Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsf2.tmp\InetLoad.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'zfjxqjwzqmyaztrlsqidzfrleiomcohwsawe' WindowName: 'mwuunbwwgprznokzeizsgnoeog'
- ClassName: 'upfemgcxpkodepshaqbufxkkqejrgkpvdlz' WindowName: 'mnrsxynplkhcyqavbwblfknoeevzeuyecu'
- ClassName: 'ujuzkurmxmxfchnbhallkcnebwlmrhtmcxw' WindowName: 'wgrbhysyvszxmevfj'
- ClassName: 'uiaknbyeuwfblipmgezvmvgyxzmqadashnpghi' WindowName: 'xfxsxcrldrsjxcytmogjdcbth'
- ClassName: 'wzpujhqkcwkemlqxxrhhlntozhhnz' WindowName: 'hqgyezznxbkpbafqwq'
- ClassName: 'dmskrkkumoxvqwmjemtcurrlbkke' WindowName: 'esldauulmazgvaf'
- ClassName: 'sausprvacstoevbwy' WindowName: 'dxkkqpzrtuxmjyndahuesnrtt'
- ClassName: 'mcvzqvvzhugpajkspukeeutsykiextwzrcw' WindowName: 'olgfelaidpioguydunsqgxhhasvuthasihjuu'
- ClassName: 'hubhqnhpzrvhiaviaxzuwmhuikrzvloqwy' WindowName: 'xgfttbilyeugyzydpaiqqsfgbyedoxe'
- ClassName: 'eeufxfvtkuzstvnczpripjqxdfwljuf' WindowName: 'iwoibpwzmlxpncf'
- ClassName: 'xhdmwaydsldwrfdunrzlz' WindowName: 'vediikkczdsxqkvpzaze'
- ClassName: 'yjlmeqohkfnbgwncqya' WindowName: 'zdhnwyvpvwmirkmqudgebnv'
- ClassName: 'ymmihoejotiiodoaikkzzzegyxfeshkr' WindowName: 'wlxbzqlupdbalfdspdhytauoufncdqk'
- ClassName: 'waraolfomfhrbxtdkrhypqdgilpmazn' WindowName: 'zuasgtrhqkdvjspflddzbh'
- ClassName: 'tlxrojsxyhclipuencifysbe' WindowName: 'ozrpohzzkltrniebg'
- ClassName: 'rosmbdabuubalbwjsdvnwuozaklap' WindowName: 'poopmalhqqfctxkgeaxecgybhueffmyjtsugzc'
- ClassName: 'hfaofkxmanevdzapooszxhceo' WindowName: 'fvuvqdoahvdagvys'
- ClassName: 'klwnomwnfadmtafi' WindowName: 'wjsrkmmvqxufiqcdlzyiqxaqetytnxcolrucv'
- ClassName: 'ejfswyyjvekkmkllsdeqxbovokshhqrpupwpm' WindowName: 'evgkvjzdimxkttblsytg'
- ClassName: 'hxfygthpmvxyglglvfagrqujmbqfn' WindowName: 'gvqhmcqdrzybpilephvenmknzgqtypb'
- ClassName: 'ompcxciaogusoimzmwvxsazcoodockkmghjuvd' WindowName: 'ifntbnohzoajsyujvfc'
- ClassName: 'hszoluepabpefhelycthurjatwn' WindowName: 'kggozsjlikqygolprzoyuwscgnfjnpcwseyz'
- ClassName: 'nnmcmcgeynsvrqbify' WindowName: 'mqjoytnpicuvmhdbzaeuvvdrfujuvnixnuoubo'
- ClassName: 'wxubprmkqvxuqsmn' WindowName: 'atxrnxpkrifxqxxzgemuzyq'
- ClassName: 'vbdfxtbhetznfbhlspvpe' WindowName: 'cxhukfyutzohyfdrcobcnkitzppjeosgl'
- ClassName: 'cpihrehppbzmbzoechldmdvojehnjmahs' WindowName: 'xngektbniptgttdglqzpbzdelhgpglkdm'
- ClassName: 'qgnkgjvdimprdmsgfkwwpxgexxostxnapolm' WindowName: 'wrqjyolbuglzkhuoicxfaarruvy'
- ClassName: 'xebnhtlszbbfdquwgsnesvlksxk' WindowName: 'ihfrxfongstlehfvrwyyhvupxvqinu'
- ClassName: 'inbnhohfwfxlfjbzqeyhcudtzqwpmc' WindowName: 'bntgdyedoklzegegitoahsshzc'
- ClassName: 'gkdipsvggxerehi' WindowName: 'cicstgobyakpawhixfnxryhlonnjoxkdgqmaldd'
- ClassName: 'kumeuyjxwpitbrwwgd' WindowName: 'cpnciepeyjwsissdghfvpta'
- ClassName: 'liawykchbyebbdnergwwv' WindowName: 'dwrekwgqnxpynaxlpwwpgzukj'
- ClassName: 'kmrotpxyirwfvfxzbvxeqqfauhmhtsbo' WindowName: 'emixtmexbmuhnbvielqejyvvpermaruodggoah'
- ClassName: 'vaqouxalczjpzpgeossqcyfqptbnctrpwl' WindowName: 'jcdreqziodxeaqknjcjofu'
- ClassName: 'qufuxaostjjkkytzmacwsgqhzzxpwtxdqkz' WindowName: 'bvcdqqjaiyikokarwi'
- ClassName: 'eelyuxhltcezjfqkbitnpcoxthvbistx' WindowName: 'graifjwxswloxcwudxzqcd'
- ClassName: 'wdfxtswdvahnquaebwuqnljg' WindowName: 'dsaylgxagyuesohjehisg'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ujdaygbwaguipoakspzqgmbrkizfvwoyovj' WindowName: 'kqucummjbhdghgyudszwfglhndayd'
- ClassName: 'umhxntqwanvxwhgqzaxzxslzpt' WindowName: 'ymhkmhkyihlkyuorpe'
- ClassName: 'gusnorsbkvayhiddtviseuebgdpsnagjon' WindowName: 'vkrgugecmrcacxcmiqx'
- ClassName: 'yebrdevsrcrygsnyczuetjlesemjijfsl' WindowName: 'vrblbkfckczfipdgezsltycxokhxaqee'
- ClassName: 'eidbnthxrrmihyjghrviphjf' WindowName: 'frbwzyeykqnepeeufyujzsyiotuqevhhtod'
