Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\InetLoad.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'zdznuabwlsfphzkik' WindowName: 'qkbpgpubijribfhilnmhlszy'
- ClassName: 'zzozqdlusykguqblqexnlewwvrgtypibdgurpq' WindowName: 'pezabhokyvoxjvxmwxymzzlzymwx'
- ClassName: 'ebjxcbkhagyfakvckoplyipbnwhcshkjsxj' WindowName: 'sgmnxccejgyltcyxlsahpztsf'
- ClassName: 'gzcrpxtlykhrjhrccntsngtpj' WindowName: 'ppqjhozvttmqfplnikforchfxz'
- ClassName: 'nhpgcmncrogedakswalodxmoysmcqlphaqaasvw' WindowName: 'joxwflireikfmgdvax'
- ClassName: 'ovguhxxzmeeitvubddviyrncpmdkmh' WindowName: 'bxmautgacagiqoslyareffxllouedbaxcqxltz'
- ClassName: 'tcfwwmslclpntjtvxywboebwxdwvvj' WindowName: 'wchliyaxfgvhmqlesnxebvhdczhojruwz'
- ClassName: 'eggyzmdejznhszfpbkagaxeczkgn' WindowName: 'rkaztcgcrbukmujewwbdgxbuf'
- ClassName: 'tupryahaiuvddjmapphahykxfznw' WindowName: 'bsbegdqbdqsojqmkyzlqyympymhlhwncsehmtyb'
- ClassName: 'znaxcjprfoyuqhjnatermanyuaxwhkyfzmu' WindowName: 'mxzhozejgawyvrllvljdtcewqwfbgkklqs'
- ClassName: 'ygyxlbufjxglvxzhjmzysqckixnzzwgi' WindowName: 'ffkvlsfxrfswllydkynjqywleejsd'
- ClassName: 'qnauofcesgsvyjrf' WindowName: 'ytleujgruanjhrjfyiepbt'
- ClassName: 'jlmpsgeazuppsve' WindowName: 'kcdfzomevpsctiiyixdguockiuyfei'
- ClassName: 'knklahxhgismzmlzacnpugvfaafbb' WindowName: 'dcizxzhgimjgquakblizjxxvelokhveu'
- ClassName: 'sxmaouvayjhtwrdigzcrfvvoupixmke' WindowName: 'oqszbgyroehqhxrxpzdidxpvrinwprdnw'
- ClassName: 'itdqrflpeazvaqpcoytrfieonjibjbialw' WindowName: 'joxejfgslhneqmhwtlqcoxeizbs'
- ClassName: 'eglmcjnyvcdllwsvhwwtawxlqaf' WindowName: 'rcitgcwedwvkoqnczoujpdlbhv'
- ClassName: 'webkutyyqawbzxo' WindowName: 'dfctoallfkscbnjbz'
- ClassName: 'nuwtlvmmfxqsijxjwqfdiye' WindowName: 'xnfjomnnhxbycwiadexijn'
- ClassName: 'tlvzvainmmrebyqrw' WindowName: 'zcczcywtdtuqvyrjprjkswcrnuqs'
- ClassName: 'pcklhjensutgcjfefswmrys' WindowName: 'btjksfgbjcgmzfytjmkjzbecnppzvxbz'
- ClassName: 'ipvjvjzfpfpwxcz' WindowName: 'cdfiwojabuerhku'
- ClassName: 'ngoaewsamcjjmrmmkabzyvbnlioqka' WindowName: 'bjzqvtrctofymuecgfsdgmnlkamqlfti'
- ClassName: 'jscafynffsldvtndxcxtsoocrdwprz' WindowName: 'qkkykqsszhwqrfcruepiois'
- ClassName: 'bakxlfgzexplnzpdtffrb' WindowName: 'cgynpnoisdcsucypxjwktfn'
- ClassName: 'rrgzswnyegmwxiurbixilpoyjbp' WindowName: 'xifkfgarcndmeuwueyadoqeovy'
- ClassName: 'qgfyyjmfhjivplirhysanuytozxehnco' WindowName: 'kyaxsrhbzkywsvmpt'
- ClassName: 'yurwysdjfualwockcunwuzmtaw' WindowName: 'owfjjwxhndcmonquthosskryklvoibcxqzt'
- ClassName: 'khtspykoessvngmtvpqsqyyvhchurx' WindowName: 'mpfdjqrhyitoavwljectxwzatnxaprk'
- ClassName: 'pfsyhctskeuzcslyaoktpewknkkqb' WindowName: 'uhdfxjondyawfgat'
- ClassName: 'swizhbuzxowudtapembghz' WindowName: 'fqxtiblertzokjxgybllnwyocgjnzhkx'
- ClassName: 'dnwaghsgkjnflhjjcbsfukdvykgnbovbnnpc' WindowName: 'ohthcqicjzvpitiig'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'qmxoafjnubhaozgbvwevwm' WindowName: 'ipomymqiersqqqoebwsw'
- ClassName: 'lkgmpjwfjlrabqlqikhcrztlow' WindowName: 'hrmvjyxbsozueaxxqtezagjf'
- ClassName: 'wyeeaiqyoukibztjqmxrgmhtj' WindowName: 'uwiedamhncmublftltf'
- ClassName: 'enqlnbggmcgrftzdwseuikbylnbglwnh' WindowName: 'qzmfuhfvfshkrtbssynhijoqtubwpjif'
- ClassName: 'vwtbfsxpzxsceszippllvfxxvsgpixkwdcm' WindowName: 'onjpavadrynhwntgol'
- ClassName: 'syxvbnhfclgxtpfjhdjuzvuahgakimkjtpor' WindowName: 'klymmppkxgdojidsfkjir'
- ClassName: 'xsmmdyuzgksmbramtfpuxa' WindowName: 'juweavvgnjjbmubtbfm'
- ClassName: 'lphclftfcynqsxfvswjciigxujxhyvysujw' WindowName: 'gvvcxsjfbgwyczqilsefyyftcodcuarwnl'
