Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsr2.tmp\InetLoad.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ajeozsdmkimxryjyuwgifmshgpoggagakb' WindowName: 'iapdnxyevhovidixncczf'
- ClassName: 'inewkypfscwvikfbwktpnuplssjacyrcgvjqum' WindowName: 'yjkgwvqlozwthzoinstcuxpiekxezylu'
- ClassName: 'foqujbdcjsfrbwymjiqztkwqhetdof' WindowName: 'lnhgllvbliqkhkqabas'
- ClassName: 'syinddyebceqdrovryrietj' WindowName: 'luzisvgbvnsnjbgzswkogjvxvegdm'
- ClassName: 'gptdymzxruhaxpjqtbxjqkdqwwlmdwkhmzh' WindowName: 'hkihqrwwsohnzlshggmkxyqu'
- ClassName: 'yfzewlezfhfprdldqsv' WindowName: 'uyjeymztouoqanccezaushs'
- ClassName: 'rsyzgsuforznvqumvwsswrqn' WindowName: 'woovofmtiktcnmxrckxzsvjowey'
- ClassName: 'zqyktkwrtvkwqai' WindowName: 'qczagimstftjlcyt'
- ClassName: 'rmqnlkbbseydvpropwpmipulkdggyon' WindowName: 'zfatailyseoqahlzispyjtiz'
- ClassName: 'zmbbqaskiiqcwtnjyymjrlcasytu' WindowName: 'fkqacaazyqoxzpeaagcnkvqtrqnk'
- ClassName: 'cwlplnrovbwoibsfvfumtmoyhubnileofxyqnuf' WindowName: 'sylsjwlgxoxpqpijh'
- ClassName: 'ljkquoedicinghgwozoqwwjvx' WindowName: 'iehskedrxtvceyndzquboafpvlxjj'
- ClassName: 'eyxshuylgtjxlhbnlvah' WindowName: 'qyeskufrwnuclohliwp'
- ClassName: 'aqrlixzxjxhduuyojxyilzdrhfkozpd' WindowName: 'yommvndnrvikebttrstiqw'
- ClassName: 'kzelsukghsfyoyrbmtztifbhprknawnvez' WindowName: 'cqkzcatdxceflrhzojlfslotjii'
- ClassName: 'rmezuxztdrmfbhwuafqq' WindowName: 'ebvbsqtdkenedeseq'
- ClassName: 'cxgxeeingxvchfbrzerzyfsdyvufdhcq' WindowName: 'iiyjvtwunvgzfxlagnuhj'
- ClassName: 'dyhgtoayamjzchkpjsusbghzpvjjnlhghcb' WindowName: 'eyyvtkcnhadxnec'
- ClassName: 'wdmbdgvjueuankgkmfm' WindowName: 'kaclfibdvmhgjdxg'
- ClassName: 'uoovbpprarajfucltwtjpkbmicsqauuxzkzvb' WindowName: 'qnpjnaonnxsyxmseiiuabob'
- ClassName: 'bnflnootjcmlurs' WindowName: 'fbzwstbkygtjpkiov'
- ClassName: 'suvzojtnrnehfejekylsuaalxkawxmzlklk' WindowName: 'veoqtjmjrokqiicqizkoeb'
- ClassName: 'webwgxklrdbsxbrehowhuyopcpedoigdadfzfh' WindowName: 'jaqxpfmclwnwsewdswtpmxsd'
- ClassName: 'rasujhdbxsylntiphpghladnkme' WindowName: 'kuqggcpegglhwzrvklnyrucjpyzlwhpotphah'
- ClassName: 'gtabjioqifbrvjwgvzuxawbyismxrnfxl' WindowName: 'zphpohqkdbyufhanjqwrl'
- ClassName: 'rxdpwdiryaxvpkcpfbcbdxkrb' WindowName: 'dstgdmaqxhkvwktvxre'
- ClassName: 'gxowbzhojujzexeyeoqm' WindowName: 'lklhfpkxqpwmnuromyedv'
- ClassName: 'zhaaemwnovmrifupylkagnun' WindowName: 'pqjgkqwybyawjbx'
- ClassName: 'pcwmfupqqcikwtbwriahci' WindowName: 'zswckgdkeqzdohecpisbsj'
- ClassName: 'ilruhjfxzdaaubdusmkmjumactu' WindowName: 'ticpuhhkbaawevvjukmv'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'romjdtxdytgexnyvwjqag' WindowName: 'jqtcdqtlxbbnlprdswqqyzgtuhlzfkgrsbg'
- ClassName: 'hxvnnsduyfswtfvvsokehqxkycz' WindowName: 'ykegiuigeyfmthuvlahhryrovewyiigpjklbf'
- ClassName: 'kkuaonzgekfconwcmavfo' WindowName: 'ddoebpmcbndzuufyfbqnru'
- ClassName: 'dtdmuwqcqriqyuszceo' WindowName: 'ewzaoafjizlvdrzqukxfgxcqfnqlplyidfhgxw'
- ClassName: 'oksuhuzxbmekotyavxfjbefwinbv' WindowName: 'ooarimrozxklmqtitpziaczmjmiigzxse'
- ClassName: 'rujeevlqganrnxfptsuqcxsdhfcykmlqxgsuxqs' WindowName: 'zhilqunstnjfkejb'
- ClassName: 'bloivjqebvrjkciahcshd' WindowName: 'zyevoykcxphjqrcift'
- ClassName: 'vfuaumwnssdoihxhipxmuaircwmtkppzvj' WindowName: 'ryzmpkpkhwzwcwgzvtr'
