Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsi2.tmp\InetLoad.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'exojzodbodhrvsrveo' WindowName: 'xxoxgyasidtswojpxopyrnbsgwlfljkfysvn'
- ClassName: 'mwwwwkcnjkgiflfuqygmatgctnfrtrvx' WindowName: 'tkixekhkjhjfzfyjmhfkpapevjhraeszosel'
- ClassName: 'lnrzznjimbcgxvbfwqzrmawdxdysybeav' WindowName: 'bxgpifhdavlicbpldzkmffdtfwenik'
- ClassName: 'okdnxzvtcwajkerqvaf' WindowName: 'apiphzsrnkpaiuqctzokjpemgglbvgvruqtrgst'
- ClassName: 'abslbfaywiydcdkqqeddhtlbwqacqvluuzdi' WindowName: 'fsxufiwbezrxzmjc'
- ClassName: 'xhseitygguhdgupwoclrxjsit' WindowName: 'qfrktmmydnqpaagdmmj'
- ClassName: 'gbeeihogvdzfwinridmk' WindowName: 'eptfwazttasbvxeexbwnhyksnzjw'
- ClassName: 'nrcnfvnqylxptkiaomrfvvpzaagxmhvbdna' WindowName: 'kglqbmduyikfatnlutinzuxf'
- ClassName: 'hanbtomwlquhgmiqwqmuzyhz' WindowName: 'yifdhfqfrnmpqzfwvpyakrgpzbvjosa'
- ClassName: 'tqziqijxlgqyinowclnnlmotiqsfmxotrqyjwyr' WindowName: 'vgbqfksthaetipjwpnldrhywirlq'
- ClassName: 'fzskdqxeuymafzifivdcvcrrshackrbuwprbkam' WindowName: 'gnregfefiujjhpgsxkmdhymycckd'
- ClassName: 'zbwgafbvbhoeyuuczpkbpyawftcfjbvdxuia' WindowName: 'lhwtybdxgjvlvngzcykoawuhi'
- ClassName: 'gegedtjdsrzpcady' WindowName: 'jgzgmqiuvoluumtvueodhlqcmvad'
- ClassName: 'jbzufskfakahafihbvxzexfcc' WindowName: 'iflywhivqayimtzxqdttypezsmerwacigfl'
- ClassName: 'pfrkzhsrithbsvanmkbhwkkmcabzyyr' WindowName: 'yxjifmojcxjiikzpfjhoicterebqwo'
- ClassName: 'xiyuwrwydowajwdppirlrxwblnblzzrxhdqa' WindowName: 'lcfjtsuvqsvzbzveurzxzrzguwftcclprrt'
- ClassName: 'iroijcguuwyteuzitbcawlnz' WindowName: 'zshmkvnszvzwkwbdqfmukejzccatuawsbpzla'
- ClassName: 'jhwukleywgxlwwffgzsypoteluqgvmvsggawdvh' WindowName: 'xtqluvkknbiewuoamkqgmsceasvqgstlzhjepfb'
- ClassName: 'tgklotokvrxualaidjwmomckeb' WindowName: 'khzkbaqoixnvoafqjghgrvw'
- ClassName: 'ijmlfxamoosxlvrrxnmchgixhqcnrjgoxkwft' WindowName: 'wqbckymxkldyvwqaqzxebajn'
- ClassName: 'ueictgzbevbmvrz' WindowName: 'jalikutladujpnnzfcxrsmkdxjovdwb'
- ClassName: 'phavwiznkodbrreofqxaaeh' WindowName: 'tgcceitryuqathbly'
- ClassName: 'wdxaffivhntavloayoehdjabeaqhgwywswkjf' WindowName: 'gssduaebkcqnjkxfsljykhlgjwirke'
- ClassName: 'kvfpqfwgqhqhqgaeymnyvretjdzobg' WindowName: 'rubsshyrtfhozqmpaunhfnhlwpd'
- ClassName: 'okyuswevixpxcdxmh' WindowName: 'nwcryyrzjpzbnwxlciifveqkaqexpsxnn'
- ClassName: 'sjlqfybkjtfvlglpcwsiopoerxdcj' WindowName: 'udynjkejtogffagpxpejnq'
- ClassName: 'omouqvvdnsgdhlcrcsgrpkklllb' WindowName: 'vegokxfcvqjayfljlujtfduku'
- ClassName: 'qvtsiqitapndhwhmqbvzhflopl' WindowName: 'rtkvqsjcrumcorcvegvjtomwaorgccan'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'dgdvygzejgslbrkwzlr' WindowName: 'gvieccxgiuzqxsbs'
- ClassName: 'zjozgpcjvqhlhcvutluguztsd' WindowName: 'jxfiogppvyeiavqnhf'
- ClassName: 'xqdaziuimgqxtwe' WindowName: 'xfsclaxploargrzglmuqxskcauqjlw'
- ClassName: 'pjnxwzcszuetjiyxcmp' WindowName: 'dcdlqdoswbbjcassfqddiujqnshgpyby'
- ClassName: 'adublnrupqpjgwoxaroiuu' WindowName: 'gfsrewewuoukqxhkgshfqwwfaiwi'
- ClassName: 'hqxgiuonyoxtrjbxeixwrnzabffwialogupggqg' WindowName: 'enichsetingtjzwsyjihphyj'
- ClassName: 'dkuqcnjiasytarb' WindowName: 'davbjbfgwwyvltbklfnxtzszsnrd'
