Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsc2.tmp\InetLoad.dll
- %TEMP%\nsc2.tmp\Math.dll
- %TEMP%\nsc2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsc2.tmp\Math.dll
- %TEMP%\nsc2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'rjcuunpxltzkbthpltouvodqayqguzqo' WindowName: 'whgovunplxnvwfg'
- ClassName: 'svrcbhinpkywymfeymmgkujopzdms' WindowName: 'wcomjqkwsydzunuezlsrxqp'
- ClassName: 'tjdavteaqzxltfilnkhsqhduvorgsjmwmuvpmn' WindowName: 'tqmziffmskapsaamhldwpvlnkkdbidsanx'
- ClassName: 'fftlnsheauqwykapvzrmbuml' WindowName: 'klmtmvjuuyfyrmtbyjpeexchsm'
- ClassName: 'mpaobvzruhfdjcpdolqnluwepwnpaz' WindowName: 'ztownsibizyqedjjklu'
- ClassName: 'wvthmjfpqgkeadkwigqxhcxsk' WindowName: 'cwnosfpnpmathimwsko'
- ClassName: 'crlgkshbmgpslbzjtx' WindowName: 'tiokhknpfqahjwnuxoi'
- ClassName: 'hcxglhwfuunvosfmaybawbkmjfwzhl' WindowName: 'hqztllmqjnwdscwafssre'
- ClassName: 'icnqpgzertryxnmyvokctmwlbbxr' WindowName: 'mxoizprztswwpcqa'
- ClassName: 'tubrcdpnnmrclfwesv' WindowName: 'kgllcrugmgjfqgqpo'
- ClassName: 'ulgangnrsvpzoftades' WindowName: 'lgbxfexnakbyozqicpslipauiphfk'
- ClassName: 'ugwjfllmrrwrmncgrovugajlvihofsk' WindowName: 'sdwwiwogifdguteybwmfczwarqwhxpktrauxmc'
- ClassName: 'dxvdttfhfsapbgmvtojma' WindowName: 'mjgdywyrnqyzfbucmneymctjsfj'
- ClassName: 'zwtjlmgvbqofvgtftikaxucwuxuhwxufdukekx' WindowName: 'othmztkryhftbleeauouco'
- ClassName: 'cutlstoxbzmcxxsxaq' WindowName: 'jxpteeddwejtqupwdsaerrxptprbzpmw'
- ClassName: 'bpcrclmtmlphptsr' WindowName: 'uprphazgqppebpakzrjqdleues'
- ClassName: 'cgwgyddahcdfcmnyyaduuleugfa' WindowName: 'frfygsvjihovuagndyeymbafehdcn'
- ClassName: 'lyfddfoppquttdbkceevudglfhlbiqeps' WindowName: 'zwstkacplxxwtbg'
- ClassName: 'lkvpifwhzbmnzoovjixa' WindowName: 'ncgmerwygdlwcutb'
- ClassName: 'lzckqjbvduyaevlalachxkhepytoowaibv' WindowName: 'xpjgyepmhrtjxcwtivdqdjeadc'
- ClassName: 'njomwxqfgspznrwan' WindowName: 'mzlczqezzvrbhjitjrpzml'
- ClassName: 'lcvhbpvtmyvbcdcjjrmeznzlctde' WindowName: 'lwrzfdyuvzokpqaynj'
- ClassName: 'seeblzvecyqdnvnuswsyazugcym' WindowName: 'lgtcxwjqwkrsetmlbfooggkqliznqneno'
- ClassName: 'vhiadcpkegzgrbrblssxlxvjsipw' WindowName: 'irlsxyznyrmluoli'
- ClassName: 'xdourulbiwqxwtemsarijmzizlyxsj' WindowName: 'dtkxrptklciefoaxceqggkpqztovufokpceoet'
- ClassName: 'vbycodkhbkerkdva' WindowName: 'eoeadcjlujfmlrwszsuwdh'
- ClassName: 'juaznojzluwjrgyrbldztfaopafqqehkewwytb' WindowName: 'qifluwrpzkxptzsmhsnznwmg'
- ClassName: 'iprjimlxanjxbxcaioudfyxyxh' WindowName: 'foacbkjnoamqnkxqfyyrtz'
- ClassName: 'ixfwsqsivkbecdaiyvfaynhjupmxffaomzf' WindowName: 'bopjssfmjdgdbufa'
- ClassName: 'aohcjydetizskpojqndnsspypnkixldnsdh' WindowName: 'ajwzpqbjbvgxjilvf'
- ClassName: 'pocvormpxxikddvsrpz' WindowName: 'jkwtzlqijxuaeexgoqxyvdwgmgwobkxsv'
- ClassName: 'vpfdewgijwzlvzzzfkgthziiiwirnudbsayptp' WindowName: 'hpvxszzkbprcrbralmosvrun'
- ClassName: 'hpefhhwukjlwupwxwzfsps' WindowName: 'tapnzbbhposykjliimwvzlmtkmxcbydaj'
- ClassName: 'tjgnlgfvdcbpvbkgywutnjvqdvrilthfhcrb' WindowName: 'okbdmfpyapxlvuzhrld'
- ClassName: 'sswnjmbiydbybpjnoczjjkjrbboxemvxsr' WindowName: 'ayalspvmmlxamyiiikoarjiikwrxcpuyznru'
- ClassName: 'vpjdvxwosjoectnklpjbkpoouze' WindowName: 'suhmexzsdeiyufrzbhsoironqkulkaepiczrbng'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ivagncjacotgyxhzatgdahhrbgoepjsfcqc' WindowName: 'otscwcffvvifhhwzuleozqkytsqrmwbdi'
