Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mkyghiyfjmtsktzgrwsocqa' WindowName: 'alybcudqzdjzypwfbwikrjmqaah'
- ClassName: 'gnqsnzeknktfewdj' WindowName: 'efiycsiibpusxxkfdepzlb'
- ClassName: 'mdvgdxpltrgzoexorvrqriom' WindowName: 'cqpsoochoirvgvscjvmrpkhhswdeloswiqvszuj'
- ClassName: 'qjvzzximlyezjfsbidkmjyktnpfnhfjntyvhklq' WindowName: 'eojtvflquptaoevirvocbka'
- ClassName: 'coyzxiffqikuyfunkwmsgtvlfmkyvujcrop' WindowName: 'fdpqwgunzwvgrppenkduwfinyuuagqfzwx'
- ClassName: 'gicyfcurytlsjshgjplcxitsxduylryfpy' WindowName: 'nctappxruewgupgrkbkhhq'
- ClassName: 'tmybbgvqymjtrfsinwsdcultlwxac' WindowName: 'qugwyptiuzdpfaosergelaynxdkj'
- ClassName: 'kthdgdyismgtoofxlrvmukcswqetsylzayvt' WindowName: 'ibzavtaxigctqokooevrlpwahydlp'
- ClassName: 'dyaqdzuvtfaqumjob' WindowName: 'ktvbxiglxcskuekbliog'
- ClassName: 'mntpzdourgnlkczspojesrqx' WindowName: 'edkungkvtpjjyoye'
- ClassName: 'crmmjricnwefsjlvwgubfuwzqpiah' WindowName: 'bdoagyazckbmoqnz'
- ClassName: 'tbbwldydvynhpupcmhg' WindowName: 'hehfqkpgnvmyhwwu'
- ClassName: 'rqkjpuwekvqxvrkswa' WindowName: 'ptattkgfdtksnaogcpxelleoytglz'
- ClassName: 'yiexemzfzqpcuygyltqaunbspkjmnwqbuayf' WindowName: 'wnlnoembrabaknslfmnrwwugvymopsjzmi'
- ClassName: 'lqffhduspixrcoivycvlxdcwzccoipnho' WindowName: 'cloeivdtkbqwypxzjfgmyuvyonxwxxdray'
- ClassName: 'olxlgqwrjljdzoyy' WindowName: 'blaoqweojtlhvvgcojejfebehnrrnt'
- ClassName: 'uejkpaxhykqwxlusneebagw' WindowName: 'sqhgmwisuzzcllxxpytosghsqclunncfvefolid'
- ClassName: 'rfehmkhafjmpzplrmborkunqjxdqak' WindowName: 'ezglbtymewyoompwwtgpkgzmenvkyctiquooo'
- ClassName: 'tvzlvsomxgszpaporidlbyfvbziffzjxmfyn' WindowName: 'odbmjruwndniyqewdctdyj'
- ClassName: 'enlrcmefgofjmlruwaajsuhuydbyfjabbbvmoi' WindowName: 'ogbgzmaxkvpfrhqirzgredxqcaimpqjcqympk'
- ClassName: 'ncmeghldenufcmbgkzwkvnnfhvnoknhvx' WindowName: 'gcfeqtoksmqikpbfimyitzsqksianxhx'
- ClassName: 'mzbttdgltcjyfara' WindowName: 'hyrobccgxkpmhiibljtvmcmczhwrddbiiuowv'
- ClassName: 'vtfokqbkfxsphshqhuilaqfqaigsmmqjzeowhj' WindowName: 'hywpplnwvhxzhemnpdjfcgvnkqlnzgizfcbvkb'
- ClassName: 'cvfeytfoqgdktkjsrzikwfsmwcbwrasyztxqux' WindowName: 'rcueeaneeckelxcjlkdgqgb'
- ClassName: 'ynublgtniacgnczzmd' WindowName: 'lcnwjvoestzrawkgsryc'
- ClassName: 'wgenzcghdwrmlziqbzlrqfhhtnzgllvbsrod' WindowName: 'nzvzsampuyacxueeyraiawccxsgwwwevgciejcd'
- ClassName: 'mfjjelkjysdaqfunyehuqeoeqykapkmzygpkm' WindowName: 'ckbvbrdwywdaktnlrwx'
- ClassName: 'wjrnlrayqifsxmdbeeuyekvfzlujy' WindowName: 'ejbpxzsdneqqpulifqluulan'
- ClassName: 'yebebbmoznkcyjw' WindowName: 'mnxhtirgsslozfvuaojgnvmiauxejuansctdtyp'
- ClassName: 'iguzuuyzthnhikrdkiosjziihhxtarxha' WindowName: 'hfinnhehmbxvehfmmjrczmwrutocybhftcgkj'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ggsnvsiccnnhotyucqxgskbtczfoavohlkbfua' WindowName: 'liictqkpnkfynbjdpexf'
- ClassName: 'oghoamkdyqqyoewcayrbihp' WindowName: 'ftufnfrtprpbrxnungmmlvoszrmrffwacbjf'
- ClassName: 'jwwfunivofpgwwennxnffezixwtxq' WindowName: 'dfoesramiibojnsmitgdsji'
- ClassName: 'vpzjbwmhxluvvtiz' WindowName: 'mbfommxxhfqozzjaiitj'
- ClassName: 'fawigpiihybyfnrnrkqwdrqkxslszqoujzad' WindowName: 'glxiszvgcqnarevyqeqfpvjpsbmaiflgxbq'
- ClassName: 'dchspoevvcplglwitcgpwftsbkrtjhad' WindowName: 'mmfuhqxkqneddstkjvlw'
- ClassName: 'uwilcgypuofrynlioc' WindowName: 'hmwvqqggnrtzklwlwpsj'
