Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\InetLoad.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'djamvtyikhoopxefyegzaxksqcjrq' WindowName: 'izhzzmfmwncbimgwxngettwxzuf'
- ClassName: 'lrkbawgvjgczarybvbvfau' WindowName: 'adxvhejzwdofoynqiayjmcp'
- ClassName: 'ctkxlelhsjyexolvruabws' WindowName: 'dmcdxgexknashkrnxjyje'
- ClassName: 'ayalstxfqfacqlfzfnpfnwjn' WindowName: 'akvmyrcngbutxljgbpcbhursebcogamtsejkc'
- ClassName: 'fnegfhftuwpkdqfqniuhgkds' WindowName: 'aoaywmmascbvgkslcgabrheu'
- ClassName: 'hlcqeyckrorufyzoixrjcgvdqfpdtuw' WindowName: 'yimjsbzwglczsxzc'
- ClassName: 'cqecxagofoihnvkwnhcvimqpdjubm' WindowName: 'xgtfnhqoeamvlyplgceuvmryj'
- ClassName: 'vhgpznyrmdfojxyhvaofjtj' WindowName: 'crtsigaljmjaczvjcc'
- ClassName: 'iffubosnnxfesqyndw' WindowName: 'cintjptkfbsozhalsmbgdgqlopmecbwac'
- ClassName: 'xwuavnqwonytshyfxyfqiwr' WindowName: 'tcgkphvrtjpgcmluzmccpxtvuvpldry'
- ClassName: 'drqxezittjudpzhdxoksmt' WindowName: 'eudybuythrqkkyqdhhmipyoyhwlrdjmza'
- ClassName: 'qqdppmsjtmtdlkhlsqaelvyiccytlkujcmklam' WindowName: 'bdvcqfvcmczebgbiczlsuizhy'
- ClassName: 'hsikdwdrujbmztgyskbwgejeommtvrh' WindowName: 'pfdjmtsroarhvgirwwqxqynawcgxgfjiwfwx'
- ClassName: 'ndmvripsbujhwiawhqaiiurtbyygotljcjq' WindowName: 'ozrczxxwmciqamwclehxtcwaxyief'
- ClassName: 'xuvqimxkyuuabynvgmiprsohiqgtisn' WindowName: 'hvrngvkaocrlczlsjgskldasevjxlgrhnibp'
- ClassName: 'xdpsadmoscywmuuny' WindowName: 'aqqwnyrmvmljjeovknanfutdbayyqtbsf'
- ClassName: 'chnbqlrokhketxasxulskioh' WindowName: 'kkfumgavzxuuiobnxdxoozqekcrro'
- ClassName: 'xgtgsycgerqydumalzylicxyqve' WindowName: 'jiffjzgsojqgvjuddduezyhrcsirulxe'
- ClassName: 'sjbxogodoonhaktv' WindowName: 'blyfsiogbxgvfzsg'
- ClassName: 'hhlfozhljiwsxjcpqanwgfhqlyzrtlvynpts' WindowName: 'oktjynjfilisnihvvikyldhxxlxybd'
- ClassName: 'mgnqocmkplugevmedbsgrsb' WindowName: 'iuoaepafwzoybpwmnzmdzvqkqqmmrnzbeal'
- ClassName: 'jrmnuyjupffutujykev' WindowName: 'gpkgftqqukdjbzmdpnpkxpdn'
- ClassName: 'sjvhtxawbftfotp' WindowName: 'zjgtsjclxvqjqxkwwcrxpnkgejgarom'
- ClassName: 'discocstfdolrljzgfls' WindowName: 'rjnssrttddqlilnmpzuun'
- ClassName: 'kcudghoopimtpohasyjqo' WindowName: 'otgymrevrwushmonzqmfinjtvpbl'
- ClassName: 'gzbsmkujasdabpagmgf' WindowName: 'ulptsgnivguirvqujidbrn'
- ClassName: 'zesvscjryfryfdnzwsuyierdkfqofidngyby' WindowName: 'ozzkqdtiiljibick'
- ClassName: 'ofjywapjornazcethzhjorxvwsrujuaefchkil' WindowName: 'msbazyyftairwbtvakiq'
- ClassName: 'dwfrgvqzoqrzdlsx' WindowName: 'pdwonbballklbguihohjuafqw'
- ClassName: 'zjxkzxsvppnysshftmvqxatayn' WindowName: 'qgzgtzhwgrgmhbvygyyirokgqwgreewj'
- ClassName: 'lxbiapuogjsfshnsyqjhuwjblwfzwzgdxlcuzvi' WindowName: 'vztryltgogamwxakxhopaqkmjgr'
- ClassName: 'hrnxebfvmtgbnozaqxf' WindowName: 'vpnowzovfphkqbsqfhsmayeulafa'
- ClassName: 'bypyrdcwyaskxtkmsms' WindowName: 'roearnbdrbmhwduqlfmbsxvzon'
- ClassName: 'hrnlhobxslenexheuvyk' WindowName: 'ogsxnemjyvvmjlofrpghdukpnvgcfgbvgpbycav'
- ClassName: 'bsmhjanpgprcrth' WindowName: 'otvpstwuihhlbwzvrkxvag'
- ClassName: 'vpqhrqqwhbcroizpbu' WindowName: 'dbxyjhalawygskxpstpjcqhzdg'
- ClassName: 'kdqbduztzllrkayyaueponuhu' WindowName: 'dblyqcncgaaczjhfngyyorbqyhx'
- ClassName: 'ecizwhivkmxzeumpkzhwj' WindowName: 'zuxuughfyjwhkiklvn'
- ClassName: 'hicsocikxhfghgzamsyvuuprpnrazjedismv' WindowName: 'dlnzmoswpdlbhkhrxmzjzqgwgwm'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'wjhctpxsdvrvtmnq' WindowName: 'aemcdohydydercsprdzypjrfz'
