Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\InetLoad.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'yimqhrtqarpibkmnzxuamhgefhxjfplmj' WindowName: 'atvpyljljtlknrsdpcvinnyohjiwoqan'
- ClassName: 'byllolvshuvpdaylqmncykay' WindowName: 'zhbjnoeobhkanaqzcj'
- ClassName: 'kqyeaaxpmswwnlypxumgcgkw' WindowName: 'lurimpkpggyrzzjcdw'
- ClassName: 'syxefyipftyrpxafykbowqkpjeafaczmao' WindowName: 'duhsbcbjdrnrhngstmlsypgtgqyhxgmgqr'
- ClassName: 'igctqberjfzivdummblw' WindowName: 'stcwpnzbunqlhbxewhpbrktpokmay'
- ClassName: 'liovenegvpqbisbghwynplkrsmznt' WindowName: 'phyuuptkxpnuntuovrssrr'
- ClassName: 'casgojhhuxmqubf' WindowName: 'hzsvlquxjxsihitmwfgux'
- ClassName: 'drllfotuaoprmixvwvdqrfzp' WindowName: 'pgpofjpousdtsmurrytrkyiljnsvxsaigqfp'
- ClassName: 'yuaigdnxftwmzeqtvebcdyamzizqsoirachea' WindowName: 'qjrgiwhjwanuiumqe'
- ClassName: 'ztkdqxlqoqmqsbjhhvymokkcllkjm' WindowName: 'dozzvstggxqrydbvaipbu'
- ClassName: 'wyyckllwqmkkhsucattmrasnv' WindowName: 'hagswciiwuaqqlpqjlljwl'
- ClassName: 'wzysxfysulbqkhguskjfvlxykrjvtlcgpxf' WindowName: 'kesrgfdkrboozyachtizmuegbkxqamxkcvjz'
- ClassName: 'feuxmgnqujbudseblgoljt' WindowName: 'wxoafmpnqknkrqoabzqjimbjy'
- ClassName: 'ifrnoggdathibdxrgrjngmytufypgwak' WindowName: 'onuptnixzxkqcotdstmmbxlmumpjjauwrze'
- ClassName: 'rfwmrbxawnrbgevaiuaepueluvitujecj' WindowName: 'ohfyxiwfojuxalgcabz'
- ClassName: 'qstfjpzikwpmbsmigbqnfobdeooyfdioxyo' WindowName: 'mxqwtajxsrxatgpofbp'
- ClassName: 'wfqwtyktmzradvazwkhzxqmuephizbiphdeoz' WindowName: 'uzpbkchqkbwotnpytnfidjjnhhc'
- ClassName: 'ylsczinjpwohfmfzzayenkesfbfviqabuiv' WindowName: 'vxwdlvgtthgzkkexrbwvatgvhtwlpksplghslyu'
- ClassName: 'airxgzfcakjfntxhewuhjjcccoyqz' WindowName: 'rukmchqgjwefipomlhogll'
- ClassName: 'zlbojkspulosxznqttbsvyykoywagriohfxznp' WindowName: 'ddawsytduvgfbbdegxzeyzgonyvaffwznjx'
- ClassName: 'wzyaqkdtxhhqbprgzakdhzpy' WindowName: 'xyiynlvezkoyopfhomgeecesbntbpbc'
- ClassName: 'fkeuszvtsppanfpvbmphdikupinxr' WindowName: 'aoakxksdtkcxrtmquqyozvjiyfgtvusiztdhp'
- ClassName: 'exhowuvxydzrjemucb' WindowName: 'tbjhqexggimtznzgsnvbfkvtcaqmups'
- ClassName: 'ipvspjvshyynxhwdm' WindowName: 'tawvfypgejfldjglattz'
- ClassName: 'cigoguseakrrektcywhndxouoghgvnlcilk' WindowName: 'zgciewxhzjiypqgxlacflilliipgkyqqp'
- ClassName: 'nmhbhlmwozacliqxyocrm' WindowName: 'apntnedlotxfwrmexapgjlybuvg'
- ClassName: 'ncntfqzsehmsplnkofzubkqwmwmhioxeyuu' WindowName: 'bprvejkroaqgipqxfotkfosmtpjmrkpyl'
- ClassName: 'kezzeuzvrgzoveevdsuwae' WindowName: 'drcpdtkjcsktqqwufsyor'
- ClassName: 'kwyfjbillgffyfdlkltg' WindowName: 'ybcacjjcpxvhhhgjyalexvzthkcezawh'
- ClassName: 'uatxkmgnptokljmchfmszuujc' WindowName: 'xvfwjmvzwcsaevwxrezly'
- ClassName: 'ebdliydjkbyoawtlltufvevbkgvqy' WindowName: 'vycamiqfkfwinrhffwmuvyfpscmhabm'
- ClassName: 'fejmpscuielqufsasgnkeifvfupqbbirmdmj' WindowName: 'nqhstomnbmxmqrgiehlhifmsr'
- ClassName: 'fkuimxvzdzrntoypbzovevgndewlasjyapyhcze' WindowName: 'yqzorbxtcdzoqbwptcqmmlvzyktgln'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'xklcnglxyidkmahuyeytlivruaiydknsaulxr' WindowName: 'lgfwzrpsactrldpmljlcfsqvnfmiusabkna'
- ClassName: 'yqadaqrsgrywsbaxncuyanfqgmcqpg' WindowName: 'arcxsbflpkanarufeeodlaajiigvaxysxcvkozp'
- ClassName: 'uxwqyxzhiqfblmheiqznmxh' WindowName: 'xtommuahmnuwpheeskphnkunbqzimddu'
- ClassName: 'ttlnkrmgpxyjnotorqohsqwo' WindowName: 'znfcexqkaruzmxdm'
- ClassName: 'tijlhztfwufbryvqliqxienubeuwdpbh' WindowName: 'qfigjrmbrcljcedgztdaegkrmljz'
- ClassName: 'jfjktzxbasxnwgrxhcxricrxhkrrgotk' WindowName: 'vobdttnhodthkroiwfstscovwbczjppfvjvxdcx'
- ClassName: 'oribazzqtuhgxjibvsadgzaaytzrchbnfulx' WindowName: 'xifsegynmuatelfjrlp'
- ClassName: 'irsdnwidpmpdylkonqcborrgija' WindowName: 'lgdfcsokafmgghaw'
- ClassName: 'lybnpzwxgoxbyzcmves' WindowName: 'srzqjrxeuptfbtnvlnxgucenrte'
