Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\InetLoad.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xdffwuoyupssrbgxt' WindowName: 'krhvvobxmbehogvgssieiholltmflr'
- ClassName: 'xbrcevhioytxffziletcnacr' WindowName: 'fnsrkpckjivgtikphaukidrnfrshncgoq'
- ClassName: 'xlegcapsylfxkklonecdeudojbyhlawdbcvptn' WindowName: 'myisnplpuaajvrgmgxplnqsns'
- ClassName: 'wjgnvbjrbowkevzn' WindowName: 'ulsclenxwyaondqqs'
- ClassName: 'cohlsnxukbfeiiwuurqefansgaydvn' WindowName: 'doibowoybjposgcumsrbialmihbewhi'
- ClassName: 'npuanvbcnshxhmzfvuorh' WindowName: 'xyoiwboprpceklyyumyidxdfsaeo'
- ClassName: 'cealhrakwwzirhotfbgnnyydvrgaphkmfcambte' WindowName: 'hpzatfxbqabkrszlgvwipz'
- ClassName: 'yxuhvovvghnuofcumhxhgbglf' WindowName: 'loiwrskssxuonomydlwcbojfeqjpctoh'
- ClassName: 'qgrovrfjetescgqkjxdtegnuggwvqvdjucbx' WindowName: 'usitbcbjbjwziegskoqwhfuudmpdpqhfyaphk'
- ClassName: 'rknrqonmsiqbgoklhniaeyuiakevvx' WindowName: 'qtzwmksiovrrmpre'
- ClassName: 'gsmnjfyymocukifwrdx' WindowName: 'hmmznppjhtwuzpbzmupouitloehrplhosn'
- ClassName: 'lxppfzqfcqfpodoewcuyidaosugcig' WindowName: 'wqevecrzgrtastwxjrfjuhvsrb'
- ClassName: 'vcjprdrrozabyfhmyvuqpsoml' WindowName: 'vwrivzxrkgigqjtdlbkfy'
- ClassName: 'rtywwcgbepmfvagg' WindowName: 'fstrtogtxwgzcxcaycejgcq'
- ClassName: 'xggutjewkxcgqhussjdqkjcudfjykxegnndcppd' WindowName: 'vpvmltghsotpxuwolppsyfallm'
- ClassName: 'uvyiwgcxqthnejnnvkpnpbwmupharybia' WindowName: 'dtqjdhqltsrtxunm'
- ClassName: 'dkkmlqfbhwgwdxeohhcrnntjnxggk' WindowName: 'azogfglpuyolaahwej'
- ClassName: 'jsulgkdchefbvhyhckqqusfpzce' WindowName: 'kcemfntnkujsfaabwtjjxzembht'
- ClassName: 'ezvemgawbhovrpmffbprke' WindowName: 'getcyhtenldyxuplwkuuwbmpltkfqoeesmfu'
- ClassName: 'novuwpqbiyfitshikbxgwpuqkwlhubncwr' WindowName: 'etbqgzjurtwoetmzhyemltfqfts'
- ClassName: 'xrvqlmvlzrvbylkoaijqagdgc' WindowName: 'thydedipurxoyzncxemyeaseutdczypjfymzl'
- ClassName: 'brxtygongdguskqihwshundhwmuewims' WindowName: 'khgtgybmntozoiubfncotdgfsqfrjdxivtpmasw'
- ClassName: 'yapjytgzwhoswblbqvfsjcok' WindowName: 'epzeodipbyfquwilhdvtzmkpqslseeaxu'
- ClassName: 'snfxghtzbzyalarooezgjrpjcqwuqgpg' WindowName: 'eeuwiewpqvwqziia'
- ClassName: 'ofxvcaonikjbhiyelizyhqyrwhvekq' WindowName: 'nwrisfdpxeivwrzuwopvejinjherwwbmbwv'
- ClassName: 'cwsdpaoyddaotaxuwrtgkdf' WindowName: 'mhyatyafxcbbnnumfehwkcpfhblsqttfwo'
- ClassName: 'pdrxuswhluatcfxpbvaaz' WindowName: 'mxohefsveyquasluugbfwscdavdwivuuu'
- ClassName: 'drcjmunmeyfsxjzsq' WindowName: 'ohfbumzeykhxtehrgjmgp'
- ClassName: 'nfouazggxmtdnhxiuaslwhesz' WindowName: 'dlzkgepnfxwcinqrrvrd'
- ClassName: 'obyjvxeerhymosbwlxpmxuusmlbybpqgribahra' WindowName: 'yxruuuesqegacvx'
- ClassName: 'fabkaqmnqrwtpuqhixrnjjqwvxrnqkghtqcs' WindowName: 'eslvuocntaptthjxjmycocxsgvileetrwzxgn'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'setsorfqbjrzgbrpsyjjasvng' WindowName: 'wejiuzxkaxstfrbxjr'
- ClassName: 'xgxtcyhzqgmutkcmiepcbhtynodozxorv' WindowName: 'toodpsoljinttgvlj'
- ClassName: 'shcyoztzdhctoqi' WindowName: 'mqjjbwkhvpwfocpfzfajvzfjdawxhwpseuewxx'
- ClassName: 'whsfwkcjvdlgwkav' WindowName: 'uecnipetgduliupyqfaehvjkcigdz'
- ClassName: 'rejhzdhpatdqxfbwjloaieytxtmtjyhqxq' WindowName: 'ceyhxohzlrjaqgdvvjevyizdqbllgk'
