Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\InetLoad.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'pdgsrfbjqdyyyhqjucrrc' WindowName: 'kgpuiziotjfokdzameuvd'
- ClassName: 'ckgpriigbmtrzxwrlkxvelpwxufruy' WindowName: 'mpmypmowzhgoqtcmiebuddijm'
- ClassName: 'dfllttjoypkyilfqypyihpecxnjkvvnb' WindowName: 'vpkechghkegctjjuiwxjjeyxaepnalpt'
- ClassName: 'noecujrmsaekoypizqjysyzelycfkhxgxehm' WindowName: 'gjvwhkzfjweudmxqvis'
- ClassName: 'dirclzjcklhonqjvfowvgswkcswnxrb' WindowName: 'amxgdznjkyfypoemptjpcg'
- ClassName: 'ayfvlrfmickjlrufq' WindowName: 'burtgafpylctjbejnawwkdtvpbljrx'
- ClassName: 'hvkstwyasischnxsv' WindowName: 'uuomzgphaacqrnclrdjioxqdciiuz'
- ClassName: 'lsexxigmntlikott' WindowName: 'juhhcphujevdfanwffbqldqjxghjos'
- ClassName: 'aruhckthtizroxqibfadcwlh' WindowName: 'nqrwnzzaklrdouiwpsiqvvgirqursccxbxt'
- ClassName: 'qvinnopgypsobdhowhmqwgodhrvwvwayvbp' WindowName: 'kvlpfoamijfnxtaekgrqppvqlexb'
- ClassName: 'fnbrtwiyfhtnkskluiefilnjhhglsnjspcseecj' WindowName: 'hoqhkfkhixzymzshfaerkpp'
- ClassName: 'mphmzljvwxlibpwnk' WindowName: 'xrplyirpndpleggbs'
- ClassName: 'ivynvqlmlqzbzrqingjfpumkqhur' WindowName: 'ihcuwwbzhahfnjmrecrxhebzxss'
- ClassName: 'wuiiydvytnwaticqxwbbtplhrcjjm' WindowName: 'auijyjjonalpndxkvxsvbpngrnerygyahsga'
- ClassName: 'aftbkemoexikmnohy' WindowName: 'pwvzxnjnjulaeawwtvboazwkuunbranp'
- ClassName: 'kiavhlpcycyudyoogab' WindowName: 'ycnhuidkggdflxdsmtmjatpvmdmxn'
- ClassName: 'tapmhndahbljujkitgxezp' WindowName: 'dlfczesetucpmypmhphaqgyyhndnhoabbkf'
- ClassName: 'catpmpddiluorqcfadwhl' WindowName: 'ehpacuxhljabvtzikjizkwdakgrdflrjt'
- ClassName: 'nbhebovvbmovpqzmwtaqchmasnqngfzvhdudzr' WindowName: 'kuucltmfxvmpjthowaprd'
- ClassName: 'ecgloeemkcuwlbixlqk' WindowName: 'uugidfygfdqjiuhmhzpxglndfpazamfgwoi'
- ClassName: 'slrpbigedvsxvbpdlubthykrad' WindowName: 'qvxekylflbglaljkimvtr'
- ClassName: 'osnsikhibzaopnnnnzaak' WindowName: 'yooehkopcgwzfuolvdvsa'
- ClassName: 'yzbbxjkkeaubwnpqazmxbjiqqnwhin' WindowName: 'wmmfagkgqyahcxbtluk'
- ClassName: 'thqxjvwmhseoryhauialxnbduqgklgoexi' WindowName: 'wtzrwbwldqvemdmhsyuljjlc'
- ClassName: 'etoxbilvmupvspuzxrglw' WindowName: 'jctdtivttccbznvbqouabdmvyiitqg'
- ClassName: 'vkiyssoyxyireooypdeb' WindowName: 'dcboipwipbsdsqvryodvaqaetabivczojgw'
- ClassName: 'gzuqoufqudmlrjxxogo' WindowName: 'wptcxteczsvkplqxezgwnggscvtdvhqe'
- ClassName: 'zfyysfzlgqdcvqsjimwbdtdtxbpaih' WindowName: 'pfdtnvuxozvyaou'
- ClassName: 'dspjyaqfjaksxsvknuiwunehamiwfoslzbfpxo' WindowName: 'cgxpteukptwmhdmlhhebmudoeetxj'
- ClassName: 'eopqnirmasnaytpdyrxlhqbjtnxsdsbiyfur' WindowName: 'nhntjsnwullixfr'
- ClassName: 'duuutzpfsmqdinmtjkdrjahwkfsnih' WindowName: 'hidaxmeuhzqvxxkydbbhvgqzwpglckgyz'
- ClassName: 'mxlurwiybjgkyujzblfhicpvbmicq' WindowName: 'fncajiplynpehgfqzmteqfxanx'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'awxgjnmrblvwlcwlzbsythdwxjwkmqtkpd' WindowName: 'tkxlkacbzgbydovscjjmieivdtmhfaeysdr'
- ClassName: 'auxvspqsjqdgsijgi' WindowName: 'suswatkqzeekthdkphcp'
- ClassName: 'aezvvuiwzpthepobfduioxrso' WindowName: 'esstczdcxwlebbuotoszc'
- ClassName: 'hfmiepwmnekwbcttvctxghdeqibpjzkqzprpfpf' WindowName: 'nyqgncxartuispxcivgiilpnqrefgzpvglxby'
- ClassName: 'xopoyyaajgwxonyqqlindbvztztgzthupqjspgo' WindowName: 'vypqmzzpafxqpxwxszcchkcuwnam'
- ClassName: 'sqglzliqiqdsuxvceogctrachnges' WindowName: 'qthpducdckecqkpqexskmrqljow'
- ClassName: 'btxjlwymivzznqxhgkitmljosihgqs' WindowName: 'lqdqvrrvxpmhkgftl'
- ClassName: 'nrqcutgzpxpljwwqxj' WindowName: 'kdmdijwqvzfjrmegtpr'
