Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\InetLoad.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mbzqlnmoklsdwiepxvhp' WindowName: 'plskxwjeqlrstytyxup'
- ClassName: 'hcymlmuhopxvpnuxndsiwfr' WindowName: 'rmkeniptjemmxnk'
- ClassName: 'usxribdbuhlrkldfsizggxaorawn' WindowName: 'ukshxnxoifqpsxkgrvoyznufuksjzqvd'
- ClassName: 'mtedohczhyutpnlydkgeso' WindowName: 'deekiqvlaxjkqkrcvumuzrlceifcfqtxmgeogmo'
- ClassName: 'ldprgdiweczdgpdeiegmomsxbr' WindowName: 'jdohkolyqjypfryrjbsue'
- ClassName: 'sexdsxtwnwkvraet' WindowName: 'sdmqpvcytzsolfmatgtpo'
- ClassName: 'wylbmmsgfylbqsvnaozpkwvreg' WindowName: 'zqjysggbznngmfatw'
- ClassName: 'rrizohudwwehthmaoufjfcgajbikispqy' WindowName: 'yxudkferhpmntuxyvltqokntzuufxamegp'
- ClassName: 'ylqbxsabgavmclj' WindowName: 'gatjczyjuirmxtsrtgzhazetkoqv'
- ClassName: 'erxqvjztmqfnrgqmcqdqczbcty' WindowName: 'nqdbebwwzvgdrwnldcmtjloqnbhlsxufoepiap'
- ClassName: 'hpcgvqppwuzfrazwruqrdflyqmlg' WindowName: 'uctvirplfymsjjcrmtmcwjicwhvkw'
- ClassName: 'fjtfignxzyqymwarnuzweowansfbym' WindowName: 'jbkqmgyqxeepdniozfujytovgxwlooqtnqglc'
- ClassName: 'fidvhzmdwdmpmwzxlwscralqwh' WindowName: 'evyzfefeaehsgbqrp'
- ClassName: 'ofnsjznacjepyhwxrdjiccpdwuxztwa' WindowName: 'pfiejsjqamajnktjpjxakainf'
- ClassName: 'hestupiwkeslrepgzlvklohkevyvgsqf' WindowName: 'eyeozxaitmshuaxjp'
- ClassName: 'wydkbtybgxvlbeywevrxcliylpxxnz' WindowName: 'lhhxvaslmdzbjxbdbmjzmbmkuarwrultuiil'
- ClassName: 'yvesxduqbszhhbfijnxufkphiphghzdparuhvx' WindowName: 'weiyjdqhuvfbpcdu'
- ClassName: 'mtfnjlrybrfaxjermgxfuyzbeuwibllzt' WindowName: 'iwzecfkethrvyrw'
- ClassName: 'vahiblunvpfqjmwnrb' WindowName: 'bczvmjsubyjqzdrgqrgswyei'
- ClassName: 'qikhesozdusttosidwxuofjlra' WindowName: 'fbajninskpbmpgjlsowvlfzrdmkgor'
- ClassName: 'wbswibliidbzbzoln' WindowName: 'vsmilhujrugxyysvfkuijng'
- ClassName: 'inrziceutajvbwnxkgalaczvuceesxwynpfg' WindowName: 'uoyyttraxlqfnunsczbck'
- ClassName: 'jnffzrtyaiugyccaxhkyyyzvu' WindowName: 'afpghsvbwvepvqjshsok'
- ClassName: 'wkswzjcpsteyxnxxjjazbhnxczpitddfceavfb' WindowName: 'seschrtpkqlvaeqaazukyxszixyvpjiplfwdeml'
- ClassName: 'wzdtklpsmoncvbyezsqsfzmttthxsusv' WindowName: 'ijriiuhnazeypkimkvgffgahyemzagtiusjdubg'
- ClassName: 'vgatxjoruvesqquvqxubrcgzhsolwtehrkt' WindowName: 'jnsoxbzrnehcnirioizsaascszabakjvvejdz'
- ClassName: 'yqnhzmbmysrqxsdefuly' WindowName: 'rkokdacvrhmprcmujpyhfuunpkhfqsadlbybi'
- ClassName: 'yuxcyhmhkrptsbyhbqskrnmqxhndmxbubrx' WindowName: 'edurertbuxrzccybvcpwgfh'
- ClassName: 'mabfjviztdwtomys' WindowName: 'rhmrynwczvnzifouueesy'
- ClassName: 'bfpqrkjqcsgtbsqxgpvaqubffsxfjntwi' WindowName: 'nouagzbrpfjllkspwigribum'
- ClassName: 'divowmpooajirqeitb' WindowName: 'ndmeesqvutlfcqomhdyv'
- ClassName: 'rltnehthgjyimsystpttbvrxeszmibuos' WindowName: 'nvtiixrhkqittutyraiwwcfvozdmrmiqkrxuii'
- ClassName: 'posmhnygaexmpibczle' WindowName: 'kmidvvunueaqdryelfvimovdc'
- ClassName: 'dcwsnejiahdsixvotbjwr' WindowName: 'jqottmsfkdpddjlsanjmplukaywlawnfzhra'
- ClassName: 'hwvwveozajvkbcncqgzmb' WindowName: 'kkkhsgcutgqcoskshsdtjvarjs'
- ClassName: 'wvwslgzaszrphhzlhvvhkezdpymu' WindowName: 'zatyrojeeazgpisfkvtmdotkkterhrdvuc'
- ClassName: 'zmhprohldngnnaxfbeslpnctsme' WindowName: 'zffqouapwyrzvjlko'
- ClassName: 'azpfrbrkoampqwbwwddqexaphtdou' WindowName: 'bbejkjxsydzeqyssqxtzmmiiodaznk'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ardfsuwevlrkaaepznpqaqjbobgrsilpwymofo' WindowName: 'knprqfooqishhnfugqsduo'
- ClassName: 'fvpxrklmlkbevxeueqhibf' WindowName: 'fceemwgmomzuxparytfveptfuktbzoiwlihq'
- ClassName: 'ginsbtpesvdvelezb' WindowName: 'nanxigytmllfnetdpcyfunjdklaliimmc'
- ClassName: 'lzrnsrhqlpsielclomkbboupruszyikfpjagpkj' WindowName: 'lmjwnkvsevmgpkbfcduwqgxmroxnv'
- ClassName: 'oipracggoilkdzdqjamjofkgtfxdcav' WindowName: 'xiektwmufwkfskuzjfqrjaaaqzvlfdsbsa'
- ClassName: 'dpfebhjyyeuvxjnywtdmjuuslqzxqvyhiwjoi' WindowName: 'cpdtdfuimoqwcmovpqirzqmwpbhsmduhgxhfsut'
- ClassName: 'mjhukuweldwkpuswfrctcuzfht' WindowName: 'zurtahpvptglkstnuyutnhysde'
- ClassName: 'zazktfntjtdhyynhjyicb' WindowName: 'etexnaoiwyxdmsatsblddu'
- ClassName: 'tddgwjwpcbbcqgvlqyseveeksinfjhl' WindowName: 'plmoqqbmqinraotsbrgy'
