Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsb2.tmp\InetLoad.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'khkkdfaqmnuayqi' WindowName: 'dnephqlqecfhlfpmovbx'
- ClassName: 'msyksurknjoatwahgfeuupwkqpjat' WindowName: 'dpcqwkdpwerjgmcf'
- ClassName: 'hyrxmsgpfvpjrip' WindowName: 'bjvqjdpdcebmgwskjxcvjffpjpl'
- ClassName: 'jpqfollcacqdkazcrldmbsaolemukxmargt' WindowName: 'lhwpzovtoievtwsaxjsjmos'
- ClassName: 'rcaciixhdrzwbrcaliepwziu' WindowName: 'xmqhzztowoieqcvmmgjfckyqyoeqiatca'
- ClassName: 'asxbelfdcecvuwcovth' WindowName: 'rtgrzqvqpyspwcwjresrjoquayvflxzhzsi'
- ClassName: 'ixkphzoeektmfneayijvvtbsxgyotneoku' WindowName: 'hssdoikexmvghyitqfirflzydsxklblvzwlol'
- ClassName: 'ueuqvgzazdhibxyisqtzinofcbjrgcsvkxfq' WindowName: 'ajqgxngysrxckfmukwccgtdpvaugpdici'
- ClassName: 'xdkullgbxlzzjcngi' WindowName: 'jpkiemgywgbkzbjjsrfckmzjlkphmocc'
- ClassName: 'cpovwnxpahfgrvazcgnzf' WindowName: 'lebcanssstssnjkrhypbsvzjravpedqok'
- ClassName: 'tvgzpqbfeikpuchjtipxofmrnnkrfnj' WindowName: 'egyjxzfburfbtdfbqpthxdpgoutxrykrmx'
- ClassName: 'tjpdbsihpwclsgvfyjprbmxijoxzlmxhxkqve' WindowName: 'qpstxgedileskrzhxldntnwhops'
- ClassName: 'nkfzzeqytsxbwnzzck' WindowName: 'xyalgpahoepqetip'
- ClassName: 'flliphbfdgavwpnzvsjjz' WindowName: 'vkcxjgxmoomvvepqiexg'
- ClassName: 'qsdwwjkiovzgbcmuaevkvcvosgheuw' WindowName: 'eyonupgnbmydnmrfknpy'
- ClassName: 'pnqjrmtikbgfdomodgywgaduszznklkielclawg' WindowName: 'kggbhxebtxnwnrdbrshggqjojbczszclvouptfm'
- ClassName: 'delzvngylkobrxwodlpatnps' WindowName: 'xiealbnjnvgngsfbrxiexqoroacnczp'
- ClassName: 'borippjarjispcprhozoinzuhpfmp' WindowName: 'wtwuetdnnwvawmgabjymiauiwxndrqlti'
- ClassName: 'dxknmbdlomoeovbwydvhtvdweemagjogzjuckvd' WindowName: 'ipigrsvvairwfjudquasdlrkdmtxw'
- ClassName: 'qbifnfsxcqxsvdqwkvhsgmf' WindowName: 'frnlswtkzzguptg'
- ClassName: 'ffezrgdrffvcsfmxiizfnfpnddlifcrs' WindowName: 'rvaqmaieqllrtudcwjvcwlocvthqsebffsyfrxa'
- ClassName: 'gfrnkakawxyvowaw' WindowName: 'rrvoiqkqkajnybnjbkdbjylqkpkcs'
- ClassName: 'opjbeksixdbtucyd' WindowName: 'wrwxcyxoyzwynugxu'
- ClassName: 'yuzqynvlnjvdebca' WindowName: 'cxfgxwuestbhdmmstshpk'
- ClassName: 'xtfflzggrmogbwqfjtgbxsyjysqt' WindowName: 'wpamtzeyzitbkoi'
- ClassName: 'zpobbuoiecyedltdaiiawmqurqwd' WindowName: 'joqtdfpyqybnqcflogfpjcyjd'
- ClassName: 'zrjaaybyncatzsntbacygjxmnk' WindowName: 'efedvedokfcdzheyy'
- ClassName: 'rzhqdcvzagptliov' WindowName: 'ahsnqpllrgvxfxmjioblfiafymid'
- ClassName: 'lrojuufrbgnnxmoz' WindowName: 'sspterjwqwvjurnirbmxthuymmistlxouh'
- ClassName: 'evsemrsasjqtjeqefl' WindowName: 'qxsrbeboswtafrlcjyqmvechpogdl'
- ClassName: 'ipworsgiaowvwdojzwrdikdzhdjqzyzqqwxx' WindowName: 'gqisduszdgdkvczkavjrlgutbqoohskusfot'
- ClassName: 'ykicjztrycuhtgqhw' WindowName: 'zewgyjmzoxsesfqwymqsjutdapoxiqlmzpnfc'
- ClassName: 'edlwpxquviawsrp' WindowName: 'crcfzcqqylivqddlvzuxaxde'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'nihjpmavkosikuqqiztdumxb' WindowName: 'yendklkwwpugkyw'
- ClassName: 'srrjeewdaadwdozoyzfkgvpmfllfxcuurrcx' WindowName: 'lrzvhjitbdwgrhogefu'
- ClassName: 'puazdbmzwwecvngfkerwkl' WindowName: 'oybkvajtumulqzy'
- ClassName: 'qsjokndspycfizoo' WindowName: 'xxgsbwkwzuoampktucloedmuoebgioz'
- ClassName: 'rxogdbnxzydhbamfznfszfajz' WindowName: 'ubxbteygrwkdmviqugrkhahdpcarumkzsrng'
- ClassName: 'ijvxfyotdqjpxsxmuzskyhq' WindowName: 'myojzuqoibglaltvuswmbloqf'
- ClassName: 'yziauorjljouokhnwcyd' WindowName: 'cphqrywzrepgzpxdoikmiiwldvrkxrzkcdqy'
