Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nso2.tmp\InetLoad.dll
- %TEMP%\nso2.tmp\Math.dll
- %TEMP%\nso2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nso2.tmp\System.dll
- %TEMP%\nso2.tmp\Math.dll
- %TEMP%\nso2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'qkldvaymzhdtbrnl' WindowName: 'xciuwshtayjfycd'
- ClassName: 'bzkhxpptmloscprte' WindowName: 'qoylwdedghvszyttpdkuhypwt'
- ClassName: 'jizoqmczeyfumkroczjuf' WindowName: 'gbpmypabfmvgffrdlepvklnyya'
- ClassName: 'cicssvtoclnbdjkcvukz' WindowName: 'jggewyunlbkwtwxdbjcymypaszvykciwhdrqjbl'
- ClassName: 'eswtnmhnbckyzyqcgdjfs' WindowName: 'lplgntaiqgsribjfedhiqdbgvbmrvzhvqcjoj'
- ClassName: 'fdzhnqwkwhygmajn' WindowName: 'szhvpeawofaiiaegxzhqfvsgzzeo'
- ClassName: 'frxxooddqqwyvdt' WindowName: 'xnxzomqqgqeucfjzlxhfsruacusruwrvflqv'
- ClassName: 'yvphxbkdvvonetycvwufcvhrg' WindowName: 'egvqxmqosklpxgjzacfhrcmokactafgj'
- ClassName: 'vqwhcpekoyodmoegokuozgykbguxowmvussjnki' WindowName: 'glifooexnnpztmzprmmaxkzjrzs'
- ClassName: 'vkumsvjwnbcooknzenuqtsd' WindowName: 'bbibhkjuvybmjwtqgxitnhaxuhtgvtkkk'
- ClassName: 'vicnrowjtoutdsrwggylpaqe' WindowName: 'awprcumsmvayfactmehluupdavigtas'
- ClassName: 'wfywjiibjulwxzhtrzoemzvpvgtetdllrrmunwq' WindowName: 'dfrjptwucakkselanxymuagixtaanifuac'
- ClassName: 'tqlwdafhpirmidgtnltchjalcnoddqkrnxgb' WindowName: 'dclvqbjimfmhxwbqgr'
- ClassName: 'cehmmymqwckxhdnmevclossnnpjxjkxf' WindowName: 'wdxgdxggmoqgbnywkycxhfkpuoxrilzofktwudr'
- ClassName: 'alfowrtiaecwdenkccgmzmtuwfesgxwpekn' WindowName: 'wzppkctqhfdtobnrlzng'
- ClassName: 'exgyxxchgmhcpzxacukeyiutdknizshuew' WindowName: 'zlpibkzgewvpgsqsogkpclvewnfvoh'
- ClassName: 'pmeplhbqmatyrsztnbtecomiklyuah' WindowName: 'wvbalyrmoaamowqwb'
- ClassName: 'mwyrvxepbbkayhiwv' WindowName: 'lswmbiduusrapjwg'
- ClassName: 'pfpkjrpcamvvcaqrgrxxslpyquzqbkyassaot' WindowName: 'ibrqfafahdwdchggcupwxkhzswqlzxxmm'
- ClassName: 'mulxyfsrooojfbvqgtt' WindowName: 'ijzwxthhaemphrikpcjqiebeklxxqlv'
- ClassName: 'hmvclopajqqgprvscmcfznnrcehbbirg' WindowName: 'ziljszalsaakwijrcuxdeeiaicfnmshght'
- ClassName: 'rpvlblxwmugjgmvmb' WindowName: 'udopdpbwnzxbidvzxswlnqpekvuagmax'
- ClassName: 'jbqxxvxhmjizzzqmz' WindowName: 'wlkncmjhhiwapxtibfeq'
- ClassName: 'vqpmjyhrouywiff' WindowName: 'ngfycvkokvhbqfwfovdbwnedxwrs'
- ClassName: 'whjirwvqefyvallcyfwqtqeylthqyz' WindowName: 'zruiquahgpcxciesckd'
- ClassName: 'jmregfjgkctlkjynicriyifyoimouzxuqix' WindowName: 'icafnnxotmccphoqitfwoiiuf'
- ClassName: 'yaayneyscptauxbsrpspw' WindowName: 'adsdheianrjhvxnieqirnkfcffxikoii'
- ClassName: 'ljnjwcedeuyzczcafbsubslajczvreao' WindowName: 'ahgzxtwevlrnbrfgusumllwjekkqs'
- ClassName: 'npkzdqowuwthjqhoeikt' WindowName: 'uycjuqnggrjapnbgqhsljilcctgm'
- ClassName: 'lncznwbsnojydqocgokkgw' WindowName: 'zukynxyvvepkodqnynbiwofhgktkbjbokwbeh'
- ClassName: 'gflgvwojfhkygqmaypcixnkynwngnbhfmo' WindowName: 'tlecpcunxgtorowlvcdctvkfuuxzcsdij'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'khbbumokwucwgitoxmodzoiohadn' WindowName: 'ypfvnufihunmnojaifwxb'
- ClassName: 'ypvpfltbnlwjmwasxfiznczguc' WindowName: 'ogqamcdamikworrune'
- ClassName: 'camadanovmtpbsslfgsxdjqltecystqrwwizq' WindowName: 'tjfgxzsnzjwcaouhluovhufpadcgezcvqnupaew'
- ClassName: 'axfzycetaabydpuaasmwpeds' WindowName: 'ogxlfocoysswqvfpfcqzxtcvvbf'
- ClassName: 'tadvqkxvknpdsrtimjebljubodhrqwwy' WindowName: 'uzzjzftvivzapeugzfz'
- ClassName: 'qqqmriwpsdaaahqacjyevcvkikkfciyukzpdp' WindowName: 'ugpaoxddkfgypwgsxfrvxzzwbwyfdpjswid'
- ClassName: 'apiirfckgnyxvmnkoqmcdemamhvsyevdbw' WindowName: 'ivljrjyqneirsgtldblevpkltvgqnrpfxhu'
- ClassName: 'vpshshyoabzlkjrzhxwvmomynmedp' WindowName: 'hwzinkwntohmmsrsauzjwcilw'
