Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\InetLoad.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ylvymwthtxfjcwphkbexdwecplmk' WindowName: 'lcgzjvdlsqhykzabkdiaszthypwzxsvi'
- ClassName: 'fwokneyovizpcasgazfqrcifgmusgdyjzmf' WindowName: 'fovvwhseoyifgcgggxbsmjndqbejhrukzqso'
- ClassName: 'jkhfrfbpeherbeihntyujuofztydawjxs' WindowName: 'lymzcqehbpkuurdvmmbjuxertpavhfedmj'
- ClassName: 'guwzrmljodhesqwbtmwstkzrrngaocmhtfdz' WindowName: 'dtipauavsoabjlngbrdaesggpxzqhkqv'
- ClassName: 'alkdcuakludicyqgikiarlfyfybvasbnjwr' WindowName: 'zzinotjtznacjeovtwjrspsiwsftjz'
- ClassName: 'arfguadgiqabkseswksqlanpvntsbpe' WindowName: 'niktokrzfmllakrfuhowxkmptw'
- ClassName: 'zbqzvxvsxfnhzvfnscslbthtxacvhhmuqxymex' WindowName: 'rbvjxrklnuvwvhoaxddeplhmvvqrjpc'
- ClassName: 'kpkckyyrwhjfyhdgziybte' WindowName: 'rzlskgzlrahstbkchklrdxqbqemjiv'
- ClassName: 'iinmyhnjzmnaevfyisbewyfyzeqtggjbtkhxfsv' WindowName: 'hripxbwbkskowdxcvspl'
- ClassName: 'idfvptgxvjzavzzqhvdebjpaayimdnjtg' WindowName: 'irshzbvzzvmtrfajivjloiaulsdgddihfcgzt'
- ClassName: 'usbqiylfoudyfssiiw' WindowName: 'sggnrecqnirbzuhflhadfjrxehbxpggrnevk'
- ClassName: 'wyfzgobacqqbruryyyhotwwruzeyf' WindowName: 'bmrmgusahfprjncuacnfsdqtiiwqzm'
- ClassName: 'ylrhtooytyyfgdmmjqd' WindowName: 'eklmvbfgrfphfmvddhd'
- ClassName: 'yjjbakfxoehpmqolghihfkkxplwxvyotuzafr' WindowName: 'xhsraiunmxylkfwcto'
- ClassName: 'sborrzzqfzlwvwadgepysroso' WindowName: 'nfzgjpxzolnvdqvamjkopbfaenxnumfg'
- ClassName: 'zcirdyauuvrcnzvvhjqzvouqomut' WindowName: 'nidofuujhzgxomaxmnrenillqymlwdtmvh'
- ClassName: 'vypdsghjvvgspvhtsmng' WindowName: 'tysduudwmheotascjqlrrqphqnhyqeirg'
- ClassName: 'hwrbcqeyycppzumozouixtxafwofcpcmofqewtp' WindowName: 'ubcksfrjiwxcdvavypxnztphwwmbonomob'
- ClassName: 'jzlgabaefbxmtacjsjhcaalqgson' WindowName: 'etalupzfglefszcwmz'
- ClassName: 'yumqvchxahjmiiyoxpgtqu' WindowName: 'zuooindqztwaalbprqyasvuynzstkqrimylozuj'
- ClassName: 'ujoeanluixwybwwacybfvrhwelddfuqrrybx' WindowName: 'oknrmnlfeszysyxuopepuwfcmmoputcwt'
- ClassName: 'nsrsjescjawhhqweocmza' WindowName: 'aqaewezhycwgxmsdjwxqrhufakudyqkhbvjoqod'
- ClassName: 'ohddiaacxflentupjgubkrzonmtmcgrkelkx' WindowName: 'cymwgwtlseegtrs'
- ClassName: 'lplhzwdyyusecravfbmvzeidtdpavynaqffwrah' WindowName: 'kgrsknjgokysspdwmenfb'
- ClassName: 'mbhrtztwgyyxkttjmjykkktvkbcwoux' WindowName: 'qkhwotoephidogdpoijoowmxzztecqaxynw'
- ClassName: 'wafttxldeocxwrvmdz' WindowName: 'nmnjmmwlpnkznsphy'
- ClassName: 'ljuehcebitpyrmlvjmztbblxkfl' WindowName: 'jvxgutybdtmsdabhi'
- ClassName: 'zbwpumqmxiazsriqfazap' WindowName: 'rawqvtfcujosedwlhdtgotasayeauntyufdeem'
- ClassName: 'zjpbdsdetbhzwwalfgrsltqt' WindowName: 'exskfdxnrqktemzgjngusbdfyyx'
- ClassName: 'tjxxgkwncjcbryvfstuqvjecjayslosqvddsnpc' WindowName: 'jrzashpblpohljbiwsohwblwalmatcjxtme'
- ClassName: 'jxvymnumixqemjdhponooouxnecjr' WindowName: 'dcllkdnavrfdejbbhcxipqkozvbgaodipetuo'
- ClassName: 'kjubfvhgnuqrjzccmyhrsipnccryngkwyd' WindowName: 'qqqarfreparikldwhylcubjusv'
- ClassName: 'nziqwzwdeqqrusnjhcplmfurvoqbtgnw' WindowName: 'mmwwgkxaunptsiravfxbrmfxxgffrcxkicpybmp'
- ClassName: 'vnullhwyrjchhhal' WindowName: 'jqffviyuuqtfrddmhxqibmrfwqejb'
- ClassName: 'jgnnhqdwaimqstrkyr' WindowName: 'wlyfdqaqdyrdnknrexoxodecbprndbskqqezgnk'
- ClassName: 'ziyfylyohpigklotpje' WindowName: 'mscbegydxpabhiltgcynejfskizevplpjar'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'oqnzyklfgjnoxacocssvkddnwriezofjwnaerk' WindowName: 'tegbmlqjfrasgpdpdevafrcgg'
- ClassName: 'bdddcjebqnquukszwuqinweo' WindowName: 'bbceapvntgdgvkzq'
- ClassName: 'ueqxvjagkfnximimmnwnsikshy' WindowName: 'gtympwbittnslfygrwdvqdtb'
- ClassName: 'yyeedqhksarsxejeznjbelqvgltmln' WindowName: 'jggosocgwszfjcmqynhvpsxuvbvdibsdtwmghuu'
- ClassName: 'sgvbontkxbwcozjhckddtdyk' WindowName: 'upasrwksbauredjqsruvzuwjgrktbsaboeziy'
