Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsh2.tmp\InetLoad.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'sejteorubpoiuanqxggg' WindowName: 'dxmtaaxvwlbbzdceppijcqwhtyp'
- ClassName: 'eyjgzsbpiytvsexuyhobzbrqxdnf' WindowName: 'gwbqjriyffrbdximmhalvctnjvpnbzqydj'
- ClassName: 'mqqryqmfsynwfouiswuooruvqbil' WindowName: 'amwojinyyvcphpllsslpshesoqglbh'
- ClassName: 'wwimvxnbpbjnfjjwquoguxnnmksdmnewxbo' WindowName: 'zvielsjbcxvrynagcsbwpuuckrdpmslxcqwh'
- ClassName: 'maaxjmeluvnmpplrwtgrnlmxmyaefux' WindowName: 'olkheoczrfpbtfpgyfanxrlhjprufnekz'
- ClassName: 'ohnokfztewrsatqdzhbyoia' WindowName: 'olyxjonswxzjvwyvaka'
- ClassName: 'jabgfwzpldbhfunyeofperllanolawrjrtr' WindowName: 'vagcwvyqvfswbctlzovzfuemauhevkebergj'
- ClassName: 'zuffhckpylglnooixjeljpcdlbrsvksozdyqpg' WindowName: 'kwafdockywgxwzepijvfhcijfewtmlfnzmy'
- ClassName: 'owpzfunjwixqewuquznlosbfbohzbgebh' WindowName: 'oiofethviapmlvellfw'
- ClassName: 'jkykccjvzjxfxfy' WindowName: 'uzrtaljicivziaskwdoqpcetapicbmrxoyxhm'
- ClassName: 'flmvcbeqkdvswmiqtg' WindowName: 'hwsewvkbhqqtpobumdyclzsc'
- ClassName: 'gthhrvtgpocqntjb' WindowName: 'gaozkxycjvnxbqasmwkyznricyocbxznyssyz'
- ClassName: 'canwntujxcxoxhksjumbtqq' WindowName: 'jydinezppquzymatxoz'
- ClassName: 'vxrxvpdxaivzsiqnu' WindowName: 'mhdarynrqtikkzpbqdpauzwqvypkukjmwb'
- ClassName: 'rmtviicfmdyzhvluoixgxivlwumrwqjyfj' WindowName: 'tqurgggqxihpuqrfy'
- ClassName: 'edwpxuqvwrkbvfkvcmetmvpysdutyljnbxovc' WindowName: 'ncnleovgqdfzipdvvemlgpvkjodtvwij'
- ClassName: 'tbcvazzhvilnffmbiltbwusu' WindowName: 'jzvrmjlgfvqiurnydrzrtmeyzz'
- ClassName: 'diuahcrpusebutiozrqmcgreq' WindowName: 'lkhhdluguwrxnkwlttwfzancttecfpmddtj'
- ClassName: 'humhyudeothukppycflawpqexfueeuprjqvd' WindowName: 'jjbtnauavmrglhtodrtdvyoh'
- ClassName: 'tzfobrphiciopfoscuqvytyticsnztmbvsd' WindowName: 'rtwgtflmxkknorowbhpmbyonuqvkiplmanjlcw'
- ClassName: 'uoxxvhvehofdlsdsbtowhwbaixadpllndwbwhka' WindowName: 'znphkqiobezfmvcdqxooqioosfiz'
- ClassName: 'nwcuvibkyhurylccwuoiqvv' WindowName: 'agwveeiblctadaul'
- ClassName: 'sawklewypjifcfqvycmvucvbodtnfv' WindowName: 'wuxnmsewtsvjwtymwmwic'
- ClassName: 'wpyzztiwbobcgaqwhwmggqzczqjo' WindowName: 'ifnbdqcgqycuigcsqiorygnlrruutgtgvkxn'
- ClassName: 'usdlpctbhwkcqtay' WindowName: 'gbudlbfrmvqpwnzzuinrwri'
- ClassName: 'vexvqunbqgmfclqcfsowfjmqhrmilbiislixfa' WindowName: 'lemapxdfydlvhqmfhsphlkkddamyuc'
- ClassName: 'wcxeyqksarcqtbagjugfdlxpalsduthl' WindowName: 'zgnczkmepodsyhoa'
- ClassName: 'nakavxagpcupfjwdsntvnwjzqzdvi' WindowName: 'dnjlozcrmplcpfihpcxdwqvwngwszg'
- ClassName: 'uvtsmphumiqfohxvxnoofkfvwluyv' WindowName: 'geeipwalhvarcpuqehptqkxijrpmymevkg'
- ClassName: 'thcugklnpbgkoptqrubvxhj' WindowName: 'pdkhxddxycgymidxma'
- ClassName: 'vmhfrjfyiqafdwglanktmp' WindowName: 'hhlaogugivtndodffedahbshkosmrl'
- ClassName: 'bysuwgluseamzfusmgzwrpcbbhw' WindowName: 'ljrulrpjrqhqqzaixvrvjzchtisihnkuii'
- ClassName: 'wgwjfledvsccmmobzcrafhx' WindowName: 'geqoywfwhtpltyohr'
- ClassName: 'jbnwuyavtsefdmfimqnzbfazsiwenouc' WindowName: 'oujdnlscvgsckcj'
- ClassName: 'ozxkznjorlwgeatstvklxrepupjojbhkdhyupm' WindowName: 'xrxqlveidnhrdrnnqnbdwpxnauohwftooplcj'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'szlivjjnntaeochrv' WindowName: 'npirehicheefykwojimlfsrerib'
- ClassName: 'wpmuwtzxnqnxqnqyr' WindowName: 'slphopirkbcjoacs'
- ClassName: 'rmnzbrilutxcrweroynjlmnbsncxvusm' WindowName: 'glkdumixshvtirrcpw'
- ClassName: 'spxxjbxcnkbrgdmfymgjzopqwsrlctowegsz' WindowName: 'hxnyhfjtvhasdlionrsmejwtjwuobxkokmjcq'
- ClassName: 'yvbohtcarkrsmrdribfvzvxwsxwiiva' WindowName: 'fmiqatoehncuymvwz'
- ClassName: 'ocfhqiwztwatdmwg' WindowName: 'upgtkpmtelantpemfyykqfrvsfubsbcqigu'
- ClassName: 'intpbpghkgmirtfiwnm' WindowName: 'enaaisrikayffuowlpyltzxnuxczbj'
