Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\InetLoad.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'uqtodtzbjffvqeyxs' WindowName: 'uwnjkpgzyimywuzmrwaw'
- ClassName: 'zgkuavukjobqwohooadw' WindowName: 'qvaxgxtyibpomdjrpokhelzaz'
- ClassName: 'rwnayeffozaaqbabgsfnz' WindowName: 'kbbttoosxsrwozvg'
- ClassName: 'bmnjdwlbrfvhifzwetfcdr' WindowName: 'ejbyffhmyzqcidzviygwaxidiaodp'
- ClassName: 'rrfkhvepwlffzchuekeomqyouazwgxw' WindowName: 'ekdsjmkcoqazkya'
- ClassName: 'qjldcageufcxdmmojmbgcjjc' WindowName: 'pbtjwwcfdurlmvlhxlzml'
- ClassName: 'ttbguxerhczeatojtgypzfnwfymcni' WindowName: 'boeaxnzotmsafuuredbqvzfbnnd'
- ClassName: 'prekrminvruqavqzuifypq' WindowName: 'jywetmofjwacrkomglugqfppvpoboytiwd'
- ClassName: 'wfjlgdtnmcqwvjssbfntawyvkqdwifnkp' WindowName: 'proiauwdidpcmqephwyphxwzcxdutlxe'
- ClassName: 'ekgqculfdmkzpvlopfsnwvad' WindowName: 'ajoylnzxkxqiqfolfzbviigsejyydio'
- ClassName: 'dwnesuhdwxseqfzspyaep' WindowName: 'wwekciopvrrtndozbgniwezatvn'
- ClassName: 'mnyiiuwxwllismn' WindowName: 'fveveqwywhlzgnaqtvslpfmlfnyijufhui'
- ClassName: 'gpsrnbfuyagtxvnsusmaknaxivgecneqyld' WindowName: 'bbjoerecnjhnidnddd'
- ClassName: 'oanhyjunuwwbkwmcawfpy' WindowName: 'wlseojhjnmmrzljanmkfobdpntiwij'
- ClassName: 'rlffjenhghqpqkzjv' WindowName: 'fgtwjgresuqzvcxeirow'
- ClassName: 'npgxpptlwjthuxui' WindowName: 'mfwsufoszovokqpugqtttkaqveobceoymp'
- ClassName: 'jgtymqepwgjnhxlcdkemax' WindowName: 'ucxluuqprpgbpanfmlzlxjxqqqxrdkvz'
- ClassName: 'cpuiiulqhdwtmrvfswgfwt' WindowName: 'fblryeowktlzcjsdmgpiafkxeet'
- ClassName: 'rspsipnsbnsqzmwsdthfcmkyphfyysgolz' WindowName: 'bcvliwlhjhsfobxejwhucwtymiauia'
- ClassName: 'sxodixvqtnapmjoskwghfelt' WindowName: 'icoqcrxjfdsefrcooujvx'
- ClassName: 'vzzxxcvcsqvzuysuipppyhdpjqivqoygaieds' WindowName: 'luzpcljwywggyphivb'
- ClassName: 'xdroufbutlrihoafpwoa' WindowName: 'mgohjjqxzemzpwzaaoxrvphrrxkdmsitvobg'
- ClassName: 'htyepwoipfuzojoevwhobdpk' WindowName: 'atgpvfezvsjmrodradgx'
- ClassName: 'jetymajcevuyirdtdtkhmjextatalkptkkmczq' WindowName: 'ldxxobydpfvykvrymguzxffsontnm'
- ClassName: 'gbigmumsxoazyqgy' WindowName: 'vbinhpcacrmfjbqlhicyy'
- ClassName: 'udwpxyxvhumiemuqgaryvoddlxzjb' WindowName: 'ffaznomecqpqcqkcuhsxtguisvgjzmnnyp'
- ClassName: 'plbcxczcorjyeemefyytj' WindowName: 'miuqvtlotdetkrmjqhrd'
- ClassName: 'tgvbtcbrlsurqkdqobfypylsxalwd' WindowName: 'fwwvopjvboqrqyypxsllseljrogdc'
- ClassName: 'gspfcbwiilfxagdvip' WindowName: 'uprdkmutmjmfczdowzkhyprpaccghgpghcbuqd'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'fltdbpihmdheopojnntaencymczjhjkvc' WindowName: 'nzsmoyhcnhmevkawkanpjrjqkbklu'
- ClassName: 'tjayelmakwmbqmjryyuwfmdekci' WindowName: 'bczroapywdoqcvilrkduxk'
- ClassName: 'glrpxnyqzntcqorltbylophrfzgelyoehjbzdk' WindowName: 'ukxcztlgrslfefeqmucii'
- ClassName: 'hzjntywgqmtrnlfjdjeskost' WindowName: 'xqzraehcgmxbzprippugwhtsvtasipqcqnxxb'
- ClassName: 'obqjbghxbpemiayygmtivkmmhijacplbgrmbqc' WindowName: 'fkuvrbmmljzpswnhv'
