Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\InetLoad.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xcgjghuyotfszhzlrrzme' WindowName: 'fisoxzbwmectvurcbdlbwdtiqbhmjrx'
- ClassName: 'irtjhiwoofphgpsbmkzvijnbbykthkkil' WindowName: 'jprgeleucyveotikqhuktdxstali'
- ClassName: 'wtjxrmgiupzsptdmrmfkomllajzhsbpxtym' WindowName: 'udomvumzvsrqvresqystlj'
- ClassName: 'fezzftgncwttzjtqkxim' WindowName: 'fbkagcunivklfxrqkhpmzdre'
- ClassName: 'ysoppnojqesszejsetrzztnitiqneszutywhiv' WindowName: 'sesbnotfgvaramjdnyzfeixm'
- ClassName: 'jxkzrilgtpyqlsiqpknyjhvpxt' WindowName: 'gffreghhalbduhdaxcniuf'
- ClassName: 'zrscfgzzukasgxxbosumovz' WindowName: 'estjthzrglmdkynbsnoclmxvmgdkyanwxslj'
- ClassName: 'zmopzpjkkvhpjkepcsadegrrnc' WindowName: 'kwcczbdytocowsdy'
- ClassName: 'dwmwbktwvgusuabvzixiahnzdpakidetwkxkgkc' WindowName: 'mhokubdnthgkwftqgja'
- ClassName: 'fwiwfgtvoxkxeywmowbfpvraozlptjg' WindowName: 'fjcwdwlyakgecjrlaqarshhyrrbqpdnwxaus'
- ClassName: 'moysgxdilqeojklpekljqdbzykx' WindowName: 'fotteffoqpsimkqaljtqpfjrarivi'
- ClassName: 'qibhrztkeadfdpckerlvqbbexsr' WindowName: 'xkeipetpbpxqcxjrulkvfl'
- ClassName: 'haxesowxkyugsqfjqrspqqcajixwvuaoocg' WindowName: 'nwkvpizmwygsyhuorfzupnwp'
- ClassName: 'dlnnzsmmjrzlkqcytl' WindowName: 'pjkpbxkzrmezimgteuimhiluvsgatgg'
- ClassName: 'ebwkdeffddyjxqnkvaitnh' WindowName: 'nkvubnfndvlvnhegwwxqeslu'
- ClassName: 'iobldfqssccfakimowyeigqixmsiaygpe' WindowName: 'kkqeyqbjyzhgoyro'
- ClassName: 'hkhdeuwpbkwzwlcniogfhfzvgyasih' WindowName: 'vnxxckxqberhgotkuoiscxilgspjikkpnwbfd'
- ClassName: 'cvdgdhnzbgzaaxfxiyihy' WindowName: 'yebycwwcahgczzmzmqocrxegqnlpahrigjnk'
- ClassName: 'nyqxkqydelhcollfhkpmrzuuthoukmsuubv' WindowName: 'hetsccerrxxnghrckancdxymkemjfypkce'
- ClassName: 'ygvgzbbcnpmlitbsvqlkkfd' WindowName: 'pjpgkcshqzrqxhcrdrvmbsaodukdxjhcy'
- ClassName: 'ddyizsjjzyaetxcjxpdmilvtyuit' WindowName: 'qlgldpekpodjxrsfegkwkemdvjjzaipcb'
- ClassName: 'ebszkoazxayohxltteflitdznjsxngbr' WindowName: 'izhrwlksecfsaokipfpjzadzggywsv'
- ClassName: 'ovozcdelwlpahoubzi' WindowName: 'npixvyttljulvwzjbpebbjkxlclcxqczyx'
- ClassName: 'xfhmblbzeylaxxrywknvukowwyftlyvuvjbinh' WindowName: 'xbqinkcpnmjpyonwdcql'
- ClassName: 'wflpcxnmojwrjvjhrirhfiio' WindowName: 'gwhxyctkxulhjszchtvpwchz'
- ClassName: 'tedhjqibwipgfifgz' WindowName: 'lrmeorvpuaycfanlfbptvxjlsnx'
- ClassName: 'iozgufhcwnhrjcdetpykcnym' WindowName: 'wmbhvhhwopisusiidtsjyejzgxbamkmt'
- ClassName: 'xjihmrzzpyharpzyfriimnamekcu' WindowName: 'yhsjozuwinxopsoju'
- ClassName: 'xbsfjsjeoppqrsdaqzubfgiljikepzxphrowf' WindowName: 'rurbhnuedvhgnhjwme'
- ClassName: 'mploylmluqwfiwlvgxvfqrmpzhpw' WindowName: 'jnajwbqdhfjgkjaxitstmni'
- ClassName: 'grjwpjwcqkkjlatntxloe' WindowName: 'eobnlovlzszzlhsoahrucn'
- ClassName: 'jgmjzsmixvyrblpnnschedbpiybz' WindowName: 'xtepybvbnbhydxsbqkgkm'
- ClassName: 'tvchgmzbggdawytzwwwcwhplxsyztnze' WindowName: 'ogvworunuefmbvgi'
- ClassName: 'lpzcwdaqwdcnrxlyyuxufuwcjysdyvwy' WindowName: 'kceefnqyhzbjviccviyo'
- ClassName: 'daftknfvoihfzvbdnkggilsclbneuqo' WindowName: 'yvhwddsvtpjvwsutlfmu'
- ClassName: 'usafszcyfhisppffvnxoegfkavciiclajja' WindowName: 'ubigmafracotnuyzq'
- ClassName: 'eoatvjrprgktuoazs' WindowName: 'cjohqppvvpajcrge'
- ClassName: 'obdglqsyddduedrbdsdptfruyryodolpkddru' WindowName: 'zrmglrwcgzrrlsxjufdnigpnctxuqufd'
- ClassName: 'lxlqjnlcqibzttyidprzfsmlwecbwxnswvnrcbu' WindowName: 'jeazvmtfrzitoficxcwvk'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ottnycylmobyxocromofpckecpytvdgui' WindowName: 'zqnphzyalnfviqkdrkupzifxpacs'
