Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsq2.tmp\InetLoad.dll
- %TEMP%\nsq2.tmp\Math.dll
- %TEMP%\nsq2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\nsq2.tmp\Math.dll
- %TEMP%\nsq2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bniqhlitlkxbgfhw' WindowName: 'zdihcxjyugnrkqqwjh'
- ClassName: 'ulefdumsjgyultfoezguspxgmemxsiyaadpx' WindowName: 'bpeldlscpgmhowynivy'
- ClassName: 'jbzfaoojaltrxexxtfugjgdeahgiiasiosi' WindowName: 'dwvwndaaxcbdabrnalxuqdzdohh'
- ClassName: 'dbzqulwmcxjypkxrm' WindowName: 'zrvndqslpxvimyqlbhzupw'
- ClassName: 'jlobaejwpjnfcjvlpftgstjrfeyergxz' WindowName: 'oqrcfigxsvikkqlohgnfdpimrzn'
- ClassName: 'ubzgslnquzbfrjvpeytsfxpjdshhrydmignup' WindowName: 'ztkjzatanynzjowbgikwfuhuxg'
- ClassName: 'wfjgezudxgubfdtrqxfxkbudbbkjuciusktvc' WindowName: 'qqkwsiexobtuwbxqxndfkfybcqkl'
- ClassName: 'wtjkbspzhwfutaxigkyhnfyzzuumuiqizsdnh' WindowName: 'kvergdoizuqqbqyfjbhsjyzgfy'
- ClassName: 'qevditnyfbiehqjfmaklnancvkphblaxojj' WindowName: 'ifdfbvtmujoafvqaekyikoyftlpghotylfw'
- ClassName: 'cutjspxsegflmrzgs' WindowName: 'adiaorqnxrulvrgdkcwkyonlokkruwzyhlr'
- ClassName: 'bdbqorfkxkhsdgpfgczvfli' WindowName: 'rablcehdvymesjwyfycgi'
- ClassName: 'jluqlwlyjvxtwbtmcisjyhnrxjfbsbnvelczmo' WindowName: 'lzwvplnjbzlhqmzikvclrobjntwqhbstzlq'
- ClassName: 'bkdbypsufgvpuwiwrursuos' WindowName: 'pqvxdmcgrlhvctlrqnexvcbrckgtpndwgxksp'
- ClassName: 'plkxityvsqsgwitmwhi' WindowName: 'pphijjftathunydqoltrzyjosyzuaird'
- ClassName: 'uxbodzoipjttgwps' WindowName: 'vhyrgccyrlkopuiluasqlzoogql'
- ClassName: 'ycwqpotobbswpjdvypmyoqalapsvsbqmgjsuyxy' WindowName: 'coendwoxgvfkwheshtisjgyhwsbeursvdu'
- ClassName: 'dxpxnlhuiybguvuziffhigvwgnk' WindowName: 'ucuyfqiglgwtipq'
- ClassName: 'agqghbaunowyimtdsdtdq' WindowName: 'pvllcqjqdwzcwarikxbbeu'
- ClassName: 'vfjgmoznfgkkhiqjywt' WindowName: 'avkifgmpeoxqzbdcppizjggd'
- ClassName: 'vfntcqdbyhcszsxmdxxdjpydtc' WindowName: 'uqmimifdcngkdbzhue'
- ClassName: 'jygnewxixfsundgram' WindowName: 'rkpkhfqpzpogyhk'
- ClassName: 'nhphpktwwsiitxrahetcvhafszjizekqmg' WindowName: 'loxtwdrxqbcdbyraaurmf'
- ClassName: 'ayyziwipjwbwuijihwdabad' WindowName: 'yppfsuxzpycywbxmkotrmcbkuyufg'
- ClassName: 'frpxwuinovprjvyyprr' WindowName: 'kuxrhbxmijynbkheltey'
- ClassName: 'plowjasjrpdzuvjzvodrorcwpyitktisejgjnq' WindowName: 'pcoendujkgtemrrfoncocblqwkbpogcweby'
- ClassName: 'qjqbcphceofcmmqfbj' WindowName: 'sbfdivcnmpblkadpb'
- ClassName: 'prmexbztkmndwdzscmq' WindowName: 'quvfacncdsxzfrkppikevwsqxvgfdtsymgpiit'
- ClassName: 'rjvikjtczlwvbybkqiawkqpctxqqpauc' WindowName: 'ebqcgmwptieblbywdgpcpye'
- ClassName: 'luwydumfjxowintzjlcqkqnqqmueh' WindowName: 'rwvvxmuktzxbbugalrcgcfki'
- ClassName: 'lckubzlnwvdxiqblazbkhrbmahnbqvqjschgcch' WindowName: 'lthrmshhhjwpnqshqwpfzgbpslsltmoojfcccw'
- ClassName: 'ieottssogiqjbyqfznkbczmvvuxakclwpsjp' WindowName: 'qhfkohxyydhnnnut'
- ClassName: 'zihlhqwbmxrafoexyulsdxjtz' WindowName: 'xxpzkgiezrbbdniobxxltbwjjls'
- ClassName: 'bjsdtczikcrdoarwdyxc' WindowName: 'ooyiowlpskobdtnlzddjtmteol'
- ClassName: 'ncgoxjsgjggcdnxmv' WindowName: 'cvyeytixbkyizhiqmlbkuizphuoryqe'
- ClassName: 'rdpawttcufnpeoqtrbgrxlhytjlp' WindowName: 'rzqvmoktexyvfrpuefejgiapmkoyfvugdzkjfpl'
- ClassName: 'lkqbvckcbndfjjfexluidimkyavrupm' WindowName: 'aknwqdetlwqyuuatnttieykqctzm'
- ClassName: 'tomrrmdiesrkloeiihbkdlidbuvic' WindowName: 'hllcphhpxsveogky'
- ClassName: 'ntybqtjtyjovxpkjpfbskigzxubosthvfyy' WindowName: 'uqfqczipimwcaohfwrlhwnjuqtgrodqfgcgcwtv'
- ClassName: 'xkdhgmtfsxhdhpnbkl' WindowName: 'qlhplwwwuodxivwqycfcfgbiwbkkff'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
