Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\InetLoad.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'wmgibllpgwzohhsxwmwbbmthmqoajsyibgudea' WindowName: 'mjghpduxhmujlfygjbxffef'
- ClassName: 'gagcojymrqpwddzsooigvaplwforazlefdia' WindowName: 'xblmhctsoinppne'
- ClassName: 'mqnqdvfoubifxdql' WindowName: 'ypfjkvkqnlhbzhqfilisjlwxcpmsfequjjlbfwi'
- ClassName: 'llsmcqrkbofbghaghgibb' WindowName: 'tagyplowkazkqhvahmghw'
- ClassName: 'zbdqkdwxhqoeocdlkrqdlrmuwwuvufdgvypezns' WindowName: 'fomwbminxlyksnieechvjv'
- ClassName: 'cytikdlhvafhnhuwyvlfwqu' WindowName: 'wydxcsiespvmiscpzyaiykohnrwz'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'byjcdzifjehpxxsqgd' WindowName: 'hvgctrieptdnigzxlyutjnecdaszwdfqpgbhr'
- ClassName: 'oqwguwakjshcmnvcgxihcdkeu' WindowName: 'ulmghpeayfworqbovzt'
- ClassName: 'npcxopjivcyvqem' WindowName: 'efuvkrjhnjdthjuhxscwfshprl'
- ClassName: 'hovjnaiykmnjzmujrjvjvswivywqjjh' WindowName: 'hcawfudrqivijqvsvfukqqn'
- ClassName: 'kncqkjhymdebusbggjwacnxnyjhkti' WindowName: 'xmiihakrdzaracwter'
- ClassName: 'hxtreemhxpirgrhpwaxxdlpaomkpv' WindowName: 'javdlqzzqvsooxssykya'
- ClassName: 'cexrcaqgcgkeolfxoesxzg' WindowName: 'homfyebnxxnaqwflijmeujzmfccs'
- ClassName: 'ksfnmrtpdqjmllytuireyg' WindowName: 'gviublfmcaflbkjzgsp'
- ClassName: 'ydnkruritfncevvvoz' WindowName: 'rqklmzrfmmlvuysfaaw'
- ClassName: 'gvhfukldxvffvcmc' WindowName: 'jiklkpxojrcalofunff'
- ClassName: 'elhqwfqsjjsmugvbjeejckegaipbmdscjte' WindowName: 'jvemupdhpubbqxlwxivaxoczb'
- ClassName: 'hmmoqcgbppxdteacxqajaklcharo' WindowName: 'xemfheyinewncesyvw'
- ClassName: 'xvfdvxvdohrrobdfazkytwqwlbiygicy' WindowName: 'ftckrntunwbqffv'
- ClassName: 'qnlvhsghomsekrmyzmzowcpitakigygolv' WindowName: 'cxdkxsdxxofquqqlkrjpkntmqrjxwcwza'
- ClassName: 'lnvzfcibosnoktrxn' WindowName: 'ukidldwzscohhxfprzqn'
- ClassName: 'rwuurbwxpqikcycr' WindowName: 'hswfjdxdbkolbcybdiocioyx'
- ClassName: 'zmautmmunedqpljehzsni' WindowName: 'mbdpxxqmmabxnjtrtovwuwbue'
- ClassName: 'bnakhiadmtrxgqqpvsglobvidu' WindowName: 'ssmhqpwhcqfonmxnyfsuarhd'
- ClassName: 'wlpeswbpjqjwfbxebguyvrkzmd' WindowName: 'vozhmjjsqapfwjbxajgp'
- ClassName: 'duamyejahmogljcbvoohd' WindowName: 'pwtftowrmuntiyhkzolkvcgz'
- ClassName: 'oksjtcfbhxgqxkqctpzthnj' WindowName: 'hzywlivbqdgqourxe'
- ClassName: 'enfgutphfbqxcnavto' WindowName: 'dqcrgnfrlbdztgcyzwkydbmsooqjzeffcslvj'
- ClassName: 'kkrrqetdeoydxtfnallqiwrpmuwhoyelch' WindowName: 'kkjvhxlcplwnzftjxhzf'
- ClassName: 'giddmfqqtjdcxnedoolsaucrqwswe' WindowName: 'lrlylyuueclmlwhecpsj'
- ClassName: 'ssmekbyishwxyvysrm' WindowName: 'qhfcvlgcqdhxcenejtosaji'
- ClassName: 'sorzhfhlnnutqcjwaojzzhtqnpnow' WindowName: 'ynrscjtiyruweetejamknmaihtpfbvftaygj'
- ClassName: 'phqkycxwwrpitgjpsllu' WindowName: 'oszhtknqsdmbwhjtxdpjfivbyxqv'
- ClassName: 'rkpjhdcsrqdyrqamigbrxvxwidrldyc' WindowName: 'qnxutfsekxegdzsmeepwlerfnolscmjvuwvq'
- ClassName: 'eaywgdlrijtqbgavbmygxaxpftasgh' WindowName: 'imdolexbyffrzhugitpxlefrztnnhbyhtlesx'
- ClassName: 'ebohwjcqezgwklwvo' WindowName: 'noarfrjyquazwnwfsmiwdalossqcrusfnjwm'
