Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\InetLoad.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dryduzofscewiywerbxytpsmvbigvnpgt' WindowName: 'jgegsulcsblfjxmmsmdjjkvppluqdzdunvwfkj'
- ClassName: 'wjqfzaavgwyktaqhuilhcwzvktsbj' WindowName: 'jfpucvagvtgggjpmilshtxvfgi'
- ClassName: 'shvgcphjfzkckaaebdadnmarg' WindowName: 'nshjpwsqjpehrrifgnciihotnmpfvozut'
- ClassName: 'wkdoccbideysfnftujzfshnkb' WindowName: 'tfnagabxznfbfupsybgzbfpk'
- ClassName: 'cdtjojzwrucmfpahqqjdjauo' WindowName: 'xnfxswrbdhzppzdtcoxkiqeywcuolobege'
- ClassName: 'ewwaoqjfwacmcftulj' WindowName: 'xckwinleayksweqwnbfwatwjjrvonazykqdt'
- ClassName: 'ajlbwjwmajsrnecjjzsr' WindowName: 'xwfjxppmamoyakazhejnlonaobluylemaqcstuc'
- ClassName: 'vsdnjwsqwqamlufpxghmkiubqaqzwiehhijlpe' WindowName: 'gfbempqpxiddoesxzbexpvpsjgffpnrrfgmbin'
- ClassName: 'nygcwszswvnehrpgioxuyyeuslhteahccdnnf' WindowName: 'onzoucdeawhbuzdmxcuuztpauec'
- ClassName: 'ejnttbtebmbtlmpdnriaeitrtaa' WindowName: 'qjqdmycxkelqomklizhklgjwhcdadfr'
- ClassName: 'gegltpifbxiboecoparnsbyzqvtktxphdrfj' WindowName: 'faunlomdgygzcvlpvfffgimz'
- ClassName: 'csdvmuwicsnhjlkpbuvaqqfujkbbedmrzski' WindowName: 'pnrlkiopawgleejbuhiucfxtwbkex'
- ClassName: 'madoxphcithcbaoxqerfck' WindowName: 'mbqsclxfgbhfvfgpf'
- ClassName: 'pewpvvmhujhscujchbpvd' WindowName: 'olvbsnxwmjrfqxvfveamuhi'
- ClassName: 'bocjfofbcyjpeymdqcrfrhamnzrpkikktjmflyp' WindowName: 'xrsmfgaekxyyjtqpdluasewfzjjtmy'
- ClassName: 'ehdxqbyosuacpdyidtruiwnbo' WindowName: 'kffkknndofyprvlfx'
- ClassName: 'xayqoznqkpgbmaep' WindowName: 'hgxwbbpfhyquacjnrlrpkawydqyxjke'
- ClassName: 'jtilpnfbmeixdnxdq' WindowName: 'kgkqgifyhlqhzesrowmyqcsoppklwjpdpwkgf'
- ClassName: 'djhlwcphwnsvnlnqotnsczubquxshsg' WindowName: 'xdqjjbdflntkoewzjoxar'
- ClassName: 'edcogvkljnqwzknlufcixrfkzjyrdnglcxc' WindowName: 'bdqbzntylotnmcwvosxrcxqesveitermzxhk'
- ClassName: 'jkicmwbprmwvdlp' WindowName: 'iaprnoexpepxkmlfcnncducmrfthbgcpzqos'
- ClassName: 'mntchstpbzidiaosbmsmcxtwf' WindowName: 'jihntnqbcineeamjlndnf'
- ClassName: 'mddugcpgunwjedrjnyhatya' WindowName: 'ftaclbnrlydvucvxe'
- ClassName: 'dcjrqlgqtlzvrmjbaivotgdwjwrkmqqivn' WindowName: 'ezdlglgyqyxfliauqqlzggwmoddbyxuyyonkqq'
- ClassName: 'opabfiwwynkrunctwburhehyqwwkfobobikuv' WindowName: 'jxtdtdxwhwtsvstobqoufummmjjzypxkpvq'
- ClassName: 'xmxsruclaxquxddttnzowrbmuzgjvbmmzoxjgfh' WindowName: 'zrqaexkxcaotlfoncpgrfnpxesdah'
- ClassName: 'lnioqoualtbnuyfvfxmfnglklt' WindowName: 'grhmqwhrdsdpmtaoqqaozk'
- ClassName: 'bpcopzneshrewifbrkvbkbaeomduvgiivmenmb' WindowName: 'jophafenpknkdwjcghywtdhcsoi'
- ClassName: 'aknfoxmpnnqykzzpbltksr' WindowName: 'uqxbkxikdegpgbdn'
- ClassName: 'dbvpfocqwzndsovaxeljjyfbyfhakdix' WindowName: 'xztunjlhyijbnen'
- ClassName: 'guyjiodtntxbwiecvswnriwuxzqzodcemrrn' WindowName: 'vyciadhrcgjmviqudhrkgx'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ogeasxaikeuwkgfyxrteyirjlkwll' WindowName: 'uhvmjblxcdyhyqkfvmfkwcwbjihhnh'
- ClassName: 'cigaogznnjuhuhrdjgnfdbqba' WindowName: 'atlceloioipokvlfanmvcnt'
- ClassName: 'fkygqfanxscmmlvargzgtnadbwp' WindowName: 'vwzpgfhdlzcdfwwizqq'
- ClassName: 'rfoztosmranicve' WindowName: 'wneinmenvrkbnmkacmljd'
