Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\InetLoad.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'wnbefgbmairhlvmmbzwe' WindowName: 'fnbaqzzlumntjmlvtxrdjjrswskgeexusjyb'
- ClassName: 'rqrfwebezxnflrmxteqhpykvppg' WindowName: 'rbjlieuaebpynontcfjscqxowocidwgjx'
- ClassName: 'vgpijhkgnzsocvg' WindowName: 'puknaxbvwiohvljczwdokcktxyzulkvidsagxz'
- ClassName: 'ceotaxqsmqxvsucwpcwjzku' WindowName: 'kfgzcmhodvfzlfwvifs'
- ClassName: 'gooekmsilrjuohyqhtop' WindowName: 'oqgzwrpaujsnukibatc'
- ClassName: 'guwthfoogmlxuybeeimnu' WindowName: 'omdvaleanzpilvirzqs'
- ClassName: 'nwowbabqcgiqsor' WindowName: 'advbsrqzjonjfewaialutqhzwqqcegr'
- ClassName: 'hqsheyrmnvvkqimdcztyctzk' WindowName: 'ynmbjjwxlhysjksxhvjen'
- ClassName: 'lbxjyarokqesxmn' WindowName: 'elikjllaccjdfegjbfy'
- ClassName: 'otpzcsmckuboxsnzwydjicbeifx' WindowName: 'xvqeaolsjjvdbfkxpwikicy'
- ClassName: 'dlkpkavbsxkqjderjubtiklpnstmrgiponicmup' WindowName: 'mprmcwefgqofghvttlv'
- ClassName: 'bnbvuatzozzhnunspvjvzoyigbget' WindowName: 'vticxyasyudvuarbuvyowqductdkpc'
- ClassName: 'sekvuwgxendngeflyytbnxgxhpla' WindowName: 'udlmyrjxffdyrgqfg'
- ClassName: 'cytphhmolmytjkzdda' WindowName: 'lqauebihtdryocdpajq'
- ClassName: 'fxozgbzpyearoqryoy' WindowName: 'vlyxqildugmvpxzoytnabtqnfckali'
- ClassName: 'yoyabyazgetmlyqgzmwzvrretjnjsumtdxgh' WindowName: 'rlkapocbwegwikksvhmkqvrsecmvetitwfq'
- ClassName: 'pqxgggcxpfqmfpzvzgqonskhomytkbchvmg' WindowName: 'jctfoopjqqbjpmqkgul'
- ClassName: 'wxgjbxxcluzryhawk' WindowName: 'yciftrnohfriszattmuvwfbnls'
- ClassName: 'fsxtdygflthvzpqkxoxfospjhe' WindowName: 'uimawfwhkybfbmsykcxusbjgvo'
- ClassName: 'vewlgdjtjnzwzfnhb' WindowName: 'gsuhylhzsveqfydmdfvakgunnxxrqp'
- ClassName: 'lbssljnsehxdicav' WindowName: 'yboigatqzkicdgvemvsyivdgiqnid'
- ClassName: 'hjfezoulhxhfafkiusawoqytybgncjurqv' WindowName: 'rehbjysoksibhvfqloxyiunlqvckf'
- ClassName: 'zjenlyurfmsvltoaquukkgsvyhzih' WindowName: 'omtqzvkcflagvpzlycpxwuygntvxqkjjcsyvonx'
- ClassName: 'urwujkgvofurnjpxybkjptpkycieiktvhvuxz' WindowName: 'bvqiesgwlhagkrl'
- ClassName: 'yespmumouoqdtfhsbfbszkbnvhdsllhxow' WindowName: 'iywrndfywnpxztgnuixsigvmxjt'
- ClassName: 'ktlkvdjftduedlororyvrqdgeybkccm' WindowName: 'mlcunuqlbomlydbapvrmkdfqtolfxla'
- ClassName: 'cqyatvvodqiakvvcinuygwzstzuucvi' WindowName: 'othdnthcyswbapdp'
- ClassName: 'ragtzcqzltgmgsqxjo' WindowName: 'pxxlukrozpqndvtfplvkpzkvp'
- ClassName: 'wgfjyymvknbmhueftwgiwrhxqtmhxwaqnhsha' WindowName: 'rxzckvkquafbxolzbqorsiiorqdlxboejyjyv'
- ClassName: 'srgrfhfdwwygjftkuafmvr' WindowName: 'hlduhoaeziazkjdacmyammwmmfbszygbglva'
- ClassName: 'zydmtdydqknvcet' WindowName: 'awecwdhbjaxnpajrw'
- ClassName: 'tpljlvkhturkveskhi' WindowName: 'uaodoolozcddmyxokswvwjahugyzrmqmnnve'
- ClassName: 'njazbekygqdgoopwmmgh' WindowName: 'sxijvmlirkpkbscoladdirhbinq'
- ClassName: 'beslsyltghuielruntlwnrhqnnzq' WindowName: 'qrmslzdqososghn'
- ClassName: 'uzbxzijkiovwgnehybdznkohalbckqwwbl' WindowName: 'jfwsubbleedipupmvntobiqmwvlcamqnic'
- ClassName: 'imubdqlhaqpevzs' WindowName: 'xumafjlykawaqnxzrvyepml'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'kehffodhqutvlgwkjuebuxawq' WindowName: 'lhmtsfiejhghlvqoxfgvkmdjzhmzsdcimvkhgpw'
- ClassName: 'idoexdjmljljmqfudzbleefqmunyftg' WindowName: 'fltmsrpwrswbccirumcpiwojlexnv'
- ClassName: 'jxanqymbtlvpweexsqxrlojevkrzeeognzrsf' WindowName: 'mweyqkzmobsuqwvceblezqjmondptdczrjorh'
- ClassName: 'qjubuyijdfmuopyvtrmushrrkjflro' WindowName: 'dowvmqjxlmpptjpvhctyzfhklqjlqmtmjhm'
- ClassName: 'pgovmuawjuuaoolzeyedxdrtyugugscvuc' WindowName: 'eeophrvzouseayqnqr'
