Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nss2.tmp\InetLoad.dll
- %TEMP%\nss2.tmp\Math.dll
- %TEMP%\nss2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nss2.tmp\System.dll
- %TEMP%\nss2.tmp\Math.dll
- %TEMP%\nss2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ojrtevuvojmrfzrfxgrgvdmq' WindowName: 'rpyruhieimvrzvzoildh'
- ClassName: 'eueffjmlecpdmfb' WindowName: 'ezkktcbabbfogfvqjjfsmjllvibr'
- ClassName: 'rggdmqdajzitwqknt' WindowName: 'aeufoctcvtxmrtgiiw'
- ClassName: 'vfjqlnivbidgftewyrdzmigwozrqkv' WindowName: 'yhsphxbnwcceuorfcotwxbpfaijagi'
- ClassName: 'ffjjtvrhyllcavjqkncnqauylehrlndkfk' WindowName: 'twemrglcupymiwkwjcmalt'
- ClassName: 'yiqctvtaxrztwqvid' WindowName: 'yicsyaakewhjpsjquu'
- ClassName: 'pxcqfcjxecvzdfwywr' WindowName: 'nohjtxzyxpdemeaelusdzlufcdmngflbqfx'
- ClassName: 'dchjwywqfxbnqmsdpqfohlbtkge' WindowName: 'siytskxtjwxtxusspqigiruhjgnsqihmdgwdw'
- ClassName: 'nvjrjjythahjokwaqasiyutgrl' WindowName: 'sworaecubvbcpoodndkdffxknorrmmkkmldc'
- ClassName: 'tvpeambudheknituajzadhpydwxs' WindowName: 'bqsdrakrurbcfpmfssxncoxhsghkvekrajfrgz'
- ClassName: 'fnavgtimqvzygxsscngbbrhypt' WindowName: 'vcnakkkpepsoewocns'
- ClassName: 'bxufbhkenmknhiicjgfsxjgbmkivdbo' WindowName: 'ygzrxbeaewzdxrzodlbapdhuuzsxi'
- ClassName: 'cnhvghxmwtradhjsothqsdwuzucalpksf' WindowName: 'okwkbpcbivtseoecrarqpxapmyjj'
- ClassName: 'svvyfokcifonlrvdjivmutipum' WindowName: 'xavoycpqtoravvlkxlgw'
- ClassName: 'iirzqabquguvvcvdydycidwdhi' WindowName: 'cdcuknyjkbkhevufvv'
- ClassName: 'wwmcidsuiifbaeybhqatsknzpmkloruag' WindowName: 'orlrtfuqdkxzfnjeequiyapfb'
- ClassName: 'uccnlkxfvuryhcjbfn' WindowName: 'hmhwuhisprgtjeehxnyzytpqqapqvqncllad'
- ClassName: 'eyqzxxvxqcuputzmtnohik' WindowName: 'kbigifmvgtnsfih'
- ClassName: 'uqvhwdnkgusoqom' WindowName: 'kjsigclwjhqyrrcxhxsthhycbkozhitydn'
- ClassName: 'qseakvpyusfufrushf' WindowName: 'hyamhfpqavcfkluk'
- ClassName: 'roejetwcafhgezdjkpohybsjnxtutb' WindowName: 'qpsmhkurlhaojifdts'
- ClassName: 'myurltcevbrlxfnivqxxobpgchki' WindowName: 'zjdhnmmvtmjwrdshhbynjfoajf'
- ClassName: 'wqkwnidepxhzjnmcqncur' WindowName: 'qtcmbedkgzdumiwvgrtfoyfcjff'
- ClassName: 'ttmsijjdphzcjjjnlklfdutvlcwtv' WindowName: 'wcgycjnwevgotreovdcadjgrhbplvjihpf'
- ClassName: 'yuzdaodalyqtilrbwu' WindowName: 'nibexudglpfknvgrazpjvpdtnwulri'
- ClassName: 'vtsypjvlmvcllytmzysnywruap' WindowName: 'qvpeibqhpsbvdjuaxjtk'
- ClassName: 'qkhokxyxzinxfgyyaotbdeccywdlvsdixj' WindowName: 'kelszhbcnlvynvzjd'
- ClassName: 'tpmijqynwyhmmgnhrmkkbkhlzhxrcbqy' WindowName: 'xybznismvurkrnbjpmvezgflhtc'
- ClassName: 'lxwvksmqozkguuyzlsmefuykzqmjgr' WindowName: 'zegoolzwicwpyrx'
- ClassName: 'cxtebgqhetarzibrtempsqm' WindowName: 'bazptkikmndpbpqusrngdxrzfkajehcfvloj'
- ClassName: 'glirwlwykokccuxwfptrmmihnmmnnnynjicx' WindowName: 'szxinfmhbigkqwwg'
- ClassName: 'vegkybhlmitniuvkydqdrecfebzh' WindowName: 'mlhrfghhowsrkcfkwzugabxcxfioxtcdjkjnu'
- ClassName: 'imrkemdwnytxbdf' WindowName: 'xhgimnxwjdcdplhnvgx'
- ClassName: 'rtyanozccfzuaowfeeszuqmtkkfcgobd' WindowName: 'ecygsmyptddognapaahrkquoyljyyanxmn'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'vdpiytnxdqltiazcyhqmjqiggvtpblpfzd' WindowName: 'pmpfvdgdartjrwdadwtxpmwqxf'
- ClassName: 'gfvjbfdihezkxdxvdoixhbyctmldbe' WindowName: 'hprcdpirmpglwmancjpoywoekfztrptolpyngn'
- ClassName: 'ybckejqgqluteepnrnesmouydw' WindowName: 'bsupipnzztdinml'
- ClassName: 'vmzmxhvqarwtjdr' WindowName: 'blaubowaltpwtwbgdfpkmqlggspiwn'
- ClassName: 'nukubppmnghmtbkcsbabinazf' WindowName: 'imwlgjggosixvbhkdwohutphrhdwcsnvljl'
- ClassName: 'msnbjsdyooegzdbhlepjjjvokj' WindowName: 'zhiqquajoqdzqep'
- ClassName: 'xtrtigogjyhobuaoifgmeapnfa' WindowName: 'kwfnlcmsvnrjvqjadhomyrlpipmdsehlwurw'
