Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsi2.tmp\InetLoad.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ojizdxbrvnzxzuodtivqliozwotgclxpq' WindowName: 'orunkqmdgcpaukvesjvnzvnungelrylzki'
- ClassName: 'jpaqiobdzgqicspiie' WindowName: 'plmvqghnyapvsdqflrvkqejj'
- ClassName: 'kchsixrwnjhwrlgwbbnhjbgxdgfk' WindowName: 'rwcojczdqykxgruhjsldyqkq'
- ClassName: 'lopmwunolddsgqzmnvzfonndl' WindowName: 'ddsizeboxorgzbzfejbjaxldmwitskymi'
- ClassName: 'fkipheedjswckfjjnnnwwziknr' WindowName: 'vaqfoedahxxzslrmwziflmenikaltajkf'
- ClassName: 'orfzrxamndqxrpwjcccnndwlccaiyrahe' WindowName: 'ypxcyrdthzkptlsichggkykiwzvboqhdpjwbxyt'
- ClassName: 'suopzcggsoiqolthkhdjek' WindowName: 'qpdcgkrabfuxrfdngeneaygkmcbgkwrxduz'
- ClassName: 'yscqupizgdmjooontthrhoujpfbvvdlutnltyqh' WindowName: 'cjhjwxubteriyeyivsplyqlplaj'
- ClassName: 'odolaljveliziweddiyuzftuvzzabso' WindowName: 'njnjglgnbmevoqodsztdsfio'
- ClassName: 'vxxyiofgknvdrfwamjo' WindowName: 'eyszszwumjxeupnnezqxdomsgswva'
- ClassName: 'lxkdmplcjqvgpyzdqvznmbhotdpckvquf' WindowName: 'dmcvtwowqcvcxhtbsyigstkphsyylrdzcet'
- ClassName: 'bkaaugkqudwadntguudjbzpmiislokzpwbwnr' WindowName: 'jujhvxsrhuyzsdtycslyduxtasfikfxxvbseayn'
- ClassName: 'dmrjavuelnqrtuooinpwqrhnwrbplmamvtuqyj' WindowName: 'iccroqjhqwdtavxxool'
- ClassName: 'onbijptasqwqqdjfext' WindowName: 'gpidqxxoztdeblaebnkg'
- ClassName: 'phglzbqpitnkjcabcsx' WindowName: 'sizkrdiwfolmbzjyqwunyielbpfktewoeamhytd'
- ClassName: 'truvunqzlwjifnzdoqzbsroyfv' WindowName: 'tzzaleffwrxiwvzohuzybtbkmjs'
- ClassName: 'gttybndtthwnscxiu' WindowName: 'mprnaesrbkltiyllddusdcvicvpgiihdl'
- ClassName: 'llkiedxiwcfszoxaceme' WindowName: 'lyxqmjrhbqjnncdpnauqviymy'
- ClassName: 'qkyusmmhmqqegxgoimp' WindowName: 'yktonrivnwcruffybehpdtkaybw'
- ClassName: 'yyuzgedwzgcnigzpfxlghsaan' WindowName: 'dyoukpxaixjkmjimnowbciad'
- ClassName: 'bihojozxjhlahpogmwbocbrbvxtqh' WindowName: 'heloeutwpsywuzvpongvu'
- ClassName: 'iwupreqfrtnxrvvxofjnmutbfsopcjf' WindowName: 'gmlqhmwymeksmbgb'
- ClassName: 'cqoyhnpciljepcrfkov' WindowName: 'fiebieknuqwvqshasyvbfmafbwzey'
- ClassName: 'fomsmryetfqjdgx' WindowName: 'aowsjnblmzvdrhddkxqu'
- ClassName: 'cwoamqxalatgaqbybvsmbhencv' WindowName: 'fytdolepjyocegpbvcpcgohaaqdwz'
- ClassName: 'dxiyqsoqxeonpdwytmkiyxeynr' WindowName: 'skbocnrwrphvicipwyjdzcp'
- ClassName: 'stcikxwsxahyjfyolmctpnpmvwldhymm' WindowName: 'jkeiwujwhgkgvrfgndyxrypjawudrceqnhwt'
- ClassName: 'wtzziscpcuhiniizeewsd' WindowName: 'kgqiqlyxkcoiiomovadxjjrxaajxnbdlwuynpm'
- ClassName: 'hvqoyxblygnegcfjgvrno' WindowName: 'svtwltqikerkduvsfxxxudmvij'
- ClassName: 'kkdjbydyrxabixaundvuthqlxtordwcsltvaqpc' WindowName: 'ykwqookwcgfvgpwfxefxqepuxmof'
- ClassName: 'exdejhqtaknzyqsrqbjgtothmivaqyyhzl' WindowName: 'ggfhfpbmrxnjasaggvemreoc'
- ClassName: 'mezwenfftsqisckeqrhioyaxtk' WindowName: 'dqlwxgfqrerjwmvgrvkx'
- ClassName: 'rblwhnchlbvjbfq' WindowName: 'uqgtmyemzahmhawlzehioxoxsxxr'
- ClassName: 'fjyxzvlxuukestsezbpguxevwgcqrgd' WindowName: 'dslajzrtanpaljpm'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ojkgcryibleomjzgiapnirjwifywdenwlpqyyo' WindowName: 'rflvhwapbuhqhsuzppckdbkxifiqrus'
- ClassName: 'ztdtjicdcnqgrwh' WindowName: 'nrrkgiygfsytuguhxbhlvyc'
- ClassName: 'cmhrghmffwmjlmjfpfzvvlaqfd' WindowName: 'vldnxerjulqjfjigjo'
- ClassName: 'uehgnmlgckpqwbblvnijouvuqjxgkzmhvcpzq' WindowName: 'bsiyurormksofhd'
