Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\InetLoad.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'icuwcztezipiveddiweykutoh' WindowName: 'akgdvyqkooiinxnewrzdkdwwmfhu'
- ClassName: 'vjrdohsxtlaogdby' WindowName: 'tneqvimmprsqshdmcaauyfih'
- ClassName: 'fmjtdykzvccwkbhjelqilo' WindowName: 'qxqimcooveuxgrodfgemgztwtpwgyrdxeunq'
- ClassName: 'buhuzodvwybxvlxyxovqzexedgqrixdsymzvh' WindowName: 'mrpnnpktxxbkqlspwwbxpray'
- ClassName: 'eppmigpbetbtlanhesbbdllvm' WindowName: 'czksltzklncwzgnzhdothqlrtaruu'
- ClassName: 'bbufyxarwbhfosglqagianwe' WindowName: 'yvoyjwxomqsgovqufeuastqhgykdoxlbdfb'
- ClassName: 'yuvrzswleyxhzkwhkvymlomnuofslqzlzpl' WindowName: 'qxmcqamxlgebixkxxrsozbfevyuubzd'
- ClassName: 'pzrwybwfgbuowwsymenfkavywlrcvkfjn' WindowName: 'dggeerzmobrodotniapkhosjalvgzzkhujndfpa'
- ClassName: 'njxtdoojnprinpxrkchjlobkkqdbpan' WindowName: 'rapnbkzjyzgixzylhpuowmmbpwydcxd'
- ClassName: 'ithgogesjtfystqzpvaogknw' WindowName: 'dlcqncxynjfdbdzzvn'
- ClassName: 'heswmeqlubchksn' WindowName: 'bhnyhwjyywcovljngxcwimlfuywidsqlwexln'
- ClassName: 'lmirrpegjxluhosizahzoszyz' WindowName: 'bkdsebrmskvrphmdiyxrmtmlgnfnr'
- ClassName: 'ntongtjtpdpdgqievgecwjosdh' WindowName: 'flpvvwcnbwvvdkyvpetglvbkfkrc'
- ClassName: 'ikxboeiehfrxygwnacklvgoejjvx' WindowName: 'zjubeqaboswjllfseoaatsrt'
- ClassName: 'umtluzalbknvpkmvmbvdlvqmke' WindowName: 'yuaqtllxgsnwdqyrprv'
- ClassName: 'jllbwqrbyyhldirfpvkwzgaustvxewqvewzok' WindowName: 'gaxfxendyfghxrxnxsuoipkdjrrdwjfqypbnxp'
- ClassName: 'icutnjwovhyxxuvylkfzzwnjmu' WindowName: 'twhwpzybsosogppdeajgbklnlctaypgxvg'
- ClassName: 'eavkmrkdonzackanowx' WindowName: 'tlntfuxcfttcuvfnvpxhibwfppeoazkvgbwhhr'
- ClassName: 'fududelsqbklsesqo' WindowName: 'fttnwobgmmgipktrphmuolrd'
- ClassName: 'cjzvhegxwpcbwmbxk' WindowName: 'hsgnksmabxtmtajudpu'
- ClassName: 'ruceccuxnbrvsjyvrecobclyeukzpr' WindowName: 'zynrkfijwgdwunsxz'
- ClassName: 'nzqowazrnkkodhaqqrrlekxcghpnxrkxqhfs' WindowName: 'mfryyxjcdrmwtmqznvpxuyzx'
- ClassName: 'ebcnpowyyplsxnnf' WindowName: 'gcfbjhommqvrbbncojrpkmjekovtqspzhy'
- ClassName: 'pwenvcpjzlxkjosn' WindowName: 'rukspkmlimbltvyvrrtl'
- ClassName: 'kwscryhaawqqtmlkmcoqfqqlqbxsl' WindowName: 'wjksatyeezyvnjcipysjihnkzcbgilhuf'
- ClassName: 'nypmlygpzoauvolevplulynvjrfuniaqe' WindowName: 'etvygtgawlzwftqybjoguyfnsbeecxyaffkbsw'
- ClassName: 'pevayjbgkydeiinsdsqlwjaiztxb' WindowName: 'cmdezifurkwlyswu'
- ClassName: 'kyzzxmvveozkbrhva' WindowName: 'dsmglsjmbsuunrcaen'
- ClassName: 'ciizdwjbuseezfzzdtxmpwwwuvinhor' WindowName: 'vmvsiaiocamymjcmlajiopbogmxxjsij'
- ClassName: 'jixaejpahcekffiwkyiytlihlwywxtrtptelkp' WindowName: 'cbtkeddinaezekstv'
- ClassName: 'uguuykekepmojnhakgaphsweiztqoloep' WindowName: 'lpbrbyiclwxgppss'
- ClassName: 'rumqvgvbubrzwdebcy' WindowName: 'ngdpemzkdexfyvnlhuovvabpzskvavbfqcpyio'
- ClassName: 'negpxblwojebwigsxhqducekqjcy' WindowName: 'aqawnhcseounmewnwymz'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'meuenympzvwqfxe' WindowName: 'yniaikwboiteslfpwlp'
- ClassName: 'zlaqqobmxpyjtuurgisrwf' WindowName: 'akghtuisfhvfwhttpsqdljgc'
- ClassName: 'eoaulvvkgigggvnasoibxithymqhp' WindowName: 'kqhdxppbraxdfwzrzxatipjthsmplrgopmp'
- ClassName: 'vucmrxuvnwjxkozhgkomjndlpsrcosnimj' WindowName: 'brdhimdvwbiznhwrtxhx'
- ClassName: 'xhpzbfqjpmgtpcq' WindowName: 'xubgmnsbitatdmvqccbmznrhkktznfdfvidv'
- ClassName: 'euqgcqtxrbobmkhg' WindowName: 'ineinwijdeokomwndmkgjkkkpuglyfztnjfvc'
- ClassName: 'thhcjslngxvxlnijzsvnrrqxuiwolsaujyp' WindowName: 'xnjmsskoaliyibigywoncgmt'
- ClassName: 'emfwquvmbtzfdbgofgrzzglfggmwxnletiomoh' WindowName: 'wyglfnvvqfmaaoevrqjqlxufi'
- ClassName: 'jlwrkatyzszyqypzscchhodhllbpvut' WindowName: 'jnyymlbruzcswpwhfcfiy'
- ClassName: 'yeqfwdkpptfoqbqcfkhwpxdmrxfriftg' WindowName: 'wtrmcrkrxdwlerdugcyruooercdmmnzsqmip'
