Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\InetLoad.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bbyoxpryxalhbjbfkvypnrzxzhdoaxrwplh' WindowName: 'pvxxhyidrstndvcisdughhvqwaotuhdlnq'
- ClassName: 'jjynndbtzkbrkdvujdhhythugpakfvp' WindowName: 'dleafjrbeysxozhsicviuxfg'
- ClassName: 'bjiosyyguocwusmijiuxjpxr' WindowName: 'qfabxilgwtpjvixubfxhr'
- ClassName: 'dfoumlyvsdvljrjvr' WindowName: 'oxvkoomkpmzcxmq'
- ClassName: 'ruyirxgpaisdujqibnlsaky' WindowName: 'nadygkjnmmrgxilxtdnltmjrhzuzpcjsp'
- ClassName: 'nymvrqnzihtpuqjjermmvnfdvovqnngxthxhmjo' WindowName: 'igesbuorgraonbkfsofkazovrjimxcpzohse'
- ClassName: 'hjablonehxvkmriprjwamkwijswvkcqmwt' WindowName: 'femegwzfnxochhgisrampvcrhwvcuditnjcwdo'
- ClassName: 'lpjryvdfakfuzhehlfqgtwfkuycbptorlykt' WindowName: 'ktqfqkchfpilotusvhlltqwxnkcrgxdrzfpffv'
- ClassName: 'bywketbiyrhpskacfkcbbqxnid' WindowName: 'uaavptngrorslodumhmofrfgakrhr'
- ClassName: 'reyrsbqtdjtgykwcz' WindowName: 'vtwservhccosclehcoeeanrscsuhto'
- ClassName: 'lduxtqznhgoubpiahhevspoztd' WindowName: 'qsmydowmaudezjpckg'
- ClassName: 'cowymginmlghgnjiuqz' WindowName: 'ageusiqbyntmaoladdbagjpdguuilaiilosqocs'
- ClassName: 'grakkywozyunusiunnoitw' WindowName: 'qwfabbhftogqokyaupsfkjfhvaehkji'
- ClassName: 'oxnfkfweydylgwfqxsjkwkrqkxkyy' WindowName: 'xfwbxgyxgzcceflezstsjphxxc'
- ClassName: 'sbfcbklwigecxlijzqgfvzhpfpzjtbg' WindowName: 'vvgatqczjjsduixekvzoiduiipujzfsgp'
- ClassName: 'lnwcqekpebkryqjihriwxzzjmq' WindowName: 'feheepdrnlbvysk'
- ClassName: 'vorficbooaueieuofflvfdd' WindowName: 'mbhhqdtlistkqckftnqexdapngxgz'
- ClassName: 'khfdjcpzvoacebnhsnxqhyvijtpdizdwewr' WindowName: 'zcscmhrdxsfuvrfigodphquocoanifmwm'
- ClassName: 'lqhglwxmriensabrsajslktglngwqwrptr' WindowName: 'zzhtaczjcpymbaqjnxqttuqpgnldhgqw'
- ClassName: 'yovbeihakyehqajqzcaglsl' WindowName: 'qrlbgosoccwwebzrlmslqcvtufj'
- ClassName: 'nmzvhikiecgmxwlxgsfo' WindowName: 'ymneoxmohcewueoej'
- ClassName: 'mkzwvtkmjqhdaevcvlwxfx' WindowName: 'zzwvrgugmekaztfd'
- ClassName: 'zannbpciisfelqznnbffsbnmmc' WindowName: 'juuhofnddnipwqgoozp'
- ClassName: 'yktpnftlcyrozvdt' WindowName: 'bmgmhhlvtwsxnggoqkxor'
- ClassName: 'hsojskdzrqzcwcdtoxfbinin' WindowName: 'vfahsutrpxsiqtrjdbdsqhwrgbg'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'eifqnpcngltukoycwxkbm' WindowName: 'ygryifmhwjdkwayblkugwzretqfyeo'
- ClassName: 'wbdjskqiohghmvar' WindowName: 'qaycdnifjjxknfsfnlyquidjwhrhpahnbw'
- ClassName: 'idgwfedcmgutdxdvnqfvbpw' WindowName: 'ewfxcjvljklpkenxxjyhfxsgcnlnc'
- ClassName: 'kpspcfgnyacfweugwumgfvrovmb' WindowName: 'mefrjwouebzhjcfmtpp'
- ClassName: 'cwiytvfpuoltyqaujtluouspjpofndfcmfpy' WindowName: 'qfteqcokwpsjxurg'
- ClassName: 'plwfvwgosquesxhpkzcshitgya' WindowName: 'ejelxzvhdzzywpgdcypslwvvhsjsveqh'
