Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsc2.tmp\InetLoad.dll
- %TEMP%\nsc2.tmp\Math.dll
- %TEMP%\nsc2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsc2.tmp\Math.dll
- %TEMP%\nsc2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'yzccaecjiwxwuegbyryyok' WindowName: 'wlppkbyefzabxrhvknejsnlpywmomqzfuxygyde'
- ClassName: 'qfocfmfeppnaecshlhlwgghiaqqjwvg' WindowName: 'lafddscduvrvzojrzujahpefygtlplsdeoibywf'
- ClassName: 'nnkzmzbnyohtdhpkiwyjnyfhfxeq' WindowName: 'enrhelskscroxaikmztjzuaf'
- ClassName: 'edqjjpgizbnxnvkzkqkzbgedqbugyhc' WindowName: 'vpilqszgddbzctoyezplpv'
- ClassName: 'xzcmstbhlfrsuyprlfxurthkiue' WindowName: 'urgaoudqdukmzzjszsafaiewwfaihrdsits'
- ClassName: 'kfazdigyccrvohdlkmzfrbhybjhgjlri' WindowName: 'btxaiqhykwvkiemgvc'
- ClassName: 'miuahhwyepqvmhi' WindowName: 'rdwzjfofiadpapssjiwnhll'
- ClassName: 'iuzsilhtvvqjzobkcubmcffiedxhsqkqmndj' WindowName: 'omxvcwdtrbakbowwiour'
- ClassName: 'tabiwklkhervhiibchasburchahzprpyeqndq' WindowName: 'spzmkmvcmbzrqkykjvete'
- ClassName: 'hioqlphivljowraafmrydpbziejivfdlolbsy' WindowName: 'rvdqxegiamvctzewvounghv'
- ClassName: 'jzgxxnckngsninjzxfqr' WindowName: 'rqepjpjcepuaprjdshzvspeaztopbih'
- ClassName: 'bxctoywtfupeczkkfxsy' WindowName: 'iawjbzxvtupnpqygj'
- ClassName: 'rssqxxnqlbuiszm' WindowName: 'tljalaojxfjmjjiecqobb'
- ClassName: 'uszpnefydapwlmqkyjlrueuxjuqdj' WindowName: 'lndrjdizvnohutnwtxuthkvalj'
- ClassName: 'qmoxlidtxlfsvqzvqicdwskopcgppegnxtghs' WindowName: 'soektzmhiciqeianxwcllodqmxzusfbuj'
- ClassName: 'raduutsskfiqkturatvmbbeadkppp' WindowName: 'pndswlecddbkczdjnskdinoybrhhbrcuelmmxox'
- ClassName: 'pwqhrldfemaybkbmkufclhyoh' WindowName: 'eogdauqgohiubzrkaaqjcyskowrt'
- ClassName: 'wqpjigdtbqknrsgxvjkqmbjvmghzzyr' WindowName: 'yxdcidghhqqglbmkmzgwlqmhvxlpqgsuax'
- ClassName: 'jzofvmidjykonij' WindowName: 'gxyghqaiztumpszsqwuzhfbes'
- ClassName: 'btxkrgkkxvzkthirttns' WindowName: 'kstnukjngalgkxvnkf'
- ClassName: 'ndyhopqpgjpuonifxcybocibkjtyrx' WindowName: 'tzgrmacpbfvlxcrnwziwegmiyiiitsq'
- ClassName: 'wajuyujjdnkeklalbzplbspiuuqbgey' WindowName: 'tesvxcnsqyzwgcoltfhkdcorojospwarq'
- ClassName: 'nzzajatjdjcavviqlnptkxkpyiuxuo' WindowName: 'eesbdsbhaqvskfhqocz'
- ClassName: 'ughbgllztuetlhkrunqkjoxqulrtisqccaaj' WindowName: 'qdhjtpnbtzkwlzyunsjhrwaclvkantk'
- ClassName: 'wvektfoggtitfofvao' WindowName: 'xxbezkxiqrcncqgxpdqmcwdmofggwrtbnwxh'
- ClassName: 'msdvltodpxcyocgcyekfdzy' WindowName: 'iwpilxxhyypfawj'
- ClassName: 'jyxbqmgkzhlaibd' WindowName: 'dstgroxuitgrkeztdvgpnfksdikrtohimesv'
- ClassName: 'phocvdejqmlqtphkwyaxpmyqrtwkwkjsmffmxte' WindowName: 'hvbsbjwkuxqzjampmoawl'
- ClassName: 'mkrzvthyugvliryyvdxfsazk' WindowName: 'komourlqsblbqpriqnsnawkcon'
- ClassName: 'nbckdoohouarxbs' WindowName: 'ktkjmxbyepmzlzkbekl'
- ClassName: 'hvtnoyqfnusetncorjpwdxuwcx' WindowName: 'fjxrewzgigvhysivyqapqqaaqdoveuwhmynkke'
- ClassName: 'nbifeuajhfwckpoqpunhsjxfagtmjxlagmcj' WindowName: 'syvtsuuakzjuodekyphaggvb'
- ClassName: 'wznqdvkaftdcfndgjapxrcfivxrktwcwyhqvnl' WindowName: 'yjpwqinozhyebttlbxjpyufajppuxztn'
- ClassName: 'ullwtpxwzigdeynkfuosyrevanaf' WindowName: 'kidizasvnfgspycarmtkfyihk'
- ClassName: 'qvgapperrlgfmbqgnyixqjltivewwxwxcula' WindowName: 'gojzklxxkgmwulcczpjsu'
- ClassName: 'feckuciaulsooybexdcvwit' WindowName: 'guyifisvnowtwqzrv'
- ClassName: 'ulqvwnwpmthtktgwahwmce' WindowName: 'yorckgvycdiqiexn'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
