Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\InetLoad.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'qzevbusonxozpjirbbvdrtuxwxjoczigesw' WindowName: 'xgjuzxgplgcpuux'
- ClassName: 'yekwztwkozcdqfxohrjoxyllyfzjbgzuto' WindowName: 'mbfswjuchzlkfxpuejttleajqrofnvosppgla'
- ClassName: 'lnyynamqcxhgyavvjrfmpadduqwn' WindowName: 'kxpkanncmanbkcoisihxshcudozsjgm'
- ClassName: 'hwirdllwpwwbgfgkwmduacnqyioeiom' WindowName: 'zmgumuosdnymkhhw'
- ClassName: 'loaoythqcpdfafnq' WindowName: 'emswnxzobmmskxcpciftlmlzeh'
- ClassName: 'oxxnjatvkfpzfiprfutxmqunenkhvvrrmhjhb' WindowName: 'qmxqodsuwagovlphmozspwpqkreaouhv'
- ClassName: 'zytiosggifeyhdtbeaikfzygaesrw' WindowName: 'lpcsjnvpdszfpfhwnpwtvlljlrkfl'
- ClassName: 'pwjgyxpvdiviaayyzfhflsqxmtamzf' WindowName: 'lfimpgxyfjuwmwuexoekrjecowikfukhr'
- ClassName: 'cbkccjrbmmstmoogrdhjidcvgckrmdex' WindowName: 'cjmccxrmpaucvlvlurpbacvxh'
- ClassName: 'ovldzqxiejpvakjulvfptghncrmxrmbqm' WindowName: 'hhsqrbjvxcmugevcqu'
- ClassName: 'mdotyptwqjaudjzxyzokevrett' WindowName: 'cyjftwkgclytvlsqppcdc'
- ClassName: 'trgsxbdntemekazdtljyodvzgjbzgtkpisng' WindowName: 'yepgfgksnkgdegmlgustavnrqu'
- ClassName: 'tjdxtrhbpeiplwfuhpjqldsp' WindowName: 'zyulvahqsywtans'
- ClassName: 'kovcbycfmtpmmtsrnt' WindowName: 'irjyedmtiauvpsb'
- ClassName: 'yedyezblwfqerxagoty' WindowName: 'ehumekhozzatatzrbqvnjefilb'
- ClassName: 'lntybtptuklrqngvhjnk' WindowName: 'miivubocjafwhjpodxldtl'
- ClassName: 'tsysxxnvxdvxglsjk' WindowName: 'obllbxiauzmpjtewoaavlotnwdzcg'
- ClassName: 'gqpqqqjvhqnnjyhjwjwqmdefwhjy' WindowName: 'qmafyzjymokhgbhvloag'
- ClassName: 'qnaoonapbcaiayowpuickfzwrmdrr' WindowName: 'tmdbjszpnttobtheiqmshq'
- ClassName: 'thexarjbebmwcdfvkfuwmwpsk' WindowName: 'rxaosjnpnrjxwfl'
- ClassName: 'utwdeysidmgijhohtnoetiyaj' WindowName: 'irmtkucscmkonazrigfskwgx'
- ClassName: 'wknioujmxbbhcbysuwemkuqmbosj' WindowName: 'qpdcrguryqebkpelvnkiiz'
- ClassName: 'yqyrhkzjiklcetdommwaxnjjykbuxlfsk' WindowName: 'kdyxyhbbrfltaitioe'
- ClassName: 'qzekdnoqpxtilgfucsqwd' WindowName: 'ypzggiyijasznddounb'
- ClassName: 'dvchjoswjbsoskbqsrgydqjeuswndeitnuvtx' WindowName: 'qobbcjoqhbdarbbwlqustfc'
- ClassName: 'hnkblvluqrrhivbda' WindowName: 'dbxrungpyqxeillcsbdogewkw'
- ClassName: 'fygccnrcosmmidpjrlajfmwzzuoqgv' WindowName: 'nvjpyeezpmbfsmohnxsqagtzcxca'
- ClassName: 'notasocuiscvzyjnsafpifmrqtesgb' WindowName: 'prrjxecdjclekfzgbkoujmizjocfqegnllfvby'
- ClassName: 'pnbwxbjdenenpfufhlylnkgkxkrvxgyho' WindowName: 'ycotrksrrrwtteivgpptkzzdcgoj'
- ClassName: 'vipnonshcigzsergnrcbsdamouahwgahj' WindowName: 'iwkoovakhrsbvctgrwvelr'
- ClassName: 'ddtzkdyngldzlhpnojhgf' WindowName: 'pwiisqrimzehfezqyisiyayy'
- ClassName: 'dyrctoiknhjnlmqaqvpiqzhcg' WindowName: 'ubvzqxwswhgupnvr'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'cxfswfzknemysyddtzjshwbctqjghkj' WindowName: 'qakffzjywugdgxyv'
- ClassName: 'vifeasgpvqsawydfctsglsjygzkkcrfziqlmw' WindowName: 'npplxvnwxcrljflmfrfvzhtj'
- ClassName: 'dqqfqvniaeqvfrtmfcjsijxpcaoqwp' WindowName: 'rjjstfhdnzvjtithbkjwumckpkoojgylo'
