Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsi2.tmp\InetLoad.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'tsasbonndxwrppxteqeesylzfuwsplx' WindowName: 'qrpspkplhukxtaagodocrj'
- ClassName: 'lsjtdsswmmgtnevxdfdbdb' WindowName: 'sflbqlxtcsbqqaoatymsur'
- ClassName: 'evivttedizexiclpjfmz' WindowName: 'lvnwxwpcbwfxpqclluooalhzedosbtn'
- ClassName: 'czpnagnqyewtpphlbhwpkkt' WindowName: 'vpgswxccnvhiwhsumhvwjn'
- ClassName: 'jpnuquobgwsuakiaomphqmikrmshrif' WindowName: 'rbyxwjzkrqdeqhdubtwabgscmdnggibtss'
- ClassName: 'fqblvdcehzzquamelfpkselgpedj' WindowName: 'xdbsqxerihfzszqfmwwdgmn'
- ClassName: 'uqyhhtnsctvcmqwhcslctoracokpbwnpjni' WindowName: 'aqoljsqajofrebgsmexlhxyaltggycr'
- ClassName: 'wgnbogzuvrwbjhbwaykhofthliradwpdjcxqu' WindowName: 'jjztmgjrozrjexguymvjqucz'
- ClassName: 'hutefxsiwgmeykuestpaf' WindowName: 'hscdswnqbunwgfmzqtvzmmtpodedjxmoyodetys'
- ClassName: 'opokaldmmlevzrkyfowdraoqoofpiixencjsuf' WindowName: 'lqiynqjcndhazrmnmncaxfbvowc'
- ClassName: 'wiprfcogcprsxcxmjupvwvnxlyfy' WindowName: 'gfwpbymiyvsyafrqlocmvyphfzssaffnmwgn'
- ClassName: 'kuitdniggkglxsve' WindowName: 'witjhvxuzirquwlbdhuvw'
- ClassName: 'hggjcgqohjcvankxlleqa' WindowName: 'mafjdbvvowrjanoxxl'
- ClassName: 'udqwieqgzwvuabswslcdforesjzrpj' WindowName: 'kbwjqyiingozoijwnlbzhtmcaobqelknmp'
- ClassName: 'dnxmcibsgjceyhahrdjyz' WindowName: 'ioopbxmlqfmgtmpjsefxgtdjtdkgacbrttbkvf'
- ClassName: 'wjhenboukatlgtbywqte' WindowName: 'pwcmmqzsubeqcqhouiqhkrlthpcgrincjklgon'
- ClassName: 'evwnguwuurkfcrmyfkwusfvuspfwxwwevgaiwof' WindowName: 'wvdhxkhhqowazddhqheusejuganepxorvyra'
- ClassName: 'sgvrlfdfxxkokhxnqqrqsooilrtmdbqipyz' WindowName: 'lsbwdsskyyrzlywbunaesrlpijful'
- ClassName: 'vqrtphqmplcmesfesqaxbjdqdbpeebhcnft' WindowName: 'yfhmxxwbxqkmsxpagvvcaxcywylpej'
- ClassName: 'pxlbegapzkhvknwmlwfetwlnbpdukzw' WindowName: 'egajsjflgidpzrssboyenjfoj'
- ClassName: 'pkzptrykuwukoshhmzmybw' WindowName: 'sskoxhxqhinbkglifuxte'
- ClassName: 'cesoigqjbssgbqebslesmjcrqcfuishxqlybwn' WindowName: 'lvtlzwigitrrxvdkxxbcpuswjlobejmcsntdur'
- ClassName: 'iocoremprxawkrlmtwifvevcunth' WindowName: 'bxbgzbirduqsmbe'
- ClassName: 'tnmbszebxpbpvwziissclgmzdnf' WindowName: 'nzzihieeionaayf'
- ClassName: 'qwtsoywjfbneyaphcgizxeihkmtfb' WindowName: 'cijevrdzvweiyqqmhqvjgaeaexdrbd'
- ClassName: 'brlnuvdtmtopsyrvoximuuuattryuvx' WindowName: 'jsyuczbirfltzbhddwjmgqurwkhl'
- ClassName: 'oncompphfqwvcqjakbhqrtwnfnpvq' WindowName: 'vsswxsccoxxcxkegrvfgqwjx'
- ClassName: 'psixzxwcuwkjbvhycygelgexveotakgzqyvgg' WindowName: 'nfjudezclixdnqflowzuyteuphah'
- ClassName: 'hzzikhlnysrkzggvfa' WindowName: 'jxovygsxuiaaealpovvpbknh'
- ClassName: 'mufuoriupmafwaiozydzrwmfvnajf' WindowName: 'aqqopwqbjboserjgirsfzr'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'lgcwyjpeaqavcwyzffki' WindowName: 'tkvqctnxthpiqtreq'
- ClassName: 'gwycujawaewanyddymlxcekcui' WindowName: 'borcjnngqlazttnjfescsnbxzayx'
- ClassName: 'ysxaxqscnyliwxdirtmboguuxuhrdctslw' WindowName: 'tqbobhppuxnijkekeeyvqldvd'
- ClassName: 'xtfodypjjfpulrwx' WindowName: 'cfsaubaimqweyxnnypkajcklutityzudtopjn'
- ClassName: 'rcuyirhsalusjanuiclesetbfwnjsdclu' WindowName: 'xvpucdtgyzajkiflesnluguuukeeuqqm'
- ClassName: 'uagxzkojznjpkimaymkmgjivymeqlmtzikfwa' WindowName: 'uifebqsjtfqxjlfdgqelgcauiumvsxov'
- ClassName: 'fusaodiovgzohjznjbcuks' WindowName: 'ioecbmbjmxuanwpjhnkozixhyjub'
