Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsf2.tmp\InetLoad.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'gfgbsbgnpyztzaxgwmotighyiwfhogckc' WindowName: 'mktbegigsrsfbwoaeedduzc'
- ClassName: 'wsjipzpmqhfbiamjubq' WindowName: 'bdqhnjzfuuvytovpbuddcunjfgdufm'
- ClassName: 'gtrtceobvgykrrhy' WindowName: 'kifbjilfnxbqcuxkz'
- ClassName: 'ocqxcnohsnhxmzgwphadrsxgweeju' WindowName: 'pohpwqqfguwvipagxsjzlumzfmeltcdvivev'
- ClassName: 'adbqrbjwjtaualaco' WindowName: 'mziqgfkkvwqunnhbuxyjzpzhwmvb'
- ClassName: 'hxssqwxeuvnfpswaxqpbexpcwdmoswobdwbi' WindowName: 'libxfjemfmqtmywgdzyhsswdpceeklpe'
- ClassName: 'ctomiubpuulliyogpbtychcy' WindowName: 'zmuwjvakaifgegdas'
- ClassName: 'qxcvvabiejjkmbgnzzamuhaxleoqqanhjckmz' WindowName: 'xmvpukhgqfjtcchkaczhwtjuqjnxilsuvpvko'
- ClassName: 'mbgsvefqkcepinpsruisasu' WindowName: 'dmgztoufkakowxsbxxrvpjcfip'
- ClassName: 'sntjgmmuejbqpctnfyeqi' WindowName: 'xllngkxnmiuntmjerfdqckouternkd'
- ClassName: 'krpiquwqstzounqtibixjl' WindowName: 'ewbbmzflsoxmzzlspzhckd'
- ClassName: 'wwnffyjpjxujvjxpxzaznarqz' WindowName: 'duvlqjvxvwdkwmxrjez'
- ClassName: 'szhiwxtalaghesismivdayhpjdfqeaizazjwxru' WindowName: 'glpzxfrtxajbwhsmzpfijwlic'
- ClassName: 'vjujbdcugyxtvbsypdotreibiq' WindowName: 'uxnbtcmxjdjubldh'
- ClassName: 'udvbabscelvigjyokpbtanhwpodzgtxmgasgfg' WindowName: 'hhittgudgxgkcvwmafylushmwuuetvmh'
- ClassName: 'syvzlowgqemtgrbhuhrr' WindowName: 'aytcrernusdhtkqfeesybubxcrejauzx'
- ClassName: 'rdsjipgkrduzluwqvtvuhrbawb' WindowName: 'vbhuaslgokfdepylxdylgm'
- ClassName: 'aesqfliyavjixzblccshpfksmvgqktnxlwxvv' WindowName: 'lmmfzuzpqiiwxikgszcrcrpcccgzep'
- ClassName: 'qlerhcncoowqxdbkvcdxmuv' WindowName: 'teaumxymmzukmpxhmsctmtwljwgwrrggdaabro'
- ClassName: 'dbojnuorjyjzfklpbtemyohmhiylkghxzhq' WindowName: 'mwpvgdnsosjrvemiiximdabbvneygibdvgtqq'
- ClassName: 'scejlyspdojsmffsgyyukvomkkdl' WindowName: 'xktsykgehoamaedmaeskjnqreafzmxkgcvttqfw'
- ClassName: 'aktpinoexkxhhznoxxwjo' WindowName: 'ptgipytyowxkmnnlbqmwrnscwwdv'
- ClassName: 'evbklfddypctegbovlnmkyghfyofuyiwofzjvyn' WindowName: 'njlinnbfiwpdltxqmbvqfzsebxekixjtslpa'
- ClassName: 'pcxbmaniximfnqpjwwbvlmhpwjtqahismegys' WindowName: 'jprswlvbuvdguyxvqmtagvgkrlcswjllnq'
- ClassName: 'ruphjlfjwkoyqfrnjyicdyg' WindowName: 'yhexpicnqyduiumahjxzioxjaiivr'
- ClassName: 'lmnkqyicfnpqukuzdcywcgdntazvqz' WindowName: 'tfyqvxdeeqdykjunahjgr'
- ClassName: 'zauqdfzxqckcanwjjuc' WindowName: 'aujbhpvtxwvmuncjwceydascnxtiixm'
- ClassName: 'tgsrfijuxxkvztomcxsbywrhzju' WindowName: 'pvlrnhyuuocjwlnuyxyyaelrmgrxwysjynsyw'
- ClassName: 'wdntplcmpwrstdlkrvxonk' WindowName: 'hjbiutzieyzuzdb'
- ClassName: 'djtchgnuupfmiuavqxnwucnsofhjzvvqefi' WindowName: 'ijthnpuizolxttjfzqmvylpc'
- ClassName: 'ezeddddrfkcbcreqkzpsmiesdqlvkgdrsy' WindowName: 'czajvqrwdmbylavfdoli'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'mwolxzzifhqzdkobydzzpducbwvsmbzok' WindowName: 'pxmmelrbmmfuzcaofgxiugcfgvyhls'
- ClassName: 'ihnvzqyrinaoemjgoo' WindowName: 'yhfvmntdmhadjzzirkszoeco'
- ClassName: 'tkvlrawrlejlojwcohawdwwnkdkzwdqidr' WindowName: 'xrmmlcenixqfnmmsxovmenmylrfuthxaennabgl'
- ClassName: 'qcrthekyilhbwddwrmvhzlgvzqdvscxypak' WindowName: 'cornjdlykeqrdcrtjksc'
- ClassName: 'jibkpgkircaonxsv' WindowName: 'maulhuyanissxuptyeytuvyjmyvfjb'
