Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\NSISdl.dll
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\NSISdl.dll
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'tztgflcsfejdhqqfmkpenegqpwrshxxpxcmkps' WindowName: 'wdcpidswwxxcshugkxmaqfdb'
- ClassName: 'rypejloldufljitklvsuesnuri' WindowName: 'nveqrcluubwwnkreggl'
- ClassName: 'ptzgczyvtbjqzrbxchvqnphqevh' WindowName: 'vugwryqmqrccdwdvassskspllseyokidco'
- ClassName: 'ystzqpjeynqicaydsaodrcbwndbrkty' WindowName: 'uhgrprapfxevotwv'
- ClassName: 'yypyfryhkipplqanfoxim' WindowName: 'cxmetkruxzktfeatsfejhxejklniducmtexafq'
- ClassName: 'vxbvzyaxnylsbwtomserkmxcnqc' WindowName: 'ijugagyzqyxephbueuhrbedskrskypwrane'
- ClassName: 'fbilgnikbugvdvbrjcdpjqfwbpescc' WindowName: 'gtufbokyzkriajzvvfattivygsa'
- ClassName: 'hjdtxvrxdfserughdxlgmcnjdkai' WindowName: 'hcjyddvbnnyogvrgavajoqznrrux'
- ClassName: 'vjzpnnjtjrwnflyikykmo' WindowName: 'nrpypsfoujxzruvilbs'
- ClassName: 'acrzymsseqikqfywipn' WindowName: 'uqpmklfamsdurjqdcdbhibnqssck'
- ClassName: 'dhzpocguiqootxmwvcjeffflptmtoaudpbij' WindowName: 'dumfixiweuqhrftxkvmsxpttagamfgsuu'
- ClassName: 'uswiwwyarrynwyvtolog' WindowName: 'ouyffsgbgvmqhtwodkwuczvmc'
- ClassName: 'ulvulvgwxtxjunxoihoydelpwx' WindowName: 'qdxujqiytdeirvq'
- ClassName: 'juvrqybxytfvuxcfilvmczytezqtjtrcz' WindowName: 'sasxrxmanfhrmkcmphjtnohrdnkocojzm'
- ClassName: 'olfqvqyckydhpwupfzwdbzovdblhtcb' WindowName: 'udbywdwuhaazkowfqnqzwa'
- ClassName: 'efoaxdhrramaitdxwhtyhqdgkqocujkdiiwbzep' WindowName: 'kuuotjtkwmozuyce'
- ClassName: 'givqtydsjgaattwmehdvnfbmjnyrfvtew' WindowName: 'pbhqyxggtmfrmwmuirzijhhkdanajhksmunpuem'
- ClassName: 'piwfpqainimwiwbtcpxcdjd' WindowName: 'iolnzraknzchxaj'
- ClassName: 'adkmqzidvzcbfnhmimx' WindowName: 'rslfihcxdhzqvlvwag'
- ClassName: 'miinjisqwlmltbnvzmve' WindowName: 'ycvojguukmpmowb'
- ClassName: 'vojjuovzmwwqbcwwrxlpcgxfy' WindowName: 'jcjpvsnlrhzcgwxlvihvrh'
- ClassName: 'wepztwscfhsweoeabhimyz' WindowName: 'nnudmagmdnlajstjitpxqwyif'
- ClassName: 'wvrhfdtknzknjxqlovhzsvovhvdshlogby' WindowName: 'ngoyuiqycqzwbnwlmpbmkklj'
- ClassName: 'mcreyytenwkbxqpsjgtubjuzyir' WindowName: 'ooufnfekwcuimdj'
- ClassName: 'hwpvzspikkefklfcytvuswynhwepkepvmevg' WindowName: 'zcrvgrrkliakyiwymuzbcabd'
- ClassName: 'obcxlmbxcqdsikf' WindowName: 'vphjltohwmclmuxgeymkixmnibzhzr'
- ClassName: 'skcavkpmdcpgjhzyroemgyj' WindowName: 'urzxhczqgdinucyiaznmhxibjiae'
- ClassName: 'znwaoylnuixpgoimnvzlgdjbwnr' WindowName: 'cfrqiuzjgvgtrhvxrrrdnbtthreqxkryaxmzdr'
- ClassName: 'lurdxnnyupdihmsxhafoznmupv' WindowName: 'zgfebpgesblbmryeaqkqhzcvtwjguiqwtotrm'
- ClassName: 'bmtwzigjfhvwrftzokmbccxlo' WindowName: 'szuxdbrxqlyhcnjimzgxukxdrkkd'
- ClassName: 'pcppxwuqgwdjmmangrmziuolcwhfmcomcsdi' WindowName: 'mlvsadkkhgdyoshpvgfsekkxonwqqte'
- ClassName: 'dqwzsvehbgmvitbrmdjwya' WindowName: 'rdpmekzidqlugvzrihwodmk'
- ClassName: 'waboehwbadfhbdrkfwefhka' WindowName: 'yzitapnmqvygjzwpwntoxvioltnmdyzybwkmqj'
- ClassName: 'njkdrnlfdfdrsgrlzlcupywf' WindowName: 'cbogyrpgbutbhwafzaiupfpu'
- ClassName: 'cziandgpnnwxurmhxsujnayqljdjotbz' WindowName: 'nsarmkabxullidoinpzs'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'eikmyaqxncgnrktzarrvbqfizbe' WindowName: 'odxitqeyizbirzbgvyl'
- ClassName: 'ercyzctfgmvwocfstqfelifjotrbcyxurhptbq' WindowName: 'sunmgdlrilrzqpvsjrkjjmavyqrlkw'
- ClassName: 'cgoloybjqmycgmnayjfdlrgtvbtfhxbokwen' WindowName: 'xkqorveeymdckdozbochf'
- ClassName: 'mfhssrhfnrwitbsumik' WindowName: 'zmlwbomhhrylucxraozgavriecynacum'
- ClassName: 'srtnsumgwjlawrwhs' WindowName: 'xqqgdllvecbjcdgcpwtudhthwpqknopb'
