Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'zubgldvqvdgdxkmhrqkghlkkzqrmyxzgxq' WindowName: 'exxdnurwhlxrdaopuytexsamgni'
- ClassName: 'wvwjebhuoxkdmpspghplkeseucqpdcxwjs' WindowName: 'jplqjbonocapsbyirxxbvgo'
- ClassName: 'lhjvaphiitlfrillnyaulsyy' WindowName: 'uscyqsoepjadquxmzv'
- ClassName: 'bchrmxpwikwnxqbkeptgihjrwykwsvicnnogt' WindowName: 'ykqhzobfnskuejrcokfnvbcygqhwfkhdadugc'
- ClassName: 'iphnommobjjsxnlwk' WindowName: 'qohtboaqrdsczfqmwnhqq'
- ClassName: 'gdxwozzxvvisuxfavrilq' WindowName: 'yqqxiaxcxymocjzpvlekcygelijcvsr'
- ClassName: 'mileauvdndqxpfgdnssq' WindowName: 'gxglvpzsshbhmjqrkue'
- ClassName: 'llkjaldxthqgtwwphrtjaqxuptyliptonj' WindowName: 'maxvgghlrevpumqngyeceqgpgci'
- ClassName: 'pqsyngefbjjvpofegjausjlf' WindowName: 'avovyhdfwwatdnlbioimwxmedpwpo'
- ClassName: 'yjjwqpbvvvavqnksrnrgupsszatfd' WindowName: 'lbtyvforvdtlgebpzedcfqxpmwrjhyncdiwzx'
- ClassName: 'tfiejlxrmyyvthokihq' WindowName: 'yfpjkjutgoewcozftq'
- ClassName: 'fcfudzwqmtuxdfaawggxxcavxifq' WindowName: 'vpqscqumvnvzyaaavkhunqvtcu'
- ClassName: 'fjqvlfxdddumitwsaxxcpkpmqgpent' WindowName: 'ncmzpbgpxtcuqryydezpoegsqg'
- ClassName: 'vyxjzivjzalojhozotsghbrfxzhzativfgooh' WindowName: 'lzqopqjyfhstkgoyqzcmtrewrakwsz'
- ClassName: 'mwqojcexmmxojbracwdfspwkguhabu' WindowName: 'dhypirqgriarpqxykt'
- ClassName: 'fvenhqfadyrmfdto' WindowName: 'xqinttzcipvhkcdyopzpbtnob'
- ClassName: 'oyxmtccnnnsercnknveukiisqmmmxjnh' WindowName: 'gqlknucrnsdgneuuaffpiscyzkjitbzatwtyp'
- ClassName: 'wmgagvlbqnalezbzmyayhhzajzvowmgaibymwxs' WindowName: 'gfknbuuotdkurtvzifjbignhtcmaxepnewinkk'
- ClassName: 'yekqlyvsrjrkvdyivhttsbyp' WindowName: 'rpuphkqxsktlqrvfingrliak'
- ClassName: 'fjigvsrvrhwjldcfdcbapzanejqpzaighgk' WindowName: 'iniflczaatpmmcnmhxrbczubgns'
- ClassName: 'jckbnhnbdpicucprlksrifzloadgevmepkbq' WindowName: 'moecodhoqbvndeksganwv'
- ClassName: 'zlprwukbxvpahusglvwxy' WindowName: 'zvkujpwnltezitkapj'
- ClassName: 'twmcuewcfisbhptvwyoxiqgqcubpw' WindowName: 'ofjdpifnwmjnpjhizzihkdlxk'
- ClassName: 'aunlgoobpcbyxzmxdlotfcjepjoi' WindowName: 'ioozpqxcsnnpdudaixdvn'
- ClassName: 'ukmejsjanxkvxdkfzehkfhvlknavrrfkdajsqu' WindowName: 'jrjzpuvshmmxqswsjjftm'
- ClassName: 'usrzkxmwxtgyescpgv' WindowName: 'xcxtkjwlxhjqzsxtydwdobdzhwxmionfgpz'
- ClassName: 'mwzeoatdjcgqxganxmtrh' WindowName: 'qviygztzsuedtkuzajvtkaalefcp'
- ClassName: 'zibjupxrekjdzlsdrxxkutwwxgjm' WindowName: 'jxivitkhsltkjflyjepp'
- ClassName: 'mwsjhoebhjntuxalnisfcfyvjtzwailpazvdndp' WindowName: 'krjihjtnowylmlwdzfkawlzrixizizzdrh'
- ClassName: 'vcwdcyckikgjabyog' WindowName: 'aqmmbmbwpntxqkpnru'
- ClassName: 'bprksssucdqwidz' WindowName: 'yzoqyeasyyrdasnebotfyspkf'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'biywpismrjbszro' WindowName: 'xfnfylfygywmdlkxkbyvpghg'
- ClassName: 'eaaeqsvhcwabvjuujr' WindowName: 'afqqjtsmegvrfjwxodyfodglnyxx'
- ClassName: 'bmmzooyjbzxgwshcuujfvjsleobnftxefoxlh' WindowName: 'ihvhfmrbaszophsqejgglkysyugonqcy'
- ClassName: 'nifzgkseswvxvbnfltwahieqli' WindowName: 'lmjgklghqahmasath'
