Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsa2.tmp\InetLoad.dll
- %TEMP%\nsa2.tmp\Math.dll
- %TEMP%\nsa2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\Math.dll
- %TEMP%\nsa2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jgkafviucdkvcfjckkvwpkdjsaq' WindowName: 'kxbiwhzbfacsyxlsfpzlimaxsbqoyzo'
- ClassName: 'anbwocqwpnkfhqcwiegufdrtdjgqrtfk' WindowName: 'ueeqlpltxzbwpjyvi'
- ClassName: 'tinmssobumowymjrjksqvabxwydxojfn' WindowName: 'mvhfhatjnizubutebmsbxo'
- ClassName: 'cmzartolhbtwcxyhmgectvhjfrkbczwjznafvs' WindowName: 'pjmpecxptfznmzedyjojrguoojamcgswoy'
- ClassName: 'eqlbmgzxpardzmfoqyvy' WindowName: 'gshtijntbtayqpmdetuyfxnkdifqi'
- ClassName: 'giihrylsvmmopaenosczvibhthqnmhgpodjqbrn' WindowName: 'rqnzdvirsernhkarwzqajssqsyhq'
- ClassName: 'tadilfxrpcpqmskztpvqzertptipooetivwrsrg' WindowName: 'jjnwkgnlclamczzlcdanlaprmp'
- ClassName: 'xagqxnkunsgbocrlzywwn' WindowName: 'zmbjscnloxzwuuhnsfjeb'
- ClassName: 'obdyuvoesoohtbebwhl' WindowName: 'qacoqqqzwtnryztdsgemnypmrqu'
- ClassName: 'eldzpxolurmofutlquqmxalmzoobn' WindowName: 'ujnijtzmzxjhzhagsmxktjakxxwzgtpvkpjm'
- ClassName: 'blflxngftadomlyowhlczdhgstnkc' WindowName: 'rkddfehlhocpxyfqofehwjshcjaxghmriobdvp'
- ClassName: 'nvkxsrnvjhqxbzkq' WindowName: 'zplzpkzoixfnwjjhswhzoucaaavqqomjvkf'
- ClassName: 'vzzncebmqecwxzceftibtxnfsvblcqaevgh' WindowName: 'pnghfiullgpfsyezbvpbiwemlxz'
- ClassName: 'jlwxxbxidsfrwvflbugwdvqgutmqszjfaqqqmg' WindowName: 'zwxburhrlqblaifartmrz'
- ClassName: 'unavfgrsrgficmadsenxuiwrucjlhpsbvcjo' WindowName: 'yrbishlormnnzeabxhvpdwtybapdjtgipbrpcgu'
- ClassName: 'urtlhkhsqwtodddroblhpabami' WindowName: 'ogrlylavegjdqwdphc'
- ClassName: 'cvaywfmbkhlnjlk' WindowName: 'sizyqzrawvcumsunhyv'
- ClassName: 'uszgvpiclsbflhruhxnukcvmj' WindowName: 'jtxpaglievuypeuiupwqjvazsz'
- ClassName: 'osxolpykcpfbhjejnwwpbxyycrqun' WindowName: 'hhbnsjpcenhancowuocmdat'
- ClassName: 'dyuyyliqnjwvhhuzptc' WindowName: 'shagwbbfalpfkgwxbxwrjmbppgpwhlbgaztz'
- ClassName: 'bxxjwkbxaprwniwulsxmfqcktco' WindowName: 'cxuwwgjqasjbqshhfmhvmnn'
- ClassName: 'fkcabkdsshnfwlwruxeqkwqyuhtyjqn' WindowName: 'eamjojneftddwmfgqxltu'
- ClassName: 'vhlgcjslnkjycsybsxbykuqrgzanyqljll' WindowName: 'qypvxwrcamelfgqjh'
- ClassName: 'idvqmpfvkgljgzckfivh' WindowName: 'rqkzcaxlxuivxhwqebvraebkeitcuk'
- ClassName: 'dfzewfgutqflxmhhbrhykiu' WindowName: 'ruzfqledtqvvsdclteizfehtfwghahp'
- ClassName: 'yiqhspyfhzleojdykdullnfjfyxanhpokfcwlj' WindowName: 'vvhpbrapemhaaldco'
- ClassName: 'hkchefiwjlseanhr' WindowName: 'ilyejvfnjloimxvvfidhvzpheb'
- ClassName: 'tstogmxjhdxbnrysfptchywfmuuifeyd' WindowName: 'grmwzomswgniptcryscylgsz'
- ClassName: 'dfprhijhkfsciwqczqfhoulu' WindowName: 'ksvxfitgczyhnhqezhw'
- ClassName: 'xrvxylsuiskpcxcffkqs' WindowName: 'fbeiqqaqlfywldsptrdczf'
- ClassName: 'wcykegtytbwuuikhdumozpbniicaxxsxwac' WindowName: 'lcehpfnhfqtlhvkjjwkmdackmmzigxap'
- ClassName: 'ygyvyrljjnwehhsjnebkhoztogkoh' WindowName: 'zhwdfolfsclraxex'
- ClassName: 'pvuykvjireunzgxvkuzqjjnuynbsssiktr' WindowName: 'wmpphlyuylklemcskbrmxmrtownbdszmurd'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'tnrpwwuzuwwhacurzqouqpueunuuxvuaqihy' WindowName: 'yfhsqfkmlluuzijcame'
- ClassName: 'oxhjguhvlplghuxziedssiuwouqijiep' WindowName: 'olawpfarsabdjfcfjy'
- ClassName: 'hupwxxaeqyqyhccyakyzdjguyqorsft' WindowName: 'juwcskhwvuwzhbdgicccdx'
- ClassName: 'jnqyljhvebcwrgd' WindowName: 'kdklqeyykcuyauhagugjwmhaummedtc'
- ClassName: 'fvkarnadrlqglssuibctrmygbdzdvrqous' WindowName: 'bzgvmaqeollzrizklsazmvxkgzdtsxskfn'
- ClassName: 'mklyaaqxjfezbchwildbk' WindowName: 'jnrzeknypjaytbeeezabtlmomwpfuixzxvuhbfl'
- ClassName: 'uqfigcdlyxzdhxikkyrdfcpejskafbbk' WindowName: 'wlvdfqlqyzfdyqkqb'
- ClassName: 'lfaagprwapgmvykfibuhlnijkfknlrzaxgllka' WindowName: 'lyxwzqenoeqtkijrebvsprg'
- ClassName: 'opvceoiydzxlhpyks' WindowName: 'smvzvtiaizundrfkfaojzo'
