Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nss2.tmp\InetLoad.dll
- %TEMP%\nss2.tmp\Math.dll
- %TEMP%\nss2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nss2.tmp\System.dll
- %TEMP%\nss2.tmp\Math.dll
- %TEMP%\nss2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mxhftjjmpwyjlgyaxknhbr' WindowName: 'ynhjlmljbasmikb'
- ClassName: 'ftxxnmgvjkoepuavyrkrxyjamnat' WindowName: 'lvimfqclluqlhtfrpfpjpciw'
- ClassName: 'okfysuqsdytzucmlbgoqhki' WindowName: 'iotopypwsppvycuasfyfbvycfwknnawto'
- ClassName: 'azhwsozyncdnrplidkaulodjkoasljlbtzukgi' WindowName: 'qxbsgdddijkvlgqjypiiit'
- ClassName: 'cdegkyhzihhygkqoddamllxfcfqhse' WindowName: 'teszmlxfxpupkwonpquqflhbogfgpijhvlsugr'
- ClassName: 'wakdeiytprgcjsom' WindowName: 'akuxnwypwqfiero'
- ClassName: 'jnyfboishxrqienjubuvnbpjs' WindowName: 'gmdyqphqiplwyccpachhbxxvrppfxy'
- ClassName: 'dwhhinnxybiblmsrkrhcoscehuvnzmvb' WindowName: 'ibuwzbecbpmiagavtkmiunemuzlvj'
- ClassName: 'racavfavybyedlqkufvoiaph' WindowName: 'frcqduuiczrpkwdxptuektupgsjunh'
- ClassName: 'cztbcldocrrtgtqlks' WindowName: 'iqdsoaadhqenhqdayxczhpkgmxyd'
- ClassName: 'jbkhyuxkxputxjlbndk' WindowName: 'jsnjvkspqrmwytnxi'
- ClassName: 'zlkybzsgbftdiydizgi' WindowName: 'thcuvbvvendecpqvivibbpo'
- ClassName: 'wgwefpmfrinzbxdzbqmbhnkbbq' WindowName: 'ajaipohwmehsunouvgjktv'
- ClassName: 'ayvzpwbjwqujsiyhmswznnhnxmcpidjqf' WindowName: 'cavlyyxxzrpfzgs'
- ClassName: 'vdjayetyywsxlbdpqerpqknuuiuuke' WindowName: 'ijsydlcycdvfdrsvulu'
- ClassName: 'syeafvvbhqqzxcnhkpwwjbr' WindowName: 'ubrjqzojrusitdeshpjtqcbykhivbze'
- ClassName: 'vgxuwmzjoqfjxztrsdggcubdloflrf' WindowName: 'cxrheujbqlnomdiswaflcqxotquyazfautvh'
- ClassName: 'murhbazfanwvmoypjvmcgvljdbdxcvkck' WindowName: 'vazfbyuohmvzguparpsbpdfcqmhahhysohiz'
- ClassName: 'azcxjpfmyjvzilicuzgkcky' WindowName: 'bypaifearjjagzoynewotbahjqkklevu'
- ClassName: 'xeovkggrtfcjidrtxscnrxejevllzqytpxjb' WindowName: 'boxydfrcofvpdymlworrwmkcepvtdwp'
- ClassName: 'lphvppnljwyintbmqsbpjlfmhiypbubq' WindowName: 'kjeswifkcyfywnbgmkzbhtenpqjxhnh'
- ClassName: 'koceeztyrjcftoubypsxdr' WindowName: 'epiwmyaezsunhqtb'
- ClassName: 'sygjynatrjoyzmmxgkdwcrwiwowazwobgoyelvk' WindowName: 'dnuuxtgdlfscaqrecyuldiiellxzalbla'
- ClassName: 'hdsmuzaxvyeclzakuhh' WindowName: 'qxnzowjigoswomspb'
- ClassName: 'tiujxemqkhafnwpvjwfoulqgzuejvh' WindowName: 'iojimsyevxwknimlwbjtostqhbawvh'
- ClassName: 'zakloqtyfmafdkwivfcbjpxgvfaezrrwmeub' WindowName: 'vqfzvgvfgmnjcumqzormxysowt'
- ClassName: 'upmzuqzvahnbalaplpwyyklo' WindowName: 'pdtajssmxelrromuzwnfnvwreopcklgctz'
- ClassName: 'lcxnozxwomiplwifawhspa' WindowName: 'vdjuagxygdlcfcfhofeivbvtfhnpgi'
- ClassName: 'zxwwfnljlvwzqllxtaeeciak' WindowName: 'roksdwhknbnvyyiibhzomcxws'
- ClassName: 'lqekjhcnlnbbsjkbqhpbyrjuxmrbjsfvia' WindowName: 'srjcfhaisvvkvweuzvjnsrroslmxdnwe'
- ClassName: 'vvdmtfeozcllljtdilbpb' WindowName: 'hrkxszkdcqjmyenwbsoyycwxunbgmm'
- ClassName: 'ujsgcqyhvbwbxjzivzqqplw' WindowName: 'bbupmeujkvhjzveh'
- ClassName: 'eqqqeoecewahhdfafmzn' WindowName: 'wglkxysxbvglhkqbdseixr'
- ClassName: 'cxqzwkwtvvnhkxpjyihiyzgad' WindowName: 'bkyyzeoewrlfmzbubsioenzzspqmlxxct'
- ClassName: 'mfrgffipwxmjtrupj' WindowName: 'pptuumhawtrgcuzebqoji'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'xgcwozcatilrkjcsokhmblopgjakyjbjqurdv' WindowName: 'giyqzkfwndobscbszedbhxvn'
- ClassName: 'gfuqspjzepwnkehmstbabmtzcvmtm' WindowName: 'uhookznlouewtolrlasbznyile'
- ClassName: 'ehnzxbumqkewkxtypwcklmdombntkejxztowwd' WindowName: 'qbswiqgrfmcbzeltgvrphwghzdweilwcbxr'
- ClassName: 'iuqfmlyawghlzlhuksviwzwoemcbuo' WindowName: 'iffbazqmkncoygqwuxcxadtcynxrnzlnqpokri'
- ClassName: 'dmrpzfleizadqchbrowljd' WindowName: 'bbbgktrjjbdpnfsivlwg'
- ClassName: 'ymnuttmrgyzbjbtoenj' WindowName: 'kywjaazxyhlkqmuxqrjffqfgwgjiafstxkizvoo'
- ClassName: 'jesbkqhyvlhzuguxkfjegih' WindowName: 'ubudhcqrywcnnkdhrcmguwow'
- ClassName: 'saqecbnurdmiyaejugfcrxhiy' WindowName: 'yhgiujtjjgcioefajyfchozffrom'
- ClassName: 'xrmhctdlipiqqkwsjeintviak' WindowName: 'odvkugzydrfmpvahrdwupbviusoovfhm'
- ClassName: 'olgbxfiuhkfdtsaopamhbhgcqmcelofdi' WindowName: 'dizkyfsgbmkctyxk'
