Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsq2.tmp\InetLoad.dll
- %TEMP%\nsq2.tmp\Math.dll
- %TEMP%\nsq2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\nsq2.tmp\Math.dll
- %TEMP%\nsq2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'qfxndqrtmobrulxbhtmgazrhyvvzoms' WindowName: 'loaclkhetkpshmtjqrwefjrlmdjyduochuhpz'
- ClassName: 'khopofdterwkebzghrulp' WindowName: 'qlqdfqkwzmpjybs'
- ClassName: 'ahgpsracvrkvswwkgmrlmrwkboit' WindowName: 'athskwxzwflrgigxephqva'
- ClassName: 'emydxdhsgghlswtaomyorul' WindowName: 'rherwaxhfafzzhzvmcizzkmwwfyrqfp'
- ClassName: 'eeayvqhsqppnbfsgpxpcpfxwgf' WindowName: 'srmfbczwuuihshrzb'
- ClassName: 'yhuznhzdgxpcmprimvzebjfnmwp' WindowName: 'qhhwdyewltwikrg'
- ClassName: 'rwylqsjhbgpjhqexgfjljfrdpqznk' WindowName: 'kbpkieadksmufxpsuopxoleffwaxeoespxib'
- ClassName: 'rmndpjthkizxmbupmzggtugztycvfh' WindowName: 'vvcpcpucyswjuummstdnzhrzgqjffq'
- ClassName: 'gpydohrpwaahbjmgosgiohvbzqxk' WindowName: 'sxcgdsdddirjkanmkpqcfebsnrwmxpzbvhyto'
- ClassName: 'pixrextrjnbqvlcihbwn' WindowName: 'lixwhyahffoycgnsynhrliqg'
- ClassName: 'iszlixfqtsmwwtkhlpuysgpvhyjgiajoc' WindowName: 'keppfevynsotaiest'
- ClassName: 'xaglwzrttrxtddugcfwhjkztoyknecnrak' WindowName: 'pxkrfiwhzreudwsdek'
- ClassName: 'eyemzauwcyfdlqxlzzjmvovzwdqpb' WindowName: 'kmajwnqsexlgwvacekkoklhhjcqxvhzdhhlps'
- ClassName: 'dxvibrqventhdskezijttmw' WindowName: 'xuwdwojvtiiqtcoh'
- ClassName: 'lipdpsqnquleovlkaxovxt' WindowName: 'vgepiftakqsetawfkborwrbuxeaajxejtwe'
- ClassName: 'kzneuwvboupsydwbrcgxutnemzxnmbck' WindowName: 'qljtaxioycbihudedhwwnmnlpdifoabwtymx'
- ClassName: 'snoiwahbfisjigauw' WindowName: 'txcpljgayrpxstyfaaphtfdp'
- ClassName: 'ayjysjvutcfngdnyrupjmtujjddhexqbw' WindowName: 'yigqebupptcboxxgzfupfzbtxuay'
- ClassName: 'apclamysciukyxotixym' WindowName: 'imlngnzhvkxtfgkxwoq'
- ClassName: 'ajjyhufvnfqyfihjbcjtacmn' WindowName: 'vyrjuidgkniptxrpvfzkbkjuykdic'
- ClassName: 'utymdqsjzbcgpabzgcttbgbtrvptwwnemkyhyy' WindowName: 'balqphpgcpgocavbvfaborcsfszhbxja'
- ClassName: 'lsofoiwuymzljeuktvplufbkiygofmvwjyot' WindowName: 'fumfkyioqsihidahbyuu'
- ClassName: 'apfnfmwxhxqscjexwzoefvjsavbbjegnn' WindowName: 'tavxquibakjrlbac'
- ClassName: 'axgahglrkkbdrkqtxpbmickm' WindowName: 'tuxuqtyndwrgewhtn'
- ClassName: 'xmmrcrggnilvmmtqfiqgfebjt' WindowName: 'zivabrmxrpioikdgvyixkktuyutf'
- ClassName: 'dtzkamrwkdtvuirxqnry' WindowName: 'izlutlczceoqfgmwnu'
- ClassName: 'lhtxxtltlwwarnownqetsfqpanrrfrmix' WindowName: 'eccynhqwwjdxdwzczvruihfnwn'
- ClassName: 'bmaaatrrckmsszekhotbeolbyxrkhvcsk' WindowName: 'akfxufolmxhbzuyqdcflcjtqndpcozuxfynnwn'
- ClassName: 'lqwewqchnqkzwvlfpmsieqh' WindowName: 'bljdhblytpzjjqdayauzbw'
- ClassName: 'uphlpykywqvlvqgdqpccrhbaxlvdme' WindowName: 'mocffprpfkwjkgoxq'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'iloufhbsoqhxkvxseqa' WindowName: 'isovbgysalokpzxlaguibetlqqlyp'
- ClassName: 'nexzyurvtkkqcroebys' WindowName: 'aoteaztwzwmoloekv'
- ClassName: 'suyjbcdwqtssdzmyetmpauyhezhcwlkrhwu' WindowName: 'vnfdvbqzpdtbniwnqgctkfmhrizaurtkc'
- ClassName: 'lnebtylezcrkluesbsqpdcthdtedukzcywhetr' WindowName: 'smgmivxqhfyjngytnsxzwjldyrwbp'
- ClassName: 'acnulyaulrkhdanvfxlpbbwonsfuanend' WindowName: 'qzesxdwqqvjefgpkkdcofsutjfivknpjpdi'
- ClassName: 'jfclfuglmjyfevdvereftmvr' WindowName: 'lqtzktpowkkeuvetatvvkyuovalckplhrz'
- ClassName: 'tumraazvvechsrcwzwawvxczeum' WindowName: 'buqgkmrwpiturtiorpttloqfzvrtnrlrwmue'
- ClassName: 'tdwflddocowxgyfjt' WindowName: 'bsgmnhigkzvdeuhwtxiltcilct'
- ClassName: 'zxvoblyrogxuygnbcovtgy' WindowName: 'isfpdmvehvlwrwwqmnqddkxoysw'
