Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\InetLoad.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'srutbhiixhlhjkgbmomqygomgfmxavjsnzm' WindowName: 'cnthwnzoqtzzrcltukghbe'
- ClassName: 'cvuqiocudjntfghxiotierjgg' WindowName: 'hbzqbknpfpfilarbmbmeofbsshvksr'
- ClassName: 'wwnkjczeckaphikdggvhvylnkl' WindowName: 'faivhmucfqaggcmsuieanoquam'
- ClassName: 'dzcclqqbpiipcsrqevwyvkwfluxmbcafay' WindowName: 'ghpobqbgxtxshtvaiuoubhoijam'
- ClassName: 'cntlsnqbviqvohjfqibfyqfyqn' WindowName: 'zeuamvmysmtzkokgsugteamjqvjdhkgpcn'
- ClassName: 'floibisotwepibbeauuifflrhnaprev' WindowName: 'wuadjdvlwrrgfephknudpkahdmjhermsuef'
- ClassName: 'taflusedprxldmqzcxwyaatztyxa' WindowName: 'fhwflcbticucmqb'
- ClassName: 'zrmssqnncywlgaicbwildkqbobrvyxgmidh' WindowName: 'kyxmdrolfpeqjnfvnnpqwyimtsev'
- ClassName: 'uiobdcozqklnxwuaheojj' WindowName: 'edhnssuijbkichrpnkbmyywqfpo'
- ClassName: 'ywtgbiymqigoceoyhy' WindowName: 'piosvxrmlsavbjgqqdsdbhdnapzyzvnwdae'
- ClassName: 'ktoagmrakirkfcelbftxndnjjbnmxwykd' WindowName: 'msuvbhzjjnnnzxrczxgtazztmmuojhlouknuio'
- ClassName: 'ctatzqngbvxosraoajgnqxokounvall' WindowName: 'uihfojjujpyslfbjfdvkifkfyeojwbrpki'
- ClassName: 'abvvzkzxqvseangkezgdgrqlhi' WindowName: 'hsjkwsfxjhgusygrrvwjqiwy'
- ClassName: 'bgqsktmsdjcxaqbpate' WindowName: 'bjqeyntqmiqkcsqqwkgzpgrxhdhdkpbv'
- ClassName: 'xvdnwtwsvbbqvybctelks' WindowName: 'cbrcfcstdesoywecssmzyrjuaiptdhfwksf'
- ClassName: 'pvmavxpeaakltiusasrevlyfykdxbgnvjiscl' WindowName: 'kxdpnpnedczckwskxtnghbsoesdlvwv'
- ClassName: 'wnngabeptydjblrcufbndsikzyzawbxys' WindowName: 'whtzjjxelasvrufodfhfartjynwlgihbycnb'
- ClassName: 'jdxlcvinhmcslbjxmfybswehofgkgsu' WindowName: 'povkfbyhhezamalmvoxgbtnev'
- ClassName: 'fpdlhnxtcalawnwhtlggbfz' WindowName: 'fdrmpngabfksuredvryjimqtntejwe'
- ClassName: 'wygaolchvxywdzfzcvinj' WindowName: 'zhlngwngokekzatgao'
- ClassName: 'xlqqpmdjsmmtpabnbauodmcbmbecoqmsoxbpc' WindowName: 'ishejanmxazookbqai'
- ClassName: 'bihejbygirhmyzijcbujlod' WindowName: 'walevudihogzlazijctdzxrbicozckqgjtmkp'
- ClassName: 'hegaodigrlecrlzsumulqgv' WindowName: 'kqbpzjymkafdplakzmbfnnpmaedocpdwdrp'
- ClassName: 'fhfqunanfydhkcghxwjb' WindowName: 'dodjbomjjowcsbkkevrkswyuidda'
- ClassName: 'hspvidizlhnibjmgfxrzsfxddikyxvyfbzayfxl' WindowName: 'cwkizqilecjatihtkvxqtiahqchtatr'
- ClassName: 'duifrxycrpshcpbufjlxnzukcimsq' WindowName: 'ljcgushzfmvdqeorfikxvhpbplpyce'
- ClassName: 'dkjbkekgasmqcjfuneiuxfbttkhvpja' WindowName: 'iomjeedrzwpauflwoibeworrgiibp'
- ClassName: 'gawqsicmurkxszqhmkaokvvqelqqsxqga' WindowName: 'vufhdicbmftzimluoetcphkrlyoxikf'
- ClassName: 'yuqyclnhgrajisl' WindowName: 'ttipqkrynymdkeuuhwwxrlaoxjfmwtjf'
- ClassName: 'njobgjqnkktpaxrzqxwbfhbwsiajzqfwxmpm' WindowName: 'sywctxvbtbuxnscv'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'zexhfuaahfpopiwqehriotutsw' WindowName: 'pbqdwqwonkycudczugzvmptyxhnstmpsfiq'
- ClassName: 'jbcjaobpzwfrvjqbsauhinrvzrrcnah' WindowName: 'rjltuxmsgopcuuowyoiswuce'
- ClassName: 'klngtpgkdkezmif' WindowName: 'svofdtaenqgnknffdlcgoay'
- ClassName: 'wpxqymuwmapbbjmjdtobwmxkvzf' WindowName: 'rfedkzebkwfhalcose'
- ClassName: 'rktmvkevuohpbnhknawsapeoj' WindowName: 'fatcmjfmjehdsaulhzaaan'
- ClassName: 'xdiixckwzwcvkwzhrvrtrpxtuz' WindowName: 'andsrvihvkxdcedeyf'
- ClassName: 'lbgsxanulzgwhizzokogudvxdsbsgnlkt' WindowName: 'xvoactwgprlswsgotfthhjwkdimqzsm'
- ClassName: 'akkrnivsvqjmhzjwnyrtjfdjnqclnlsklvorkjq' WindowName: 'pcnqiflzkfunojokodopuafexssdgrpb'
- ClassName: 'wcgmuqeeditvgmddfftlmsvgbrrcl' WindowName: 'qyohuysytzjcgfxtzfgensmkxzabgcdulgvcugw'
