Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsd2.tmp\InetLoad.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsd2.tmp\System.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'wdodqqbgureiqqvpolcesdgr' WindowName: 'kxubmgummxjjplgmfijmbwdtf'
- ClassName: 'yfnfxothwibhhsichix' WindowName: 'qdjolvuqzmoslsbimskuj'
- ClassName: 'cmmbxnxmzoxfciofjmjcymdxzhqlwbhgwfgh' WindowName: 'zceaoawfutclklevshuydhjyyiiftdxzrdlyyct'
- ClassName: 'djicmpsghwknsvcazppljplnkzjghvnr' WindowName: 'vkpoedoqcwwevauzmxzro'
- ClassName: 'ztytdnbysuahhybhzqlldsksngrryprd' WindowName: 'liscosccvchtciowvfpeckdegpnetci'
- ClassName: 'nvtcsnmfczqkygnuywxnodywtnvkebv' WindowName: 'kvpujxdbjcsfqrfzqrlbtrmtaceqizyo'
- ClassName: 'dsmipabkvjqdmsvkvyyjcsuxjrntu' WindowName: 'hrarlxcctppybucopxuflxpuq'
- ClassName: 'efmmwkzpjjlogpewdetw' WindowName: 'wzixfyfyeueauhgcsalvxvkzkb'
- ClassName: 'lmeoyitsglmxnwibbvuonclthqouim' WindowName: 'rwgokrxhrkkwdfcxogweimkzdcnplzljmufny'
- ClassName: 'xhlbrewevfvhxsolygwbgoxwlwhgexcspfb' WindowName: 'pcxusesguugctnpwsni'
- ClassName: 'tbeoiqgpzinojduzcprnldrqwv' WindowName: 'usxplqmyeclbardpugnswbzqbvxvweardqfzdod'
- ClassName: 'nlueqtjfqsldrpmhsks' WindowName: 'bgdtlxcijfyqndbwqffh'
- ClassName: 'jkazxcmloqxktgzbcfbodaamqegqqlwro' WindowName: 'dqzeolishjxxybe'
- ClassName: 'sayjqgpqdfmxbnssosojk' WindowName: 'fazsddezicopvty'
- ClassName: 'lavuhadswbthqwjdkublhlgolvaedxkxytoo' WindowName: 'iofkdnltzoodkwqqvyjiqkkwggzjwse'
- ClassName: 'qydezujutjmwmdewoammesilsjqbbmoyixax' WindowName: 'sqrgvcjglxrorutfwklcwaejsfxaqgkcu'
- ClassName: 'mqgtoqvjmrrgqxpkygtgm' WindowName: 'lkxtledzujzjbmppfoxneanqymt'
- ClassName: 'kauxrbrkqicnhixh' WindowName: 'rsfszffpjgtczrvqeaul'
- ClassName: 'wwhnjgrebaltlppbacctnlcumkwua' WindowName: 'ptlkpsvdwlrvhvrmgwouvgajgagsfzbhlifxzgd'
- ClassName: 'dlrxabvcykbwxveteraqsvklgu' WindowName: 'fxlutacmujfvfabcgn'
- ClassName: 'zovxafhelxzlqphldwtsixdphcwhn' WindowName: 'zatvnvooeqfurpvxejsmdzexvcclssxlpophnzh'
- ClassName: 'vnwqegcamsahaqfdvgcuodbgketdaizuergvm' WindowName: 'uiovqovklfytoqmxxbqbnqddaaptbfraqulez'
- ClassName: 'jiglalldepjgrhzapxbztddscc' WindowName: 'tnjyzbusemixqrxeiiazdbwrmqyxxgsjstjnqiy'
- ClassName: 'rmexzdnnaajkqmhsadpoealoetbr' WindowName: 'oudorrgvnvimktvfhzdnamaangpbumvsztopn'
- ClassName: 'tzscbkllhkqpvihwnnekjtxv' WindowName: 'dqpzovsvmtzldrhrpqd'
- ClassName: 'ukgjxqsdznfennowfyvvrbqgxmw' WindowName: 'goivmolxyabiudwaar'
- ClassName: 'ighrojlskobcxomi' WindowName: 'mxqquubffukzhetbuevxencojrzrr'
- ClassName: 'ynocfbmwtvybuwmajixahyrl' WindowName: 'sojsjeuyxkrutdfeigghndlrrocclweng'
- ClassName: 'sppnzxtfdffdvcbangktelqu' WindowName: 'zteoruyikkoemhqujciuvm'
- ClassName: 'hwkwsmvidyghpjjwuytlyrlfyhrfebescpa' WindowName: 'znghpiumuxtlfekfnjtpxudsyhuetiytdrbw'
- ClassName: 'crszqlokmqvifwfoxxbidlrxlavjeomljhqhq' WindowName: 'kxbmvsxnpsrcylgpvfwdexz'
- ClassName: 'vxpuzfvedrrjbwsbtoftdph' WindowName: 'pbchuwicoljxuyuubyfdhbrdv'
- ClassName: 'zlzngxeapwxlolkxbdhxvmqjjrc' WindowName: 'twcjpcazwudddombxsintcmyqk'
- ClassName: 'jeemeldkvnwiklgczdh' WindowName: 'hlmoewqxbxurforpejskefafqvdfvmvy'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'pvhyeiglfoqajzaihxbbgpcwdy' WindowName: 'yxtvffjoogebgxmkzucpgio'
- ClassName: 'jclprnbikrgqdscrnvdipfbr' WindowName: 'udbvofurkdpliycjrtiotpwlhmsquszwojaks'
- ClassName: 'kcsghrhyrqfybgykusuzukmj' WindowName: 'dloffaejsospegxbjhq'
- ClassName: 'ushqczaffezlrnp' WindowName: 'irkslzzbutraghvsmxbyernmnvulhk'
