Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'whtakhthhumssrkdweuewvejglij' WindowName: 'khbhdyztoitedqhxnia'
- ClassName: 'odkwxkzkmxhjcsuz' WindowName: 'ivuvgilovqsnlbyohqvskulm'
- ClassName: 'tijggnigeaqnoajdhkem' WindowName: 'aqaeapblfznbkvqdqchvmlhsyleqnnrxqk'
- ClassName: 'exzxnnlnkmyqobmjqhzta' WindowName: 'mravdeglbybtugoilqqspop'
- ClassName: 'ssfzcvkyhnytovfjuwzzmljapj' WindowName: 'zygvirvsdfpyvll'
- ClassName: 'wgedgbwxwwasngjjyvi' WindowName: 'qpujlbmewtlbenmyacotvsmffgltlnh'
- ClassName: 'picfcufytasfdabzdxnzxjdmszkb' WindowName: 'jipqygcogmsqwcwpziesbruxjecbhfgllkqe'
- ClassName: 'pyzzdrcugmrievcwxdkesqvdfsufsdhfqaah' WindowName: 'rwwaqhbmgqctzygbhiuehwryybtcxhsscatzl'
- ClassName: 'vhaavveuczyixegsgfrbrui' WindowName: 'vbqvajihmvqduncudhbxnmlomdkcauxoiy'
- ClassName: 'cxhantyoleruryhvzhvfjgkhdrg' WindowName: 'fvsurvbufkfuknmbmhhbwzmewvdptgumepeminb'
- ClassName: 'jxfvnzdryswpamuxabwcnx' WindowName: 'lngvngsnvdkbvodzbcfsvozdja'
- ClassName: 'xsqreoluhtpxwny' WindowName: 'esidkzmlmxbrmbeniikrjvpihtrk'
- ClassName: 'mqnwlulggrbyipvorlgvjsvjibkrkahcxglzawr' WindowName: 'ijevaodbnzwlqoqufcjnsyqyhreunzdwfabtp'
- ClassName: 'tomzswumtzvnephzzxaffhnbe' WindowName: 'lxrqaxyhvjlapafuicvrojdvduuabkcufkzxvul'
- ClassName: 'inttwbxrvbimrtj' WindowName: 'mygvxwfsydkzizj'
- ClassName: 'uzvmxvaqhbhmlhpebpfdqymaowpxijymwxyqb' WindowName: 'unprijbpyzzhtuxr'
- ClassName: 'tufuiuxhtqofkmcc' WindowName: 'rkztbzfnkxadzjwdpdqvzkj'
- ClassName: 'xwhtohzmdasprenx' WindowName: 'iwqabvnlizheicagcn'
- ClassName: 'rrmbkpccpblvjrgajgnpitpigix' WindowName: 'zzpftxfsztwczqq'
- ClassName: 'ksvsagsdvagjtqqwdjqscua' WindowName: 'dyynnkejoabgsuswzurgthfynhespgc'
- ClassName: 'tpkedygfikhbsuwxigvsvlwtcyqblmir' WindowName: 'szqfirzeqxeesvrgmrtrdlvmhmkphqbalnoavyh'
- ClassName: 'omqskfhqnhysxlejdrpknpzcrolldcykpjp' WindowName: 'upsuikdybrwkgxyrkzjuscqucmljfbkgmgcwnd'
- ClassName: 'iltnuxrqzdkaqjoosaxkxmhmbuhpukyenomvt' WindowName: 'xjlbtiwymteeesfhnlhqmjcdalsbmkvgv'
- ClassName: 'kolastjagdttmdboxansttazcpl' WindowName: 'ioprloncaecwqrhqtfkwbqbhwiwqzcciq'
- ClassName: 'ueianotcbjcjqmjgkxov' WindowName: 'vxhostrmrmvwsswtfyovncgdrhzpeujolfpwy'
- ClassName: 'itowyljljoedjvnehyzowsdtcb' WindowName: 'fovuzsgggjsltdfjndtefeaduyfqbrpbggpdkio'
- ClassName: 'pmwcisoujobntzcytjawwpweugzbmulrtjihmvx' WindowName: 'pngxjcoitvddxwrtrzgqbulh'
- ClassName: 'xwzwdrbkioqwuilamyuyi' WindowName: 'odqgzkbtdwndtgbizamvntwk'
- ClassName: 'dqejbfhhdtokeyweemvweibhwgjch' WindowName: 'menalfojyfyzrkrdscaheg'
- ClassName: 'oskyaxloxrwssjmijpjvp' WindowName: 'rmsouwscchfblmiwfyhxbfkfrrsdphlbd'
- ClassName: 'fsqgsytunuxesmz' WindowName: 'xzbjfmftitxzjzsnjrucwnbupgcasncd'
- ClassName: 'todcuqcgfgwpgwvrof' WindowName: 'znsujyvnmkhdaqrszhammjjhltzonkkoayg'
- ClassName: 'oppkfjsyeyljbdrqla' WindowName: 'zlrbcgfduqtnpczzwdrmnmovrvhhtblzitpgl'
- ClassName: 'qzkptuisobdnhkfxlszogaplnulhgbqybnmm' WindowName: 'boglffkoyharpjzakbvjzfqzsmiezgdcuxdgsfz'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'vbmmjcieypznpfxpkpvxndpvpbna' WindowName: 'kdavgamwcxeabcmhlmeydxtnxam'
- ClassName: 'rodehogxysuwyesbiqvrwmp' WindowName: 'uzybzsegijoxgbkxbykwixkve'
- ClassName: 'xojpcllfzfbbenb' WindowName: 'ydkjkdixklprtxqph'
- ClassName: 'djciariezsntrmnsllwsizxkyvlkhagkyscgj' WindowName: 'zsuigmuldavpbvqjpl'
- ClassName: 'sasumcgqipskbhnhecwqoqktqbfv' WindowName: 'pfwneaymyhkdfjjuoacyobpv'
- ClassName: 'lrqlmbfuzdqodglfpwemjva' WindowName: 'dkuqcssmylwitytiezwhswdclcsdc'
- ClassName: 'wqiubgoakcignbjlect' WindowName: 'dkobdytumauhczgevcchwmrxaa'
- ClassName: 'ftcfjlhrnrgnjaoxqebzrhoawducxgdqgi' WindowName: 'siwvpatxhmmmekpakpqsdqlvezpdgjnzbujkjl'
