Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsi2.tmp\InetLoad.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'fhjksbxfubpbpenumqxrn' WindowName: 'scbnilxciijqhwpfhtyziitpqff'
- ClassName: 'intrfijmhybxpaltwvhfctl' WindowName: 'bbgeqfrhekfjgome'
- ClassName: 'ciyycfsfxanzquthgwlrlwswnstjson' WindowName: 'fdacstpvrwpncmycurxggeel'
- ClassName: 'bvihrdcbhoyzkbrhdpvyhpd' WindowName: 'brrcltkphujpvdqgf'
- ClassName: 'ewkuazwhsuwjpstkiyjiyngueblmhcoogivbn' WindowName: 'gsymwdnskefsyvpvdqodouxynlyxmpdb'
- ClassName: 'kbnforrpvpthdhzbgxrpmc' WindowName: 'plmzqzcjaawaldlozckrfmuzjfjyj'
- ClassName: 'ffqllwosysluvnvz' WindowName: 'gmlrftkdxiynvxlnutulxgzuzwcckryxbbv'
- ClassName: 'qnolgglskfxyvmrsfrgfssmxqmcud' WindowName: 'iguaxuvazlnfwvm'
- ClassName: 'fznmspdvzqveefuzrdfvlnhwdycmkgpcin' WindowName: 'iurbrfkvxckkkpuxgwdncjkurwynrdmnmnys'
- ClassName: 'digohxyvriblqrgpixkbdhjchybubbgjaxg' WindowName: 'eabailmfxkodwkkxlcr'
- ClassName: 'opptyebbrlsqryotq' WindowName: 'dwwofzxummkqcoyrdtseiblwyitgorfidhbzkf'
- ClassName: 'vwezkhqqzvfqgogovqilgugdylxm' WindowName: 'xkzvtaijoeesvzlddzgqgr'
- ClassName: 'rqpqzyhmyghgdoyeaimvndyvagbbj' WindowName: 'zwjmfcszeejssokiokyhpyr'
- ClassName: 'jijgjkqjdpxuuncnlyxszykmgstqaceprtju' WindowName: 'frihbnybhsbmkjrazpvoqacyki'
- ClassName: 'qbkejiqvkbsjqnvjknlplbtajwqdhrlpjemyxok' WindowName: 'jlisoinrxizozkgjwdwawp'
- ClassName: 'mklxekfvrckeirackgsnpb' WindowName: 'llyvbudvckaplavyewqkagfszuuklvtn'
- ClassName: 'jdrussjxnbvsrvxhijmjakdfuaujxb' WindowName: 'edzcudwgcbzdiowmbopeggtg'
- ClassName: 'bxktudrkytvujcba' WindowName: 'bujlbyopnaiyomcbwyuveqbldykpzyzaejpjdrd'
- ClassName: 'lbwcujdxzgagjjigcdobipmvmd' WindowName: 'sikpqpgvwdvrkjdmlylfbmptqjxfjzlucc'
- ClassName: 'khocnhcbhhzadhevzqmjnpjnnkxfz' WindowName: 'wxjoutmbpksgyesiha'
- ClassName: 'aomxwpculnrsiagxrxqthyqedgvig' WindowName: 'vrdgekqyvqcfato'
- ClassName: 'mvslmadyjhxklnms' WindowName: 'ycersnnewmyywzsszx'
- ClassName: 'ketsdgegcpqugiqkkpmw' WindowName: 'yxseiqjgevoxlrzlxnzfogqjtv'
- ClassName: 'lgevjvyudbqrmxevjqwjjuuxtngtssao' WindowName: 'pmebfmoezajqrlapqxfoibowh'
- ClassName: 'xmhzhqpicumniketectlbxaibsvo' WindowName: 'khlramynvygkqdwkogdmjdaffyzlzusswrgtzmy'
- ClassName: 'fwgbwnkpbdpjvgcgazmrg' WindowName: 'kquwnljchfufpynwdbligob'
- ClassName: 'ofntsggmdvcdxqigmiptgjmyunvglilwe' WindowName: 'cnnvunvfxlxiykeyth'
- ClassName: 'oocynnrqjpztqglynikvuljymrtbbcjxagxrhe' WindowName: 'nspfylgnzhejndhsqefrvdb'
- ClassName: 'atlkcskprruljfraqbeicwhgrhnuhgnbfrwpyh' WindowName: 'qorhztvfftlggnycameahdtrbrzrgbsleyfg'
- ClassName: 'rtbajydrfsqbyupqbspo' WindowName: 'smgmvshokooalpebzavbhtonfy'
- ClassName: 'ivzfxaxznervphjbaaprnoaomlb' WindowName: 'dvifiryrljywdsbikawfabfoexyvp'
- ClassName: 'oltshfyqovafeill' WindowName: 'eyxmyrqpspkosaewqyavmaxyydbtpcwfpseamjx'
- ClassName: 'judnexxyygkjywfsupwmeyyrqfmfc' WindowName: 'jstgefzhtgccxakkixjnesmu'
- ClassName: 'rrxrblmasyrcoxupuilxweujcfihbm' WindowName: 'rmenrhoijkvwuidutczqohwti'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'spcnhwtwtdwelhit' WindowName: 'ykbirjrmxmbpekapprhtuymdit'
- ClassName: 'osokekdtlomdjnkrmauvxayhopetbrlxumgf' WindowName: 'klmhfmjaehkelsrhjozbhcwkkezewvgeocq'
- ClassName: 'lpqaodazcfbxvaovpcuupwakmmvx' WindowName: 'vybgphcxsluqfzowmvyibtddhodc'
- ClassName: 'bslmunafgclmctuhdvfjk' WindowName: 'lkaisjqjlyaaujjfqoietpzk'
- ClassName: 'tnycwmcxnylzuctzxtuwpxbdihj' WindowName: 'yakldginxgujypejxfksxmryqrgnq'
- ClassName: 'fonyluycuvkwclzffyqgbfepkslthyldx' WindowName: 'punsrwkgavfqdedhrftrotypxmztaudididluak'
- ClassName: 'gxxdlrrtjxnnflmjth' WindowName: 'nyjfmmuglmxccorkpghympjxvsm'
- ClassName: 'kbrstmlkishikigynhobvtwkbgpzaud' WindowName: 'zpndwkvebqklncgaeheoclrfvcbv'
