Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'htavpzhnxhazrqarbyjxflmyjuo' WindowName: 'xdjvltxbcdpdfhkpzrknbnoweb'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsb2.tmp\InetLoad.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'nwirkbzuouxaiirmivgzjudi' WindowName: 'kjwtajkblmftlhzulnkkmnlphfskqxy'
- ClassName: 'eqdtqwsmxkrmjvwyiy' WindowName: 'fvqvrpahrpfnftrwtdatnzktffxbdrvjhiplmm'
- ClassName: 'cyseugoijvltdlper' WindowName: 'urbazudtfoqtumdzt'
- ClassName: 'tmqaviphxiqhustdd' WindowName: 'hpvdxrpygwpsvbwzsttimq'
- ClassName: 'ynasxldrsajrwhhtcvmlzkytveztq' WindowName: 'acdpbjkntzaeuxphbpmtwfamnkffkdaqkrvvmzd'
- ClassName: 'gviodqfhteedsucnwfqvbfilpkhcn' WindowName: 'dqjesarfjgslrdwyhpxbvsdwnlakpik'
- ClassName: 'ubwejscqysmpbzjrklioerpiehabjuyqnsc' WindowName: 'hnurxlpoikgvlrxafkmfjbbeeapkmebqhnwq'
- ClassName: 'ktknkfydzhwgkvrftiuntapcinugnrjw' WindowName: 'hdlwuqyllqgzkozonwiscudiaejpg'
- ClassName: 'oivtvdpczmuuytbvxkaooqhccdlnsop' WindowName: 'zhvqoqwksjapidndqjqtaycugynbeckczlrw'
- ClassName: 'qtnisgfbgiaxmjvfxw' WindowName: 'kbujplboawfhizbrxktbjkpz'
- ClassName: 'fnkbunfzvlutnpszfid' WindowName: 'fmszcjjlrtbkykwhzusscokyfi'
- ClassName: 'yotvfjizuzjnmdefjfrdueprlwfzmmdvsyur' WindowName: 'kjrvszzlsyxxgakepyiimbduxiydwoqida'
- ClassName: 'uggasrimxxaauhayzfcnhinspjudihbc' WindowName: 'upqzscehlinqwsdxuejnghyiqzsdqensuhewin'
- ClassName: 'ioqpyusxcbvvgoeelxlwtitcgddau' WindowName: 'lmuyiiirlhxkdvwdcmfkvoa'
- ClassName: 'ixtqrisntantgerkuutxqrxyae' WindowName: 'aadzxleexacwyirhsscxribkiosxdkumglai'
- ClassName: 'gepfohtodeungrjvt' WindowName: 'vkirexxqtvzgnqfnsx'
- ClassName: 'pssveuwzjeyacsuimtndu' WindowName: 'frcmvlsdkkanwnp'
- ClassName: 'wrjqdoclqmmdawwftmwpi' WindowName: 'pnnmubbuecbzrehtffaubgbsyyfgq'
- ClassName: 'zfwdqepkxiqhbqeptxvsjomgdtdjtxis' WindowName: 'sofsmtpmhtajnxszixwalnzrs'
- ClassName: 'pqrovbabtywlddqwiztakkngnkyudodwvwadrx' WindowName: 'rkirfxyoujvcorpknjlgsqrrwtt'
- ClassName: 'vjjwxuxazspstvfmsz' WindowName: 'uposqumlfuqegpmtoxvnb'
- ClassName: 'hgrcyfzdqmlcovrsehygrmkrfhh' WindowName: 'vxpeffhisuivgqqunyabxpubq'
- ClassName: 'xttghfwgtautvkfjxwvkmwlobbs' WindowName: 'pzlekjsiplpqejmkjnplvppjrzpdu'
- ClassName: 'nfkpfddmufsfblmxfnidrkoclrep' WindowName: 'nsromvujfoaslpspcfwanmltxxfffc'
- ClassName: 'mgwqbvxmbqkxschwrzexhnynltvhlqnfiku' WindowName: 'jzsvgpbnrhrkrewerccfljmztzdwfabqlcbqo'
- ClassName: 'mbgygoifloayiaajymcrinwwrlbs' WindowName: 'mxwrrzznqrbxkfzn'
- ClassName: 'aegnehyptepbxwovyqivhslnlgktj' WindowName: 'jghfmhrincjgiokiyzkfiuczlqwpytwxjky'
- ClassName: 'thdyfnzdsqpywdstygwd' WindowName: 'qfdefzpnxnlqqdagrmkrrsskznbym'
- ClassName: 'ghjwygdtpjsaujmjtasueqelzgotkbkpocfcjmr' WindowName: 'wspgnxqodqmabidmgchi'
- ClassName: 'saioyllofasrhbroiwklraepyizwzi' WindowName: 'ngbqhuzsqsjfovfb'
- ClassName: 'puddzcmnzhrfslye' WindowName: 'ovtqgnrjdnrwbzhpsspntdguqujfyresoetrm'
- ClassName: 'glqjakwgqvxhxhljoamxyecwvvronyymveszrkg' WindowName: 'nlwvphniymeymsvsv'
- ClassName: 'pvhftktnedjoizqvenfllwtuztizj' WindowName: 'rqwwozmxtoihwevxqhta'
- ClassName: 'okihqeeqitwyvaqqqjgtxwgwdk' WindowName: 'pculehkerssbimvfzhinumhsxsv'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'slbjiwlusiqxigqlqv' WindowName: 'ovayknxbzovgomfcwa'
- ClassName: 'pycinuotnsjqwrmtpdppfwnhiraa' WindowName: 'jgaymramlwrfjsunfhijnmti'
- ClassName: 'hhkldqqfzvdyyizmndwyasfklr' WindowName: 'jrnnnvlwdeeseqwwrlyvlchlqidcbkgtokdsvc'
- ClassName: 'rdbydjqeuddeblhtqomydbwwknbsyf' WindowName: 'qvqwgpriwvdavroztslokcvohunp'
- ClassName: 'fkvlarudbehwcdcqsicvzobcwvvgx' WindowName: 'xnlhhrulfiyrpurs'
- ClassName: 'dreskcaoalymvgscibahwd' WindowName: 'hyotdeptgapfrvsdtrywfvxqnhsyllhthovm'
- ClassName: 'ewamfozkeifuahnqkxzwfbha' WindowName: 'ihgoauhnddhbelxxkeioai'
