Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsb2.tmp\InetLoad.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bzkjnkbdfvyyngskusozrv' WindowName: 'kjlqovolutyuftlstjiipwhcko'
- ClassName: 'pgxxyjtoithpmvoqdvticconhkndg' WindowName: 'donyngonzqpkfnthtobfjxyftlsoiqsttwkc'
- ClassName: 'hlrzjziszqivbdtmnnjuieaepiqrdrxal' WindowName: 'iklluakqlxitkqvxkzathivbmxcdku'
- ClassName: 'eiovcjzxngambyfvbuhi' WindowName: 'qfyittehqqncjpyi'
- ClassName: 'fttmtflvhddyaugqauuakpmeriqpg' WindowName: 'nkwyqvlkuxexifbnfqgfsbktunjzvgwl'
- ClassName: 'ftqnvlfubcqwhhynhdajsbvcinvwddykq' WindowName: 'rmbfotokydzmaixaseqeawmnrabdyjgnvwphuvn'
- ClassName: 'dgvekmcbqzoaekweizfrdxoilbhbwjmagopcuds' WindowName: 'vxgncgqpsbyjkbvzwttjtodshmqcepjyfjlea'
- ClassName: 'lhbzhmaefdtnlgm' WindowName: 'bkwktpeyerpniivyqenniosijdfbqiinyh'
- ClassName: 'jsgexgkkjblicqbqegcboyohbrdimeg' WindowName: 'gxqofmeprupitnxxibfwuotlfyte'
- ClassName: 'xqdiwwtekcigvsrcytdyyxkzulejhz' WindowName: 'xpjbtcocpycrqwdqitblodekm'
- ClassName: 'jwfozjnwuxaclzbehn' WindowName: 'evgxwnlxsnmqopta'
- ClassName: 'wtricgcccdlwnwubckjcbfhjkwhslf' WindowName: 'dfekaxgcrxzxuhb'
- ClassName: 'uopxesrgrallhdgtq' WindowName: 'qrsfvxzyvjgmftfwlrjniyirlgrcv'
- ClassName: 'ahwdvsdbyjylfjheughrhxiygpputwbhurfwgsl' WindowName: 'fuuhhyspsvlgxhqjn'
- ClassName: 'zlapfkzjdnxmewczdxti' WindowName: 'ymouioehnspyqbtop'
- ClassName: 'jjkmpkglskacwuuxsmpljxtala' WindowName: 'wjufptdncunooozvhg'
- ClassName: 'qgtsvemndmqzlqje' WindowName: 'eraubsgunjnhrsuhuyrufaojt'
- ClassName: 'zismxebjrhrhcvpyunfxjjeszysngcjsocpnzn' WindowName: 'wgjusksfargeznsujjfevhkoagijsj'
- ClassName: 'tfvgacbkkxfrvfthfewvx' WindowName: 'flunqfgbcrqqasaptupggsykvvmughonvfsy'
- ClassName: 'akxxkukvejhujtfsdufmdpwaayifuwjy' WindowName: 'hsbuimjjkjxtexlrkzgaux'
- ClassName: 'lmsagzkjiexzrzoxlpuzzmyulddgebtak' WindowName: 'xmpzwwbizicwpzabjuqfsitvfxjxonkixhlfu'
- ClassName: 'sqdkchtrqzmsfhazrtq' WindowName: 'phpcwirpuwdarxvxidhdocalwdysahd'
- ClassName: 'czekzyoucskdvmc' WindowName: 'oqhdneiupimolgirr'
- ClassName: 'cjinatmmstagays' WindowName: 'iecnxitqspxsazgun'
- ClassName: 'jmggezkcratembbosgrnc' WindowName: 'gprnzyvsafpmuveoouuqryvjbrrgw'
- ClassName: 'nxogdpysuooqeskpghydggihp' WindowName: 'ipuawegarnghnhyofyrlvsirlhpzcsqyg'
- ClassName: 'lgbapqlnimkestswjqbsftdqgnepzqda' WindowName: 'npynqjusrupcvciacgytkfzaeipxpbmq'
- ClassName: 'hhlmltcjwbpanfkhiofngbz' WindowName: 'gkwefyidcoyirdtpgfvwyqirvixqhiwijpjev'
- ClassName: 'rwrvbvsuuzqkhzkervioaqpddzniiprk' WindowName: 'shobkknuvldntmkroioaxapybrkdomz'
- ClassName: 'hwylaxoajfmciqxurfhyhxkyctonwpkfsbpqagd' WindowName: 'ytvvpnvfedtvaanriayt'
- ClassName: 'exffuglbcixjdwakyskttxgbepphh' WindowName: 'rgjproqcfbkunldelqqhd'
- ClassName: 'mphfjrxnbsaryybyqkjb' WindowName: 'rascafstlfmekqmhwletwbrgcnrb'
- ClassName: 'xjtjqfqixjbfeeskfgpvnbmoeflnqykubtsj' WindowName: 'uaxaqeksrklvgshc'
- ClassName: 'tztkidmefmmdqllzdcjxwsc' WindowName: 'onranzrmtlvzmvmxfyzty'
- ClassName: 'smvpnfohptaglytose' WindowName: 'xnuhceqvjiuybexbxalgdstfhzlujkmkomoxq'
- ClassName: 'wsseaxwykcppzhrckjzfq' WindowName: 'cgggxdueaqncadlpcwrur'
- ClassName: 'nhtlfixrkqxaswhjlxgpnzuqngekytaxvvpim' WindowName: 'sacxajvutboypvqnirilms'
- ClassName: 'hoigvditgegydifbyveaelpveqnw' WindowName: 'zxuepcsfikflmbxibyi'
- ClassName: 'zwrfgazthtfwgjukcumehctuhcow' WindowName: 'bvqpeazqymjmnna'
- ClassName: 'rrsvbwtderamvjhyidliwexhzviojkfwlkny' WindowName: 'skxigbgvsppjabxqissfaqcgqv'
- ClassName: 'rdawucmwaqeqnxisbdoiggoj' WindowName: 'ksruorfqppprxyandbkl'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
