkithgznpvzgsxetibdmgkjdqcjcj'
- ClassName: 'igzkiuwghegijbjnuwascpfjd' WindowName: 'phageoliqqhecdqlbyb'
- ClassName: 'oaduepywjmcktfnrpurbxdbv' WindowName: 'uwvsfspcmoylkrjvcfrrlpi'
- ClassName: 'sgotqjbsvweddbduuwtkk' WindowName: 'wgfcualimbypcpgbzxdbafyzofkrls'
- ClassName: 'exmzcqhpbfuuejpikywjprugpqvauxm' WindowName: 'ropwrflaungvrtb'
- ClassName: 'mzmzmxddcrvmoydxfhdhvyeyzpcexxouhwlwws' WindowName: 'jkxpqprkunagypzhexaswskjnic'
- ClassName: 'ergvgccwmetvxlyqsesrjhh' WindowName: 'kruxltjncoukwutrhksq'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'zgwrdbaivsbmutmlb' WindowName: 'qlooizkwaarjyzvzeztzoicvm'
- ClassName: 'lmkdgzdkgdteahixfejtjvnrmrydlyv' WindowName: 'aznspqlslaiwwomowyopo'
- ClassName: 'kgbstyntnvbaccrjeiceigheeyee' WindowName: 'qztiuesgzkonxpcnfyojgsj'
- ClassName: 'ifwnowcsdpwkucywtbbplndshqir' WindowName: 'okmqcclhpraajvimyajxlt'
