Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\InetLoad.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'lpmmnhrzquyklllochfczbnfjdhnddmtkcnowg' WindowName: 'tccydjgcjycunhrhsdpojnivcowaczwpgyly'
- ClassName: 'iushbnfyjqxwzaxvidgel' WindowName: 'flszuwfotysfpbyqvmvpshaciwxeufivcj'
- ClassName: 'hedaqacwaentbdlqwweomvz' WindowName: 'ptdysqxknwnbhhlwfrozugeyhwlho'
- ClassName: 'nwjqqsbzobhtijdnsprzqvq' WindowName: 'ezckywkcuwupkvvgwgxqymunztzezfhpgd'
- ClassName: 'yiatifizplrvoanrapylsuigazlnndayr' WindowName: 'nwdlouzfwhvoeslyfdhpopodokfrv'
- ClassName: 'xdiiybwxzagzgpwtqqgjfcevnsnjktf' WindowName: 'jdnubdkgpxbzqrdlgxizhvxtwnuwq'
- ClassName: 'pnsgzkmtrugsegqszderk' WindowName: 'ogunmlobbhdzoyigonw'
- ClassName: 'frmipjlzilzuvhhkggzx' WindowName: 'nhkmywnhafosesralrigcuudlekvw'
- ClassName: 'sccmeptwxotsdnxgcxxkypciakufsblmd' WindowName: 'mwdqvatqwmzuleqeyhylrkgd'
- ClassName: 'mampdqwhaffzcyrezdnmltsdelxlbcfpgylna' WindowName: 'qrmruzzqhiqjtnggiuamqjxmvgndstjg'
- ClassName: 'yhjmdjijhxnmjuddsdidadhnjocba' WindowName: 'honohenmkjxhaunrkz'
- ClassName: 'gguhiilryhrnxecbtlxjewh' WindowName: 'rzgjstcibgpcmnq'
- ClassName: 'exctjxgnbsethqiscldqmzjlpuuqcyr' WindowName: 'bawqxosfcktaqzl'
- ClassName: 'exbutxfngdwcrbfrpnyqu' WindowName: 'mrgijhigtscbgcmigvjcbyzmlrjphmedggo'
- ClassName: 'wgkeurqgtzxjmslvkygtktltapyjhniw' WindowName: 'ojzfdcpxdobtpomhzln'
- ClassName: 'yyvjgytsmmcmrpfhftbiqbzzvqkdwegxaxc' WindowName: 'vpbxiwixrabunjeusxfyifxeelpee'
- ClassName: 'imhxakbqhghjciaouytbmatxjbym' WindowName: 'iilyzrubqpgcjrfghesqzhqvuajyrwpt'
- ClassName: 'qewjpmwijhznlxuexzsbmxnzxdg' WindowName: 'joneoiayzmontlmpdqr'
- ClassName: 'cmikejbdhbomdxirnzugwpmgn' WindowName: 'rhhwmlktokjzoayugvxxncnqbhqikoulpsjfxq'
- ClassName: 'zazfynetcofkoucfaats' WindowName: 'rcbbzoosumashwbnx'
- ClassName: 'dpplhkxukjphvuvcyfgnuxdscxw' WindowName: 'rinxthhfcjznnfaiuaxfhfnzovcavwtxmkx'
- ClassName: 'zlelthsnujomwrajnxopiuvtdu' WindowName: 'cobkuxvododwybjdmsqxmdnwl'
- ClassName: 'jqgbltagjmjqcdekyzyufbphc' WindowName: 'uzsiyfibxdjxpoysraub'
- ClassName: 'rmfblmxdkyhxgpphokpjqvxtwv' WindowName: 'nvmjpjjrsqcusemakryj'
- ClassName: 'ujpwuvjzhroxckutlyfpqwxvnsqdcjxlmsbfljo' WindowName: 'hojmvgutdshzrtwtj'
- ClassName: 'ceyfhsbryystmkoeninq' WindowName: 'ahewmofplysiebqdnsffjc'
- ClassName: 'iendcwqbxkjwlpgawktbnl' WindowName: 'hcqveoywnknzcudukqbyuapxweylfw'
- ClassName: 'geyxlmqrfasjltwv' WindowName: 'ckvmraawivredjevvhtnpnwysnlqlmighb'
- ClassName: 'tmhnlggrxyopzyiuqlvjbnj' WindowName: 'gbzpnebfoyrcheizvxjsaehtdnidjuttsdlfi'
- ClassName: 'rpisyusehzhjbxprgixstgqtacdcaavy' WindowName: 'bvvgxaamdnjjlcvdjxnrfdebitefwpfexqflgud'
- ClassName: 'vkoqsfaedkadjbflganwbkngypximyr' WindowName: 'sqtlublqwvdpmprraqis'
- ClassName: 'pqwyuxlvwgxizxjkz' WindowName: 'rdelfgrbagboshuunmhfmpvhb'
- ClassName: 'mycczcdmcjhtbwsizhqcrvgypzqqejdgibkv' WindowName: 'spdltktefiwlhdhplfxilnjwkjjtwdzuv'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'opyekimjdqmowankotvmpudrqft' WindowName: 'yqbqvzzmugzzjyljfkqcknprkcjbaegybz'
- ClassName: 'unzkgzfuquvouenibxdzbexbhfobkkcxa' WindowName: 'qlgmxrxpporxsbhndcrauysxlzs'
- ClassName: 'nghkmjtsirrvsscmcbicog' WindowName: 'dxhrwftnbwithykdgrm'
- ClassName: 'jxeyndpbixqxbnxyilykuswbgz' WindowName: 'dxddvaqvfwobnidkmfkywcnai'
- ClassName: 'dszaukimrasizlgtnrphqnbkwcwmkl' WindowName: 'ccajuziyipnowosvlwughjizscmuzinckvopsn'
- ClassName: 'lwtyvsozainwdwkebxsngdwstcfkp' WindowName: 'zhswdhbujgyuxqmpajqm'
- ClassName: 'hlstazrhituhdivnqhgajnsv' WindowName: 'zpuqpzuaxoocvkiprklbivpquqevoeuiydjdbwb'
- ClassName: 'ppzkjtuwkawlbml' WindowName: 'cknwbrkfnkgrehjxomqlupa'
- ClassName: 'nxopsifsvjidiwynxqbmuqhzufor' WindowName: 'ochmcqckgcpgtmlxwghgciax'
