Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsd2.tmp\InetLoad.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsd2.tmp\System.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dqkwkcvgyfljvgrchvsacyjii' WindowName: 'qsagzvtdjuoiseiprdxhlpfsbaixwtnb'
- ClassName: 'rbnwtwmahtkbhzprirnfyrsjsjoqvcsq' WindowName: 'sjoasqjuimrtyajmzxcbjvjer'
- ClassName: 'izfimlzyhqdghhvetoiojlzfilyokwapbrq' WindowName: 'jshhpunqqumthsimy'
- ClassName: 'xgbchkzjdzbvioxscahwcchgkgwmhwoyygld' WindowName: 'ndugccswqbwfwod'
- ClassName: 'arghyxfpquyzhfabjajsn' WindowName: 'tjovvelyjszrtumsqxsdpmh'
- ClassName: 'xtazfvhgkelfnqxckkhoykcbkvcnozigafykohl' WindowName: 'uubjhmhgvjmhzykslcogawpowfuxqzskjgtwk'
- ClassName: 'wcuuswlevtkbogndmy' WindowName: 'lhlwuvrhyuocmsdvallwsuwzcj'
- ClassName: 'nrhuocwftvgjchnacploagvdsdetiphehgejt' WindowName: 'wtzhkdfzuhkutaya'
- ClassName: 'uhkjqeumawbbmmnfbrxrpgbglh' WindowName: 'iaielizudtmrbwfbv'
- ClassName: 'brfsztvfmzfnmejfweextrhvbkgdgatfjs' WindowName: 'zwpszwutskythnar'
- ClassName: 'pqekdmnfetjxxvagpifpdldhepiqtvpueanvlre' WindowName: 'esgubcosohqbupzdhxbatvhgltinicrkeug'
- ClassName: 'ubbzntentycdqivhujbf' WindowName: 'jknjpelcrfxwrtmhkugvoujisoohhupyio'
- ClassName: 'egtyalsbokiexvuids' WindowName: 'zirawqdgfnvzpaiol'
- ClassName: 'pwbynttjeclkbihzvnmd' WindowName: 'cmrqubllnqjzfujmkdlervzjaumznrco'
- ClassName: 'zgokvqckxmmdqohi' WindowName: 'wylaythtndbtfngxttyqffyijlxvxnxxnin'
- ClassName: 'whmtezzvslwksejzyplqgnmdr' WindowName: 'gxramwvfczufbfojxa'
- ClassName: 'geceexgsmnwukgtlrwjiqiqcvurbhex' WindowName: 'bslvblfildyraisxbccyklgvnlv'
- ClassName: 'ficdrqfewanxbztujewohttol' WindowName: 'ljyhzuzhmmibctydydxcoxxjapnmuy'
- ClassName: 'ynugirocovmvnqjltqxagoyksnzxeyfijva' WindowName: 'xdugqntwvhwjciut'
- ClassName: 'uwddarqufcqgtvbkerd' WindowName: 'wmyzshdlpohthsllkapkdge'
- ClassName: 'estnuiexntuotttifzlryingwqqcyiqoclhh' WindowName: 'gebwjjpyvvgjereaqxanwckmwaaaysnd'
- ClassName: 'jrebmwyfkgievjfvfnhzlmnlgyztjyu' WindowName: 'wmgxzxcikhnjjwkkrbfchwim'
- ClassName: 'qrxnfchwhkcbqnfsy' WindowName: 'mdomyojrvfhzxuegccrrqzgjtokkzrqhkddgmuf'
- ClassName: 'caufvzaylazsqneuhtpejoudhhmyktz' WindowName: 'wklkuqoezijjushosnewcstf'
- ClassName: 'widkzwbaiixcjivmkliljasrwkxfc' WindowName: 'visvcxmnnsuedhemhizjanqogmq'
- ClassName: 'cxlhcexdlpcjrfhklmsza' WindowName: 'bxpkakzyisuisgbuvhknk'
- ClassName: 'wdunbcbcyarblwmkylgsaimqmlfyfehj' WindowName: 'cgwpdxpongloznqgs'
- ClassName: 'kwbtjjvfudtyerjiajogkrfnfsoetohrplt' WindowName: 'arvsfseuycdribevywanyhkzptndzfpryqsi'
- ClassName: 'cvbnakzbizgnjwfnomrddewqbsitdcehn' WindowName: 'ddhdlbjmdldslnhowujiefzfsomnpkrvr'
- ClassName: 'xdwbepjqmgpnjbvuuqzkkrekirt' WindowName: 'csroptpcgizgyrpvpf'
- ClassName: 'xbslldpthsjgluajasirtonmdfbjblzvhhpmo' WindowName: 'kdqhxhxjbxirwtoxbhcjhhhwhgk'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'qzvouxxeovqiouvloqcdyydlftmzbmisklfti' WindowName: 'zhmzfrbbrjwaiwgxybsftglpjlectulhlv'
- ClassName: 'smzkpygsiiyzuhvouopopmogtxqlfyucdiwo' WindowName: 'ycvzbfxnzcsysxijepo'
- ClassName: 'afciatnmsgjgmvtlpveospjlkpghidxreskj' WindowName: 'bnfpscwvkzadjvmqhnztgztskft'
- ClassName: 'iyddjubpvukbnttfqkbhujavyugedwnpcwsm' WindowName: 'yeafwsdilyhdsodsefvttbv'
