Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsi2.tmp\InetLoad.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bdxjazhywztmxqzgek' WindowName: 'fqtqkhcvidxxqizfxnmmscucrnsgodrfwinvzpe'
- ClassName: 'kedxgeolsswliiircjkinrqeqzylen' WindowName: 'kurorfcfweuhpsslhravxukie'
- ClassName: 'gzylygaclrxrvaczokjxvlkgcjdxgpfoiw' WindowName: 'jctjdopidteelxreetffwegryziugkl'
- ClassName: 'kzbgnyfmqycjdxgna' WindowName: 'fqkfdqotinvcqhplfpqcrhfwoicwybv'
- ClassName: 'sgfgvanqezfbgpdrnjnyvmqsuofakzo' WindowName: 'yrpowzzxbfkpphrnmzrkiydots'
- ClassName: 'mztewroxyczopbhixkfiwzmz' WindowName: 'onzmfoimzmcaakgljpjlskekrflvltxtnaihptm'
- ClassName: 'gbjcpvbohsoiobkqjkqxgmghqgiemhj' WindowName: 'sqxywpvcgkgmbyshookjgncqjcseni'
- ClassName: 'ntzbltwpgbbmektcjgbjrlwupewf' WindowName: 'vloyfltexsmekkfquqri'
- ClassName: 'iaandwpcjonxdciybdjbymypuy' WindowName: 'iqkvorkakwzkujgp'
- ClassName: 'mqloejsshzofbamrdguvupnkvrdtogrraqzgmbu' WindowName: 'bmqetzmffpvwkadxmqolu'
- ClassName: 'stqnswlvipbopxbaddsugjs' WindowName: 'abcumnlzjctupmdnro'
- ClassName: 'trwtjpppuhksiddpoi' WindowName: 'aqtkdvccddhoyglbxatxt'
- ClassName: 'pqjpuiogregnbrhmpbgzprrshespfzoauxpzm' WindowName: 'huzifbzhkgrjoqmwzxagy'
- ClassName: 'lndyufttcriilcalyujvdnvf' WindowName: 'mlhbyhcxnjrpyqvhdvonaxrqaswkmipcgrvtsgn'
- ClassName: 'drthavnrzgmrxnbwxkjxwhocjvpwfflfj' WindowName: 'hsznvxjkeasbvsuavkeotpxtldcspkjlkk'
- ClassName: 'cmrkqzbkdkxectujftcayefoaglfzfa' WindowName: 'xqjfwrxphtqvyehcxfieqonjbrneqdcziqvlc'
- ClassName: 'xcmaznlvmyoneqqwsuxouukioace' WindowName: 'afrswljozdqghypfmr'
- ClassName: 'wesshesiufkgdcuaawhavtpkzxksi' WindowName: 'lsfcylbbvmrlfaccfhanmmekcbcsjzu'
- ClassName: 'eponjrgczvvwxcsnacbfqdnrjkq' WindowName: 'uqmdtnqzhzrdpzernyodjbigyarckfkejgh'
- ClassName: 'cvbnrtpmrydkcaq' WindowName: 'kzahqfdwsmhfyhwuslsutffnbgyn'
- ClassName: 'zjcqpvkcdotyrrogofymtqjet' WindowName: 'tdghmfeobnncrmrcwghejcskfnupvvskkejq'
- ClassName: 'ykgfgqhiwzirjjxakpzcmtbjtzyufqgypytkzp' WindowName: 'phqaikjltgxhlzv'
- ClassName: 'zweaumwkwdajrdzrgwxpktveuuqnb' WindowName: 'lwgngifzttayfbmrgd'
- ClassName: 'suqrhfbkoikpksanyuaurlfifzszynigkncedn' WindowName: 'itopdhahryhwxcdpcyofuvvtkhvencajlzkct'
- ClassName: 'bteyzlmiwmhwniftevilatvtvj' WindowName: 'jbkclnglgvcjjmrztavvflnkghqqiuqsvyey'
- ClassName: 'wanbvlycipvvxjsayjt' WindowName: 'unqeffqmfnvbdtzhqdbngaxdhguvkosr'
- ClassName: 'czcwnnvabpgjjlztrf' WindowName: 'dgretqtzwkzppadkrlnnikyobfse'
- ClassName: 'wcqtqpvmnaymrbajwqdtdfco' WindowName: 'wqaakvxxezbpynfetls'
- ClassName: 'ymacsovgjjkfpyqypjejjgudxquq' WindowName: 'lyfqvapfpviiknehhjkryeccns'
- ClassName: 'lifjlivqjagqilzmmfhmjyjxxzwtlwismeqq' WindowName: 'psjoqedlpvldqsayjfzmtipzmrgmyq'
- ClassName: 'uxczfxbtsdfhqecgzvsrfvpuzdlsezl' WindowName: 'haaxptiviopfttazza'
- ClassName: 'mdozcldnzxkkqotfjprjyncdadqw' WindowName: 'xibtulvxctxnmkpdylzgyamzcilrxaomcydeux'
- ClassName: 'dviqornzugueqrf' WindowName: 'bacacpahqwlfpwlcbxtiaducfngorabfap'
- ClassName: 'ouwfbomngyzyqojpmhiycodvqnwthtkga' WindowName: 'tqvxpvagupfcusrklmvqidpceytzhqbywti'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'swacpbcvvcsvlajb' WindowName: 'yfiqffjnzmqgzguusfl'
- ClassName: 'ylnlcanteimncsrmahmtav' WindowName: 'jcuzpsdxawoxbejlqewqdkypiq'
- ClassName: 'iagogomdbablcdcuyipaum' WindowName: 'nzmcetuioqqxiqikqqusb'
- ClassName: 'izucoxdukaahpwtostfoiesilvbycri' WindowName: 'rzjhukdxwhngmwllvayow'
