Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\InetLoad.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ntzgeojtwmykynyxbyqgcgdmnosprkinjphzqz' WindowName: 'kgwqhhbnzcvlbzroqcxqprf'
- ClassName: 'lojngvjkpdohphw' WindowName: 'ojwvhmsqpmuwcmvzdgqal'
- ClassName: 'ztotteozddvgsrwjphycrsisyahkfmvmbm' WindowName: 'duwzwanvgnrskwhumrhastguiupjxwrhledzut'
- ClassName: 'sphxelgrmoatldpcw' WindowName: 'ypcmdxuhyxnmuorarswikw'
- ClassName: 'vlaigybgdggrwecmbzwcyxavjbpt' WindowName: 'ewlkpqhtbmodnoilprjwxgkgvnglyb'
- ClassName: 'vsbktyqaoziukuhorseuv' WindowName: 'bfitmtgxminjvrji'
- ClassName: 'fdfsqchyjukobpurd' WindowName: 'tiswpjqwpirhyyeyvyfvtmrwspxlahdtxaamdf'
- ClassName: 'jhshugrcwvspmbfiszye' WindowName: 'plronggxajsfpsmp'
- ClassName: 'nssjbmgpwglqjwymoqhydan' WindowName: 'lwnfntnzhoyqxfepmsstgfyalrwziom'
- ClassName: 'sjuztqonildzpppxiwpcmdtdntlmxmfervwe' WindowName: 'ulamonmwninhiwdroasu'
- ClassName: 'pljmnjfzvlxtckspnrplyklybofzwwiiaogtob' WindowName: 'fixwwzdjqocnmnstqfhahj'
- ClassName: 'gpmeljhxtwkjgshduubryirflbohpim' WindowName: 'iaufnmuebtqxrnawnlrn'
- ClassName: 'lfbdomekouqhacpibbhqjoskymsrehypvrgw' WindowName: 'isetojdsodyzhvciiawbbeylkmdoszogffh'
- ClassName: 'edanrpxldctrstco' WindowName: 'yyyhhiwgwhiyowvehuksrlguvkcgcddwjaknn'
- ClassName: 'micbvxmcfdmyzfb' WindowName: 'jnsgfpvqagaaaglaeasoqgnutfsjirblkxxlhb'
- ClassName: 'tufmunatzudupnjrxddbffuojgd' WindowName: 'cdzyuxwvkjsqzybvkvkbctumj'
- ClassName: 'jcwobjdkrecfkwytzpqeby' WindowName: 'wtaylyxdnhuiikjkyaprbjvfsndbfvvxd'
- ClassName: 'nydintrgmnsbclw' WindowName: 'vdjhrshpcafubsmzzimunpr'
- ClassName: 'vckkeirraetcdtdvotbrcktxdxpwkd' WindowName: 'pvbfwbwpizmoskfnlwfnmagbbenctwjbk'
- ClassName: 'leewwdjvwcirvuxpgnog' WindowName: 'oabvxgncnzlzdidblsyxmlhdfquqkedfl'
- ClassName: 'ekspzzqpavtttlgaxlvzllft' WindowName: 'tttfrpkjagejktanzsrqzuj'
- ClassName: 'opzmcuewyvclnkir' WindowName: 'hlmlzvkoeaytzgvyrdicyzihrfdonoacydajwb'
- ClassName: 'dzfwyyimzybnuovfcbkny' WindowName: 'ogsgsnseyurhsvuaofragosnuw'
- ClassName: 'vjrqphueosecitwxdajsyugwsfwzh' WindowName: 'ndzghhtgmyiludvrjyvnveqno'
- ClassName: 'yvrwpmfirrbvmalduqxpjbnxehewbqmsmjgmoi' WindowName: 'rpffnnaslluztxtvzgjzyam'
- ClassName: 'uzuopjtopqlmpugxn' WindowName: 'njzjgwbtmevpasdwnhslfpofuwffs'
- ClassName: 'czejkwymxenszpkibgfnlrajeyciczuyrcea' WindowName: 'nzrldvnnjultyhmletmslnfvcvlspgptqp'
- ClassName: 'qdksizjaejcschbpesyzwtkhjathwzvfaydba' WindowName: 'wsxsabrafeklxaaiunlnjzwldlxql'
- ClassName: 'qxyrdwxfvccslcjdoyz' WindowName: 'ufxzeqqhxsvbtnf'
- ClassName: 'eabmqytxxlbrkcg' WindowName: 'qtkqwsaljzuilffdumrbowaxqtdd'
- ClassName: 'opsukhtsewafotn' WindowName: 'ygknkdrwushvarbcfogvobbr'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'xduphctwbeanxio' WindowName: 'mdxjkllxutxfqyjtofxzqpymotgzdxsaborjixb'
- ClassName: 'mgbuqzfwnfbfxoikgzaiuryubfuwma' WindowName: 'hjznmsrmitpdshkpitvxndfsq'
- ClassName: 'cfqkcmhusqwcqszgop' WindowName: 'fkwgdpgioqyoexnrnqluqtcxkjfgcumxvf'
- ClassName: 'xffursaziglevpmnbhm' WindowName: 'emhbmrmtitbxnafxjgxmaahatifrpysetrot'
- ClassName: 'rmvqyanwcolkjklofbptkr' WindowName: 'kyivvnpcgqknkfijuastmjnhuqnfyhxtscnwp'
- ClassName: 'iyddgbukfdosnoezbpwe' WindowName: 'zobgzdvnbluilmpncgosvef'
- ClassName: 'znqivvfrivgkreqtgdmouvwvkppfpzcxai' WindowName: 'ndbebivijqqmwjgbtocnjhif'
- ClassName: 'jumfdsvtalcbufhjyrcmnn' WindowName: 'ldeafuurrradrhejxkgwykcpanvcxtobvr'
