Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\InetLoad.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'qqxdtfcedtnkqakdgabtsuzwarhxpihzjbko' WindowName: 'nczwejpjovrcorxygcfnvohorjdzz'
- ClassName: 'rhetaglocafrkryowgbkvrgkxjudajcfp' WindowName: 'gkmxxhrjnuykggxefumltofncih'
- ClassName: 'ppjmrsyelmhcbmutfaokdhkmevuxisep' WindowName: 'hvkweveudvjxhkgvrgzmkmvukhnlduytkouxu'
- ClassName: 'ggvzfijvhvhtwkpvpwjppebxx' WindowName: 'xkgltkvrfooxyijbyqzkbhhynctrlayqvzfj'
- ClassName: 'jnxjhqqbjkwslhdquidqlbhhehrywwupcprts' WindowName: 'kyofdafgwvwpebvddwpfevzcujail'
- ClassName: 'clpxfhkgxcoydyqwmplckvcntvddzzvicvcjyl' WindowName: 'sjqwidtwgrjhghmehxfwtarnejqlprvdatodkb'
- ClassName: 'gnpgkoefehjgxqtmpowqzblafbphkbhypyrif' WindowName: 'jjmtuusjxtocczlgdknmlnpswufgzvweghnsfxl'
- ClassName: 'ivkgbpsveqyatwnriyq' WindowName: 'yjconunwdwduixyllfxfrvoblxwujmpklmrora'
- ClassName: 'mxdxqikjcxtfbfmnxqruuhhrxldtrlhqhqessly' WindowName: 'vysfzlbnzqdrpyevbpnruue'
- ClassName: 'pnkanlbnenocuywgeasfwjxfsuc' WindowName: 'htwqaoagxtfgnvgtuvrrr'
- ClassName: 'tumdxxlhjjbwqbsxygrooyzdngvfnvavmrokagh' WindowName: 'qfzwafklrxtttcleigzarhkgbbwbg'
- ClassName: 'dzghuzaltpjlvqvobvf' WindowName: 'ckazgmgzjysepooyd'
- ClassName: 'govloyasfbpenalyowahyoadoqbdzujo' WindowName: 'kmrwbroocqjffwbuhwvzhovxnegwvlq'
- ClassName: 'xkrlqjtnpgzbydbead' WindowName: 'kijpsynecczmyaorxypwmmxs'
- ClassName: 'rbbfhdoarkogdxvjflrocexxyiqwkhvqcjni' WindowName: 'jqyohkwspwtejiuwjjyqvxkmwiuhayvgczgrd'
- ClassName: 'wuwortjormibwwwdfhhqbtiwtawdiisuptlxkco' WindowName: 'svujtyhsmugskbfilyaid'
- ClassName: 'rwwqvmmmilrkghclhytcdwkteutlm' WindowName: 'czjuzmepqcbhosirlhxldgenwzbakwsnlig'
- ClassName: 'xxgtcjuljhafxxueiov' WindowName: 'bzruooqavbmldktkufepjfcc'
- ClassName: 'rlthuccjclksydedigntpzypquhdnd' WindowName: 'fisubliikuygdatgxoxyhtvzyakcw'
- ClassName: 'xnvrmffnnsckfugdxnbxmwilmfbj' WindowName: 'zuqtbgbsdcjjgbqwkgsntmytturlmcwt'
- ClassName: 'phyfduzfousastxlcxpzpfduuhker' WindowName: 'yjyerldahgsbtxoxycgrcrjqkpfybimjxkq'
- ClassName: 'kvdkklsjksvrvsikejspmjpo' WindowName: 'ncfiwkfmlievvyoxeproiwjusasakulrhbgpq'
- ClassName: 'grbobpvgpukvgfpbvwvjdovzsblzw' WindowName: 'onhvjffvpfsgtgfidbhflymqesmiwdbogpzs'
- ClassName: 'fuqcvculhbxwpqhozaxtijymrniewlafr' WindowName: 'ptbgjefqaoejdutoxmhqicaorixwkviperkjio'
- ClassName: 'xssmhyhcbksrforpqtdwwhjocbnvaytgbobqx' WindowName: 'zzvqrejnknqzheswnerftqmcugb'
- ClassName: 'yqtpnvhcqsmcsbghgfnucugwlpufooqhnqamo' WindowName: 'ihrwrhaklkldstaasduakymctmyumt'
- ClassName: 'vmcorrgecziafodiwddncykmcpfnmg' WindowName: 'uitryyrtsufjthhuoksmrcyyljvjuc'
- ClassName: 'jmgughcdjpnfcgokydwczzou' WindowName: 'dvnselwqxctunvozplike'
- ClassName: 'aesywydcsfuiszkmxdxubupzgrujvbq' WindowName: 'ghocoeywcppqbhxgkkobjrjwsbsqvxtsc'
- ClassName: 'mrnvxnwpyjwwhejtabqqpugvzuqhsvnmbsca' WindowName: 'clixdzbakxnlgnwqwkwdxsqehnfetta'
- ClassName: 'ajoopiwtslaocvhrao' WindowName: 'nfxhckfrvhugxujefyxgmfbpzrquixliot'
- ClassName: 'vdgjuhslzkvhllvvshjhxjdlzidzdxvbadkjb' WindowName: 'iwdvcislgmuqubgkxzwnav'
- ClassName: 'ygjqgmydldqdxkwvfzx' WindowName: 'joeudskmvlsywpslxpchjrgzmqumnehkjsfhj'
- ClassName: 'jfcuwjaqvldaosrrglhvafvbkld' WindowName: 'tdnljzxckjdkgccgdtgomzcuhznxowwuyhojmdm'
- ClassName: 'xdnpmezovzwrpfgtzjzq' WindowName: 'lnigrlvxuqnouypwvb'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'iouhcyiotgzuhcoxrt' WindowName: 'qlqpbkvwjsxdqzvzrkfshkfdk'
- ClassName: 'grqhgbukhezyhpkulxkgxhnqhdgupvmudjb' WindowName: 'mqirfncpetvwpiwgwjrv'
- ClassName: 'yzuberffjwceeuqjqeywzlnesmmuo' WindowName: 'ndhdpcjqoxdlptcnwlar'
- ClassName: 'bueyrlysevkiumt' WindowName: 'fjkpxwntbuvocvpujwrfuczafuaqp'
- ClassName: 'yaymhjemzpkkeadcsptxwfeqqlvjon' WindowName: 'hiqugzwgjbioyywohylcdbafemzajjongdpt'
- ClassName: 'exmuygklwapxnoalwzipygdmxbnvassztqmoq' WindowName: 'vqcuinfywiofbtktouwxprarv'
- ClassName: 'eakripdqtiqsyygrchgshpogpmgfmrvdt' WindowName: 'ohxfjyqbobajcrcodhmwxizrz'
- ClassName: 'tjybkwtcptudsxonnhyokzzulv' WindowName: 'ghopfvuznuwobfimriecgekyscsffumlbswzlep'
