Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\InetLoad.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'prbbsfwvsdjtynmrkdemsvqtsbrjqcbkl' WindowName: 'xpapvcrzfypgvknxpytqjieuvradeq'
- ClassName: 'izofcrckdeftmhnpbzfn' WindowName: 'qkguouilcxoxhyzfqeayjmo'
- ClassName: 'hjejzjtgukydaxmyeluvjgmhtuwbzmftixh' WindowName: 'dibketxukpnulhowgxqfdveqbcffxxxvthokb'
- ClassName: 'branujqmsaitqteyqlydrpdtupicnjhf' WindowName: 'gfprvqzhzicqzjtts'
- ClassName: 'ehcpmybtwqmyubext' WindowName: 'uhgzkzmiidemazuowmerre'
- ClassName: 'bcmkhpxvuhsnhaimeugiqnqipwuuhab' WindowName: 'durdltcpyxjnjrhkhohein'
- ClassName: 'yvcchnhjthjqhxssdjezgwrsmgbjhhiadg' WindowName: 'dvygytyckssemgtkdqhijiot'
- ClassName: 'chdrkbltoxbyuhxoo' WindowName: 'pkqrusjllpisyillbalmiqqpfkwxzusiibf'
- ClassName: 'ooqcowoujkaycqoxyjytclwf' WindowName: 'tipxdtzfjmnpwfoilapofsusvjdfggnlw'
- ClassName: 'pwthkurlvqskzoshceyuacnqyipyhdwx' WindowName: 'auubnwdhwayehiixufiejvjy'
- ClassName: 'ogkrtuetthbjgphjnlnnhxejf' WindowName: 'oxkmquqqysfmxurptuaerlcdvmyj'
- ClassName: 'vbkwjzgkfipmfxtkzxdhvqymg' WindowName: 'sjixmzqdsifmynlujypqurqwt'
- ClassName: 'abxrbmzwrikuglejhgrlplmcqmsru' WindowName: 'behwmgcsbrchwrimysfguhtxftfox'
- ClassName: 'whupkhanrpkhmssxivasaosmltunidp' WindowName: 'yyzblplkpogmyomvyrsohvjhnnigzmxfarfixqs'
- ClassName: 'mzzbmkwjtgzxeutnkfommbxhrvmi' WindowName: 'mtkvfpgxragickyamferzed'
- ClassName: 'xgvfsycfqjpvnszblmx' WindowName: 'tljelkxyksijuihledtbsxmwdrqh'
- ClassName: 'otpnnwqbsplherqmbbhbspzkrkhyulwebzau' WindowName: 'tshvqypifzrlnpyhjisdqwmkgdrnmrnohiccb'
- ClassName: 'mhkblhlgpkwxxiiekpzurwdzfvexvrlkypghai' WindowName: 'vtrpiixlpnhutpriynssth'
- ClassName: 'jgckwbyqjsogutmaqvl' WindowName: 'lbuegbwnleohujw'
- ClassName: 'qpamwxuqusyejtzrpikywluoymvuudphtc' WindowName: 'pstggdcipitrssihao'
- ClassName: 'tnmkczbyjvwfazwvfyogdqnhxzc' WindowName: 'giiywpbhrlzuafiqfb'
- ClassName: 'csqvdcfxrlulvfkfzljlvjhirboxghufc' WindowName: 'gnwuymfycuhxmuaaxpmrpiayjoiifc'
- ClassName: 'gapjpwdquigsxib' WindowName: 'yfubtntomapkngxqzqgncnlhsi'
- ClassName: 'zjfyybxjgasqennpmsmxkqexw' WindowName: 'esayhodsgybethxkglvlzniwonvzvao'
- ClassName: 'scsamhmfpcsgxziwaozyzgxofgyklzk' WindowName: 'xsqmbgyomvfzhhsqnsyqspasloktcbecymad'
- ClassName: 'rauzbqlhdvwnsiwyu' WindowName: 'yehynjmkfzkisgrvxdaqhuxctjtzfiwjpxzplry'
- ClassName: 'ukhffmulnpsykxrdygikrlgdm' WindowName: 'jdjgpqmyibibutc'
- ClassName: 'cdorlilqndcrjmdimh' WindowName: 'amsphsycxvjphwuzvjribft'
- ClassName: 'vzkpivgtztjvzwesrjxax' WindowName: 'glnufammdyconqjxgyxhiujogdqwszgmdxo'
- ClassName: 'okcehurcdhtutnr' WindowName: 'djgqmrxvltuxuryiruhtbgh'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ptwmudsujytoiuivsxgxnrmjkrgc' WindowName: 'carazzrldzodbkaslzpbovtsvtels'
- ClassName: 'zcdwaemkjdaxznfpvacvkg' WindowName: 'xdvlychpsqmqrpbrcswlnjjq'
- ClassName: 'osydbxoynmozcpbpmnzl' WindowName: 'fsdfsqwhspglwwzhmwsas'
- ClassName: 'xeyeporsgrsbphssybmyoza' WindowName: 'ezwmtbjkxalpgymsjpeuraitbieief'
- ClassName: 'qgvypfnidoaqytfep' WindowName: 'eojkidevgjfsztqpdkjoslbbqifodbxhyatsq'
- ClassName: 'koiepbwmarnorjopniazf' WindowName: 'waxuoaemxuprvsgxpwxcohitkwnsoyx'
- ClassName: 'ktvbrrlcnsxhagatkxvox' WindowName: 'cswhacpgodnkxmdrgtymrujswqoaozd'
- ClassName: 'woqbrlhcnorhjshg' WindowName: 'dpwskpwcmginwulbuijawrvgzjdnlwcp'
