Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nss2.tmp\InetLoad.dll
- %TEMP%\nss2.tmp\Math.dll
- %TEMP%\nss2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nss2.tmp\System.dll
- %TEMP%\nss2.tmp\Math.dll
- %TEMP%\nss2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'uiyndymplddunbfxnvbsvlshtipxbvvwe' WindowName: 'cuvbajqkytsntydzarcudfcybkhdyedcvn'
- ClassName: 'nkqrhuhtoymrhuqbjddaw' WindowName: 'xcdoomsjbvkyxzx'
- ClassName: 'zszkzcwpknxrjsddukabescedzcspa' WindowName: 'dsyngnbqcakasdr'
- ClassName: 'bfjizzaehhiwsjduneswgtwtxalbirdh' WindowName: 'nihrucnviioatgh'
- ClassName: 'acxsanxwmxbdhdmbdslldzelpzhrijfjbh' WindowName: 'evqyxrspvyfiposvwucurjetv'
- ClassName: 'flnanjdqwrucqzxiuegfpw' WindowName: 'uujtgyuhlfeonuilhxlvnsdbvzltg'
- ClassName: 'yyfpmcuzeixxnjptvsrbucanrjqifeolna' WindowName: 'szgcdedeupocznkazfjoydcxkjwzz'
- ClassName: 'tanxpvuxuhdeponpedgh' WindowName: 'hqpmzlszdsbozfvmntpyxxbkgvliwjmltw'
- ClassName: 'ssmntsxapylkhlo' WindowName: 'ubyzsjdzydmcbpcterpiyevmnaa'
- ClassName: 'sfvcbnsqqldtrqqxisbvgtbk' WindowName: 'ixftptbewkloetnkv'
- ClassName: 'tfgxmudyphlviagaikcfhj' WindowName: 'fvbwhehyzixrinhe'
- ClassName: 'srdwlbiiebbhivqyvtpcpi' WindowName: 'xahoeravxckqsnqhmakjhfvdfnohvy'
- ClassName: 'hzztggjejnrtlodslnbutgdchwss' WindowName: 'xpoxqtvvylrnnzmjdsvauslulhltxlohvfjhm'
- ClassName: 'guedovwmkckbbbcatrhrnrstzyevjwntwtjbggb' WindowName: 'ilszrejynutzzculyqdegmzuxiclnbux'
- ClassName: 'wofpkyffwvlsxeatzokneej' WindowName: 'xencijleaouzjseyjhrtcmyizytahalwij'
- ClassName: 'xerttdvzyoqmdrcztk' WindowName: 'smqxoduvpzkyibsjkvetvjfmhaemufssj'
- ClassName: 'vrgangjiqahrsfuqwt' WindowName: 'oammdhotvjcjnmgsv'
- ClassName: 'bzqozxqgkkkpovwommpli' WindowName: 'kfaahkurpsfxldqxhavpkixefaezovprvy'
- ClassName: 'nioaifbqzhrvxatkhxlelt' WindowName: 'ieqsjacdiwcoawssuaflxftjergqcsebj'
- ClassName: 'kxmvaswvnuwfifpekivveqev' WindowName: 'cgiaczqmnwodcarnpjfj'
- ClassName: 'yrwjrvqqwxbvudyga' WindowName: 'zdhaedszgimxdsurrgsxlugqwccvtbbdzzwpa'
- ClassName: 'gommsyjxxaincprzuez' WindowName: 'xoljjykehbiegpkngerdodsjaqinkzp'
- ClassName: 'wuvkackzztpzflp' WindowName: 'hhduutnivvflprzyvnvyp'
- ClassName: 'upoxxvxkakdfyctpseomqsuuwkv' WindowName: 'vihyconstufplppmfcrzteqga'
- ClassName: 'sowwpvavbgpxboovqvjffnrp' WindowName: 'twuwcsrazyssccmansh'
- ClassName: 'yvhyrfawpodtlnznizqwxruf' WindowName: 'wvcqzxeumcnulaqaclfetcipdwpjjouqly'
- ClassName: 'idvrpjoxbklgmioyuiddnbxaxvzvjvqws' WindowName: 'dhnoprpoiwtpvuguanotctafmvhuadwuomg'
- ClassName: 'tkyhzyrodqfriobqlwqbgcwzendnp' WindowName: 'sehywxcjbmararnsvkh'
- ClassName: 'toqgfquktuublbhsowqk' WindowName: 'utuhyubiqentjddbllysuizqrufxpknrhjbd'
- ClassName: 'idozrddjvbzyrukwqoxobwmicqvqvntdbsrl' WindowName: 'uzgjlarteatnyphcunkjzkjdozcvyknsyu'
- ClassName: 'rwcldkwplgzoyumkvqjsxecq' WindowName: 'gelhtqnwhaqvhumdfmbrugarqhyqwhqs'
- ClassName: 'lzmcqqhprvrahwqslkzbzym' WindowName: 'kbymxtqshjvdibbzhqagkxthwzlb'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'cryytiyoljqzmabdhulyttbtcuxqjn' WindowName: 'jgxujtxthsfxvlmxwdlfkzlbngwyahct'
- ClassName: 'scxgnuznxurftkdkvb' WindowName: 'tlznwmedegdmdumbnou'
- ClassName: 'pdfbnouxutzrrziwvskglkxi' WindowName: 'lskmfytcimahbxydonasftyc'
- ClassName: 'apsfxadognydimpfzflmw' WindowName: 'bwtbifseazjduhzzmimpkvgsysg'
- ClassName: 'jevwsxkoxkirytf' WindowName: 'seaccdsgnhovfqasfvzuqgybljyaizg'
- ClassName: 'klvmeqrdbgyzsyayqltncugvifhyerfhp' WindowName: 'ytjqvrgnkfnrdpdfycqocwchfznmcjbychaejvo'
- ClassName: 'yejbtxdwiwkaskmqqxfwmpalxvrbailkz' WindowName: 'bfeqhifcjmwkzslwkiy'
