Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\InetLoad.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'zhpgnkjbfktakyvdphwmymlj' WindowName: 'uvpkxdlcctyapvkubwsnrrmvjmcbsnocroh'
- ClassName: 'naqaqlonclyihivoddrhkpuzrgdozlhne' WindowName: 'hsyybraiymodyqjexjbjirguustqyaar'
- ClassName: 'mwdvmkauomatcvedlioddhxmaathjvwjqmqp' WindowName: 'whfshekdmwfeulguncvm'
- ClassName: 'otymhrowocffenqufzpieuhfpofvjadllm' WindowName: 'pvhbjoyuutvpsieawf'
- ClassName: 'ypgsbhyagqlzgpdqqrrbgqqkzhydzzfqfdzv' WindowName: 'eypwzmuymmoyxkfytzorgmw'
- ClassName: 'qtrbcxldwemyxntg' WindowName: 'lxqbbwyxqtqgnhzatkftpzonfexkht'
- ClassName: 'ouybvzlpudvvmcrxiguupubhcbnrwhhepf' WindowName: 'szfosirosysnxkknikhsedpexcuxzuagagumfh'
- ClassName: 'zvdkhufilicqouuoaqqyrlmgab' WindowName: 'wdhdxxzlzmmysniwxtggzaqdrvxxczelyrbbs'
- ClassName: 'ecicpkmjsuptxwofdjuvnlcibyiwwqhe' WindowName: 'bdlgobvzgbjeurmy'
- ClassName: 'nvsshtucginguinykcsnmsjtp' WindowName: 'fffmszcqovfunagtfoac'
- ClassName: 'cgctcfsdjvcafuqaxkrzubyiapboaljmpt' WindowName: 'ffxnfqfvrdatwiuoegzyvorgqiaqlhfxtof'
- ClassName: 'qphmtlaahphtwgogovngtwyskpinkkkb' WindowName: 'kjifhelivnhleuted'
- ClassName: 'ecbkicfaosqsvbxvkqwtddqchvzr' WindowName: 'qw<Служебное имя>cuscvkbptbtngdm'
- ClassName: 'bnnalrdlzychrbwdqduat' WindowName: 'gtaplkvawyrfjuburzmokdvntbri'
- ClassName: 'lfjtoxtymqeiupvmzxiyktzoyfoglbqfjjjdety' WindowName: 'jddxfruwntbwmvyxjvheqcajplydzjum'
- ClassName: 'fcemxvqnmfyyblfsouuakmtatp' WindowName: 'tfhzuuddfkjkjagbraqxhfoxeguyd'
- ClassName: 'rnhoxnaiqyularovlnpotfq' WindowName: 'uzunuoizqmobaijtsyrp'
- ClassName: 'xaqgyajhlwrphlyvqn' WindowName: 'uyavweyvexcdqjvpfhhvwfrqhnwfhumklhl'
- ClassName: 'twgajldhbccsldjomwcyosijvxiekcsugpmp' WindowName: 'lxfxmbfskyuoriwcqzpwifhqizchixhjxvnk'
- ClassName: 'jfojqketjszypajfwjhmxdsggnjntuvwwtcmg' WindowName: 'xnrsvtbppacwmpctabitp'
- ClassName: 'wmcjqjtjfkagwohhmnsruwetonhthiijyfixv' WindowName: 'qnsmqedyxmtciutujy'
- ClassName: 'nopxffuqnwzbyhmccnyfugclfv' WindowName: 'okuoehcxacygnrx'
- ClassName: 'kccjaxkpjhcvgdndlleuigeqlgpyeqeyq' WindowName: 'ysxprbnpjqvuiyokwnqrosgeuopoey'
- ClassName: 'cewgrbjsxrojssmdpyeiiyescxgclnuhqkbdobn' WindowName: 'biofhkeexhjtpiesplbndfpxbmybxpdoh'
- ClassName: 'zhrvodjxctihjkksjwpeylqhmpnsqvfiqafyfp' WindowName: 'sbgkxjqcemvrvqdmykuugjgusdh'
- ClassName: 'vddbwenmwnhumvfmnyjrkvz' WindowName: 'fttryfzhfwygnqhkdidpdthrw'
- ClassName: 'kbwssslawzgjxlshhyuwsygsgyrcgxjewwowovi' WindowName: 'lvfoibfiopwrgfwjjdppmglnhdfmmyclxohsxh'
- ClassName: 'eadohhrqmznoabjxdglyrdjbu' WindowName: 'vpybfbjpgzmknabprka'
- ClassName: 'ritzahyunguenndrqglt' WindowName: 'lbbebkbmcezstbihypdltkqcn'
- ClassName: 'xoibtofgfcfssnoleqdtatjlwcubf' WindowName: 'yezxqkrkorndreceoybsf'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'xbhqmvrabcsffnnchhuxdozbhkoffhsekvrz' WindowName: 'xwxfpfnxzbegvqn'
- ClassName: 'tmrmtqqiuzlngqllwdxh' WindowName: 'rfpwungdpxcfavrwdybkkyh'
- ClassName: 'iswizvucobmxeilfqanelvarglnk' WindowName: 'ojgwpvkgppgiowzsbatjraccdxwbqzc'
- ClassName: 'ewcbgsnyqwevmcsdvthlzftqsakwcpa' WindowName: 'jqpnjhvtqiphyxivuotqtqduxnoqbznpupvkxhv'
- ClassName: 'xzdlfavjssodvpnqsnym' WindowName: 'igsmvmclsuzcegzkbrhuwpegtguov'
- ClassName: 'mtkuhnuweuhhslaghqa' WindowName: 'cyuwomgiibarefdcgudfbjpacqmkllqdes'
- ClassName: 'bziouudfzlkwdpdplkfvzznloknkkhoty' WindowName: 'zfbqoehmikgqtrpsjufnshyymjimiitxmfomiv'
- ClassName: 'vrrrlfsepsjjtkcdmrbbg' WindowName: 'llehdsqxsnonuyuzxzikiwtxckh'
- ClassName: 'rgdsbhoccgrrmbvlgcymfxbwgnrxxyspyuktcel' WindowName: 'phyffpdysxqhdleyzhyrowpffrvwnrmjgx'
