Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xfyahlwxcszjnigznsfkdqblypjfmvzbd' WindowName: 'zqvourysrhjpjwpewsrgfgutidwvqzkb'
- ClassName: 'rcuspjnvmndgtpevffdztzjtcuukhrjfimfvx' WindowName: 'hbnygrwaahnucbxln'
- ClassName: 'kzxdfnxdbiszsboazgxdawfuduxad' WindowName: 'iscdyfcfkpmxjyjnawqgsycseefrjknlpb'
- ClassName: 'sfrizrwohnedkmnmnqblugkjqtie' WindowName: 'wpgrrfjojfvujislkrccfjystumedmdwrgfwpw'
- ClassName: 'qidlchtzamdzncxclgzzr' WindowName: 'slbvkorpmnkhcmb'
- ClassName: 'fbfdxoexwokuwhwkpeuxjyrtdmcvldjwg' WindowName: 'umsciyrdryzetzcpxpxlucxvlqgqqan'
- ClassName: 'axnvkbsdayhaiukbz' WindowName: 'gkrhiuybmlbpejwjadnswlwdrs'
- ClassName: 'hfqexaktjfqottklgiehx' WindowName: 'gdppttuxgmmhcze'
- ClassName: 'knulzrhcsqbtjazunifpirsxeusokrxwiwl' WindowName: 'ognqttqsumabzcxrnilrjiftmv'
- ClassName: 'jzukdfaktolttuomkxlowbjdld' WindowName: 'igpebfgjknccwgwvvikwoxy'
- ClassName: 'ttwbdwfcumjmnrudqdttrjntdzy' WindowName: 'yhhkywronktmfiebjxyqdwrakz'
- ClassName: 'uyrbnxjobaubfqwozkfwkhcawtxzctn' WindowName: 'iuptgzengolhglqdzofzxopwpdseikr'
- ClassName: 'rcrucgfxyzzzpnrlgndd' WindowName: 'pqevadcqqkhntzbk'
- ClassName: 'ulvyxpfzktqrxpxccamycfvt' WindowName: 'hyflgnbplwibpstupozsmb'
- ClassName: 'xlteucvpsnlnpnzzpykqrfmjsfdfpumvebou' WindowName: 'pbzfemdptvlqjrrqubs'
- ClassName: 'ebpwnjrhgahkwaahpbu' WindowName: 'zojroeqvcpoojujyungawipvzeshdxjupfmj'
- ClassName: 'lmyzlpjyztkiqwbgqhsnptiiifeqxalen' WindowName: 'hsplyfmtfheskbmkntivynvnnxvjmmr'
- ClassName: 'amffzpfczwqybtpvljhfmrziqyt' WindowName: 'ydnqmufpkddsaxeoyhauvd'
- ClassName: 'pdfenwffrmkvzbumecdbqirvgbidws' WindowName: 'fjuqctgjpxwylcyzckaob'
- ClassName: 'lulmijxmzjzyhmevzn' WindowName: 'wqbpwcvajfnwxygmdiwdtkz'
- ClassName: 'wamsluurxbnborysyofafyljql' WindowName: 'ppxsgspnqulgwobgclalwihhggvxmwa'
- ClassName: 'wjfzvrgmbtnncnat' WindowName: 'nqlkdmnxrwtejnk'
- ClassName: 'alzknmxnquskumoakxadvrfd' WindowName: 'mtygvksiddehpwojqpaowkrnkoracoehqfrwk'
- ClassName: 'fpiotxfgsibzxjw' WindowName: 'kxetnibrfcbekngdiywvtgpqgjqcjo'
- ClassName: 'iefjekpbswchuzipofjyoifkifetra' WindowName: 'bmiawsezhshuftcoeacryinwzsvu'
- ClassName: 'pwnfcjlmqozrcawyswuirhhtwmdturctpmgbww' WindowName: 'lbrqsadhosmdgoouviajsfbabvpyezbr'
- ClassName: 'erzeauwbbcucurvnojwo' WindowName: 'lywubfuxfulnhhj'
- ClassName: 'filqrhcqngzpjinemkbcakglvsnm' WindowName: 'cumyyejvbxppgwwqcmtibrwutkl'
- ClassName: 'jhjezjcvnaywthiof' WindowName: 'yeplhswexeuahglfargfoknirlkfeqtoxgjhvhy'
- ClassName: 'hacernrhzmiqqolsjbsmotft' WindowName: 'qcidvzkymhrsiyeqsgehxtifntsjphcfcyasoc'
- ClassName: 'codqnhlzusvjsggxtkflmbz' WindowName: 'skaatpnropqzcffrkmgawtxijdzkam'
- ClassName: 'qzroibfmqluvfrtnnn' WindowName: 'lbqxqfjkzzunsmvoocaewtkkovxwlmmihknsyhk'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'kobpyhtucpsogdkmmipiaiqkfy' WindowName: 'nfphvfinblfyzokvbv'
- ClassName: 'ipqvuixiukqgjglvyveglydzfhhwmfjl' WindowName: 'gyxbitrcnlrcxasqepnyfwfdtnqxen'
- ClassName: 'lulwjzymqxhhmuhxncocpbeedrgdyxrabled' WindowName: 'aaryxyeibugnsdaifkzgmkiafkikvy'
- ClassName: 'dxvqvljgrnnmcikmtuseilxaxklfrfonvsu' WindowName: 'cchzrhzmjmpogmpuymg'
- ClassName: 'yozzzczpocqvfgkluphzvx' WindowName: 'evfmsbauefjxocjrqky'
- ClassName: 'ujxntsoqkxlmyxabwm' WindowName: 'ifbqnrsouhlrfvek'
- ClassName: 'lijvwyftdyjhlhxjtlyxrncolg' WindowName: 'xfeuhpbqbnvsribrjunznvdrcwboiz'
