Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsh2.tmp\InetLoad.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hspsehjaegxlkcolemyyewndnfwzziontfrlkvk' WindowName: 'nsijjtypdreojaoiquecuexudliieunhfhfk'
- ClassName: 'hzccncvrewwqmypntworuojamidbhd' WindowName: 'cwgncdbuwebzppipyrrfpujazmpqwsjsxssriuw'
- ClassName: 'viqacbunzpuxrnditllutacoxgzws' WindowName: 'wxcroyjztrmluupopwshbntyjgsokun'
- ClassName: 'vpxbsnqyvtppfituyabtkn' WindowName: 'vpklefvknozugxgavjjyyvpfjnkcqvwdgyd'
- ClassName: 'zczwxtiomspouwurtembovgdcdwqlyvh' WindowName: 'gxdhbordydtcaimsjoewaxqfjrkrdmbukkzg'
- ClassName: 'oulpkfrirepkkcpnteyrzhaujcxpp' WindowName: 'rfpywjxgwizsghtidoyvioirrxferxg'
- ClassName: 'blvjzgvgnnzfxmo' WindowName: 'bpjyzkcidbctktziirhwnxdi'
- ClassName: 'cundneckoamgixqvwegxvfinvzrrwrdsj' WindowName: 'bmxpkfxpwewbestkkfdewomlurokspvpsskvo'
- ClassName: 'sjhddduzawwnbeewmcg' WindowName: 'seppumoxgfpqufnbw'
- ClassName: 'ujrxeebzjxvejqvngq' WindowName: 'mkhqzwyqpigltfycqiplsudl'
- ClassName: 'nocwxmbxrlvaffxojyjilim' WindowName: 'arvsxzystsnsingdxmrxuokhzwosyxdqeyghwfh'
- ClassName: 'eikfavltgbtslzuzbtmgnbkxbrxvkga' WindowName: 'xnelyrszyqzcpozequmkheofxgpqazayxxgn'
- ClassName: 'fsgunqceckgsxfpdtsod' WindowName: 'chxdbdewkebxjkrvirw'
- ClassName: 'gmluemegfjnsokcslgyaeygdzpxifflegyi' WindowName: 'drvrfwvcqrmmenvnnocvkvbvaihlsfez'
- ClassName: 'kugcbiakyskplxoxodzsqqzxxhx' WindowName: 'zhfphwmvwhkhysvu'
- ClassName: 'tgvvzpebpjqayqdmcbwackzfts' WindowName: 'dytgjzextudhzcxfdtqillsoqns'
- ClassName: 'qpduyrhipuhhewpvzyefsmrgk' WindowName: 'xedpcywgzkoumogsmxripbqcegkkwdovnwmgim'
- ClassName: 'mojgdmszuuqktcpbnschquywoqigzescqir' WindowName: 'quqcqktkjbrmxvcyuzntprmsnuhlfkwblydhxj'
- ClassName: 'mpjstfwygztuqsytgmfmnwphozqzabfcbd' WindowName: 'guthqpfxzsjtzalgjttvoazxgwz'
- ClassName: 'flwfgysymqasqijhmlqqqnljttcyvhrvgkr' WindowName: 'yithjxjnvgxwlnjjtjhai'
- ClassName: 'haweipetjxfeyzlsjahrtnrymaynwifqxsuohy' WindowName: 'ybwvctcyjoquuhzmpwpccrb'
- ClassName: 'jjcyobyexpkkszguk' WindowName: 'aejexmcjyhwmvexijkyuhtthrjxnzumivp'
- ClassName: 'vrjyfwzmwvnkbuyqnba' WindowName: 'lzhilvxkzatfqqlsloziizt'
- ClassName: 'bygbirwtypqcpjltsdsqqahlxpmmjcpuadrizt' WindowName: 'uxjciuoogvmxqxisxzzco'
- ClassName: 'keugofohrsenktclyevebnkztukhgkeadc' WindowName: 'ezxctxjihvzcotwhpyak'
- ClassName: 'tfvemnjevbzrqddzjci' WindowName: 'cgveyzqyneyqykgvwbgrdszlsmoofpfauemxw'
- ClassName: 'vgicvafmqjiitqlizbwpc' WindowName: 'zfrihwjvkcdsfcnvtaflgcvwelp'
- ClassName: 'vrefbewixlqfljpbvsedpuucqeupmxuvn' WindowName: 'ekqxpbgblxicxrgxalcsopihweax'
- ClassName: 'hbadavoickazhmjwuduthkqpbedfvcidsadi' WindowName: 'nwkvsvbigdycedlhyutavqilcexm'
- ClassName: 'wfgkepsapwvhlxlrsqbdv' WindowName: 'oozfnstxcsictkgnaljddll'
- ClassName: 'eewurzsvztiyslotko' WindowName: 'tbuigiucmlrxledizlqsmwajilundqlfh'
- ClassName: 'fschbheoiyxqebqkgizhvcaaakabgbsavln' WindowName: 'gcjhgjxdbozidgfxmwvs'
- ClassName: 'bfkaxfoxqyulczguvajflkhkxelkrj' WindowName: 'taonhbsedoappurccytedlkyhrlembp'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'btzlgdnidecmgrbqkt' WindowName: 'yfcvfucncgegxkksirhdxm'
- ClassName: 'vzdggqevinqhfwrjyjsruxlssw' WindowName: 'mcnhgvhjrnfgejpdjqvqel'
- ClassName: 'emoblwhtreudijbsiqzmny' WindowName: 'ifjhypkdounfibdvaqlgbccyttcfop'
- ClassName: 'azkvyuxflkhdtoyyeuwcohmkyrircuqcforfyf' WindowName: 'zkzinpicfiyjkwtqlzsktkiwstttabf'
- ClassName: 'tmsctlngsbwowqmrbze' WindowName: 'rsnqyrhpeljseqrvmhazrervovh'
- ClassName: 'yfebuaisemjsxmedrtgcrvwjzua' WindowName: 'knbrdcsicwbnjozpixtag'
- ClassName: 'jdwnbbeircketxhxlx' WindowName: 'eesgtstngisplhwubozmskfqxfolwwtyfiyco'
- ClassName: 'jflvatftdqvdqnpnepkuuzxhyceasje' WindowName: 'jlbliqtjfbdxjjcdiafwzwpag'
- ClassName: 'eamshndofkivytpgprjyckj' WindowName: 'xrnohjaksmzbnidxaafjategktjx'
- ClassName: 'bxfvnolsbkakjpsdclduyizavwclocxmytgr' WindowName: 'mrvluodzeibajrvdyxmoqvccgt'
