Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsf2.tmp\InetLoad.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'odhrspdmgfucvumupgxannxlpvkiwfopooxuy' WindowName: 'xymngrpkwtcrjppnbomwvsncbxvbvazirm'
- ClassName: 'bbjisbpnsskhtnvxqagqvld' WindowName: 'urpkbmyhrwuvblwfbisbktchokve'
- ClassName: 'rovkdbffbqvpvoedutk' WindowName: 'eagxhyomfndsruklp'
- ClassName: 'gvgadfksipoyisrvzpimolijhxpdmpgscn' WindowName: 'lfzjnseqolscxcvvmbtuwanjxsym'
- ClassName: 'jznczdtqahckbutvdsgynbzdi' WindowName: 'sfvvzxpasebthrxtpgorkanxnemer'
- ClassName: 'zzvdfplaopoecah' WindowName: 'mrcgzpwibcuvejhizj'
- ClassName: 'ogzwjzhbddwzcbtcevwbxoqeyjvycpomlzl' WindowName: 'cqggggsqpkgeyobnpbgjgaqpcsw'
- ClassName: 'dpdtatqomplnyhquoerjvijydmd' WindowName: 'fadfsovfbfwwxwspowhsxq'
- ClassName: 'zbcvfmfsnrzknagrfzduyghgyvhw' WindowName: 'duiqxrhsphwnngbjjlqnxpyexeyy'
- ClassName: 'lfalyzawkvscrhogizo' WindowName: 'vqpulgdfbczvjbusswhrftamerphmzpenvpgy'
- ClassName: 'dpryvccrrfzerfneufolnjz' WindowName: 'vaxdperqnozmrgsmkneqadabyggrrlffv'
- ClassName: 'azobiqpfuqizicuztcqfssbjyuf' WindowName: 'xwfbulaenaqkwlfqutkopxrxgystiwyrcmxux'
- ClassName: 'zlekvttjjcrhiawtqqcwdoygujwrrwta' WindowName: 'jwwooxrdfetocitdgysopfqnjwtvqggc'
- ClassName: 'vtudaoqzwaljmtkgykzouvvewaltsciuaq' WindowName: 'brrilqzcidqjcvjaxvikjrbslxspbscsmr'
- ClassName: 'ctgfgutczgtsjmtggufx' WindowName: 'dcaisaypfwyhqolfdvdubcmomzdcooirn'
- ClassName: 'ueyxmygejoewnycphzjujrxedwbxvvweim' WindowName: 'ohmvllelfbqlitfeacrwpktdlsnqdacwpfnn'
- ClassName: 'upwismehxatrppyufnnpmykcvnfm' WindowName: 'lzzbzggfxrchjzvugqvxu'
- ClassName: 'kkevwbpsheutdbfdbq' WindowName: 'jtwevaxwweodmxmarvukpn'
- ClassName: 'rhaggbzogampevhqgsgmkewuvotvaakqw' WindowName: 'jhtnhfqbepswttncf'
- ClassName: 'remmfndimttifzrtdqzk' WindowName: 'vhkzzjvgvakrtjplbganwrbg'
- ClassName: 'dgyrmuiixokvbxaixuiimcndxpewjgbinefu' WindowName: 'ghdtsqccncaqwkkizpzhnbuatokkgbjiixm'
- ClassName: 'qzqyvrnxqhbydkmkzm' WindowName: 'mqdjqmbtfdgiophdthokdrdophfbhjbzijjj'
- ClassName: 'vldjnqadavbcabpaeqelourggqcfz' WindowName: 'uqdfbegsfgtqgptukhaxuqqa'
- ClassName: 'ckgvqdiladblffewlsebxjizck' WindowName: 'weazruzxiopqcdokpiqfposzf'
- ClassName: 'upoydeyrjritsjswc' WindowName: 'rqxuxfsoaxukumhpcawnkuotuqrun'
- ClassName: 'fkbcrxlekkambjvokdzs' WindowName: 'gtrxypdtkitgjtxlpz'
- ClassName: 'tjgfgnjxjmaatvrixivxytcfvqcoxzetcqac' WindowName: 'pkxxlsrlmnmhuqla'
- ClassName: 'ptllowvtqhhdkxivruvphzkxurmiehmzad' WindowName: 'ynhvpppzarpmvhfoztxvdxckndsveqq'
- ClassName: 'bjxbyszfnlcganyzmtsqcjejvr' WindowName: 'wrzpkhjtlqggtns'
- ClassName: 'nsodcyflrmdxnflrvbsp' WindowName: 'gnmxcuudrfmvwcwfiu'
- ClassName: 'hvhadwxstrfmfmkcmayzdbjkevnfyz' WindowName: 'kkwiduursyxeglfpmjadttdm'
- ClassName: 'licwutnpoobcgyrr' WindowName: 'djnqjjxshepyqzmjlokaabgpierzukvbfoai'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'wjxfyszfwzgetjdyuyibcvylxdajrxj' WindowName: 'wqpkkjjzogaaqsnpi'
- ClassName: 'igaadvxtfewynvmebi' WindowName: 'efhajmgavszmpvqvilduwltrbyezuhrz'
- ClassName: 'djgdvfjiqmbxbsim' WindowName: 'yzrkyljqveveavunnaszblkxedczjrlgott'
- ClassName: 'vlqahnszlxlsixgnkfljesmx' WindowName: 'htjdspddtegwygzunnddgtbcagfehuqekbpk'
- ClassName: 'ffqynembehylbdagotscslzltiwhcdoz' WindowName: 'dtwbonufdvurfsfamqomsoszzcpg'
