Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'oozaisymavphtqvmqlqqxhyeydhlxlhtloiv' WindowName: 'cbmfxjotxwfesozrrmtjqxbnesn'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsd2.tmp\InetLoad.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsd2.tmp\System.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'yimedckmbukdhaoenucnamsjo' WindowName: 'cdfasabkrbuxsumkgqouwrzihdzpcmidwhztabb'
- ClassName: 'nhuvyphxltrvnggnl' WindowName: 'zzkclftosthttejphoz'
- ClassName: 'rigojcotedwphysjcl' WindowName: 'bogzprngioupffql'
- ClassName: 'dlzsxyopjyjwtxhdvwpjykyrhpj' WindowName: 'oovwyxtvnyqrbbewpclxzkwyyrmroqacwcnxrgf'
- ClassName: 'nlkhnjwtxmgaomno' WindowName: 'ljbsayblltlirsqy'
- ClassName: 'ykjbhxmsgxjjfchdutkvvdizb' WindowName: 'dvvkjmjpnpcppdcarfxgmwhu'
- ClassName: 'dseervkknwtupudajgeisqhjd' WindowName: 'omeiadumhnbbdsmghtqenaccry'
- ClassName: 'qcagtfirpxrwdxmeeoukzqugkmphxcxnqhiktf' WindowName: 'kybsjrjeufzydcnbeiqqjdoxqu'
- ClassName: 'zfuihhikrlwexbuv' WindowName: 'ptrjgymaxtfziprdxlqoiofqafyihtysot'
- ClassName: 'feaxembvptvdtgshqvtesjdsigh' WindowName: 'wziqmhkpikujqnxyznmboipc'
- ClassName: 'yclbfeavhpellyxbuthtxbnlwiqxcahh' WindowName: 'sfylyzguyzpmrdppjlpedgbwjn'
- ClassName: 'hlqsnedwoatcprgpdcvkl' WindowName: 'gqxldyuuzlmhiofoxusbx'
- ClassName: 'ynipzgogksawdptsldfsmpuwsyhpfhikg' WindowName: 'tvwicaqtuamkpbxqqpegof'
- ClassName: 'mcijysdneflgzgydxepsmcb' WindowName: 'vhgljygpgrsjwsstfqamgspbnuykqzlae'
- ClassName: 'nzdmnwexmtnoynqprvbfmtn' WindowName: 'xwqjmupgqtbefipdcb'
- ClassName: 'lgykpnnzogcswfspvnmtynkdbppzjtdfbrgq' WindowName: 'hfwwjptlxyqnuaumf'
- ClassName: 'thimgyswweznwudzwxkze' WindowName: 'tyesgleazrpupdeipcidehxvdaxzmuapj'
- ClassName: 'alvaeznfrucilangpcop' WindowName: 'epsrvhomhsygwaqippwbgfkrvcdfxkzev'
- ClassName: 'jodelvvuegclozhlwo' WindowName: 'mxrzxdjvqhizyzpeuplnhkcytq'
- ClassName: 'usezrzldztagqcsejwakg' WindowName: 'dnhcxwbfotpshykkezlhntbkdrdvktdyvunhy'
- ClassName: 'rmtheqswpebvwudtgkg' WindowName: 'afdmwxdepekkckzneyjy'
- ClassName: 'mikjvlukhspgpjzc' WindowName: 'bwxrweyjwyiuogzxwugwq'
- ClassName: 'ammzkdyzdtbchwtbxk' WindowName: 'uuqnwfjfpgamrewsxuoxvynallgzntyae'
- ClassName: 'etjvwncnuhqcjbpjzg' WindowName: 'wbxoymrxmendkzhnnuolvkovgckkaqzoovxjonb'
- ClassName: 'fstlbjbkpguqujfv' WindowName: 'kiwtdscuwdknattblpryizxqyv'
- ClassName: 'slqnllsidpmqcuuhgzeelkdsgebejxq' WindowName: 'wmhyprprwdxjkygnkwxylnugxafdbunpfibqxro'
- ClassName: 'cahgenumiruhugploohparadgaykuufvjiexcli' WindowName: 'czsuklgvyeqbkruevd'
- ClassName: 'mqknwjvohwhlgghbqdptcxatyombkuworatirv' WindowName: 'byehrfgguotdmrccoppgfuefswelzn'
- ClassName: 'wqdgctgxacxkkqkbscasiztmovzodwvzppf' WindowName: 'rtnayesjipgktizpsxaiwyejvpri'
- ClassName: 'cnhudvcnabfsdhswsaxqdkyd' WindowName: 'diizcactpueuleaqp'
- ClassName: 'ktncntgvijaisyqkyomuwqnvxbdepoiiborl' WindowName: 'cjcurenojxvtoyrxqzbub'
- ClassName: 'jbhvyflyclqoecvzwneizssdkkxbwzkjqemsrj' WindowName: 'hfzstwoidpbrugt'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'hlarxczdnwjeokzi' WindowName: 'ugsuisnvdkmicukbcphgmsdba'
- ClassName: 'havtapjspcjjrwhbvxfpkqcpxehkjjveulcdg' WindowName: 'hhszncljonnmtbpnbfqbw'
- ClassName: 'gzakqrubsollwfpqtjozlb' WindowName: 'xzevjkwwfbrsmtlaalqbbtkvukcq'
- ClassName: 'pkcsusxbvxcekcvlwmvrkhdmxrjncevxcdxug' WindowName: 'bhohgyywlndottnjilmipbbzfldzi'
- ClassName: 'npparualhahhdyxwd' WindowName: 'buxdghexkmmqxcollalp'
- ClassName: 'nksukxbwltwcqbbtkrlhgrmpfviasazksogcn' WindowName: 'ipkdvorsvztclblpoarivtrikajmqxe'
