Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsr2.tmp\InetLoad.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'azvtttjahpkrsbrdhipjtavqqwkw' WindowName: 'wsldexgnjopleffnnatlqstdsvqdhhgvxbkdjoz'
- ClassName: 'rurpkcywbfjawfqfsfhnjtqcxywpjolmtp' WindowName: 'gifuwijjdmehovrxfoeqejywggnsflyglnpq'
- ClassName: 'skjfyknrqidukbhphhlrvpmsajfnpmzrzcbm' WindowName: 'aqxfiaekrzeiapbqge'
- ClassName: 'bfqzjohlivcalikbiogbfoqkwolxl' WindowName: 'gcbcrakhnyccuvsrxjohirfpwlge'
- ClassName: 'pwijapftiqhbuhkk' WindowName: 'bfvleifqadglgxymnuy'
- ClassName: 'qzovdvkdwyuqqtjqjz' WindowName: 'qbkcrpxamebknkgkh'
- ClassName: 'qzdtydepmmvznirfqiezqjjbgfy' WindowName: 'ibrjhksnuxovyrdltjsn'
- ClassName: 'kumbgfserigmekhvybpmdzxvxjeaxhdjtrni' WindowName: 'oppsuhxofskambgyec'
- ClassName: 'pwxjbbxgkeybtfzadeoxwhyfpjocjagd' WindowName: 'fwdpenovhqtyvgbovmmqzfwkrafkqbzwd'
- ClassName: 'kihllvqtlzpnaqccz' WindowName: 'fcggjjmupkddbjigvpauzqggpfckwliklqjcg'
- ClassName: 'blgkiukqwggfamfnmaialbsvepowwwrwf' WindowName: 'szcjsuxsdmyethpqowqpp'
- ClassName: 'jqhlphdfrvvradtwobuxi' WindowName: 'gkqljfwcgvseaqzuqklfczpukskcuktxdz'
- ClassName: 'gaoyunqhclispoindcqozdvo' WindowName: 'ldvaphyeswntakyzsvqd'
- ClassName: 'ckfzofjoyyydezglfmnaiggiv' WindowName: 'cylxvdqesqvwsuelevrtjblet'
- ClassName: 'floytcgthfjsorf' WindowName: 'mtrrdxrxpjeezuxnoudhiykv'
- ClassName: 'hmaomfuhvuewmovxuhtk' WindowName: 'jtjceregktmmxgiiudlhujnrjnoxb'
- ClassName: 'fsbbwnapxlfbmtiewxg' WindowName: 'uijdfhjeolwchuqlgtwqxpqrexoinb'
- ClassName: 'ktbyjjedjkibqwmfktemxi' WindowName: 'endlahmczsdfdczygopgbwtdzfrvjqsczqanf'
- ClassName: 'ucnsbhvhsdhzojgrdpynoeymvnqeragjbclfzcg' WindowName: 'icjwryoaeqskesjmigcd'
- ClassName: 'lariuoopknqpiwfpffeeeho' WindowName: 'srqgmifvxyqopaqjofmuv'
- ClassName: 'kzlqcpryqcidbeuzyhjkmplucoaekkyvgti' WindowName: 'fwvqggujzfijxpnxooefqwlhtyvisaienrw'
- ClassName: 'xljprjxkcmnyjtdxfhjni' WindowName: 'qoyaaxilozwloqrmxppgu'
- ClassName: 'thwtlsxvmwmoztuymmoqomlfqqts' WindowName: 'ekcjibvmyazyfukyuxgirnfffhbc'
- ClassName: 'xumjynapbzhbuiyzgudoeqer' WindowName: 'atfwpxkuloqdwcnwtfvvqhcodrwc'
- ClassName: 'cwipkanobrqdwgcthwkttlkdpwjeydmehgp' WindowName: 'hbvsofeepfrreywxxhuvinhhkbivdj'
- ClassName: 'zeynopwqfyogoybpchqszizmdbo' WindowName: 'ryasucrcpehdloouvwwwzbqnlkhkkd'
- ClassName: 'lhfkklkwfvrymamrqoxpuv' WindowName: 'wtklpjciwhebyhahveizcybhlxgyubjbr'
- ClassName: 'lupdjwrqifblgmoejyukitvdbojnpqxzd' WindowName: 'dbjnidwpwywgqdvbfgrwjm'
- ClassName: 'vwrcgtdfrbcrczogupjxyvbtxklcg' WindowName: 'ncyvslvqfwnokylxepezobzbtkvqogec'
- ClassName: 'btiilqaxarnzwjtmwdjnjxpmvlfymmtu' WindowName: 'czvzocgwfbbwsmlvrfzitczyocneydli'
- ClassName: 'fmdroiqdnucfmlptn' WindowName: 'ghsqjuroobihypcmqnagupacchotiqgs'
- ClassName: 'amqwjbsoccqfihulitrckmzmeubwtseurxs' WindowName: 'uvleafgiyyvpsyumpprabhtjngebwkhpmt'
- ClassName: 'armwzrqspewunkhsvyoitudokrbhnkqvhlbakgn' WindowName: 'rjndlvvhtnqieac'
- ClassName: 'ftudqqxgzmwkuqjshoqsuvixopn' WindowName: 'erpjswevpinklawziuvczof'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'zzfexhlbfdtkxugbimbwefigrtlnumwaorf' WindowName: 'vhkaezfjlkazdalrmk'
- ClassName: 'guaoocegipyqtrvdqvakjaf' WindowName: 'mwiwxbnjugtmcxjuwsjxhmdomdgboaafyyj'
- ClassName: 'zbxuxeizoxvbzflxsdkjhjgocgmz' WindowName: 'slhhhmdyhxshviguvlefzztpvwmzws'
- ClassName: 'cenpgqppkeypudzrstmookvxvxnqydnciicrym' WindowName: 'jtdqsrwdvnwrpolzbukerbalazx'
- ClassName: 'roflnutzjbnnwamxl' WindowName: 'lnrztqcdidihcrnxrkahnbkytq'
- ClassName: 'tkunojhewdzfvwlsjxgymipgducxp' WindowName: 'sztcesgnwayceqvwlogcy'
- ClassName: 'sbuoslzabaabmiuxkqoeukcxkpwtnqwohezladn' WindowName: 'kduozetisxasttttxncxzwszlzyysbtsnje'
- ClassName: 'kumygdjazwrzbirmyqryqgfobcirquvscb' WindowName: 'lootdulijuuyscfvhvsr'
