Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\InetLoad.dll
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kixfpxsqohfiuznthokbvplkqbc' WindowName: 'hizlzcvytlmckcpcysxhsfksydmwmgj'
- ClassName: 'rohozkorffjclorcckggkpihgmzfyviym' WindowName: 'jxwcpmiiwffudnijipcjyebonwgqebrxg'
- ClassName: 'qznmmpbztbsooybleupnpruns' WindowName: 'ontckadtpaqlvyavejljqduxr'
- ClassName: 'genjwbpeqetbzsl' WindowName: 'ycstpknnbdqsgsmtkqkbrpdmfjxhghwyklwqlmo'
- ClassName: 'xqiiplumuzmyoktuttdmgjdkiq' WindowName: 'ilnqnqjgmmrkdqgudpjykakfnmombwc'
- ClassName: 'bfewjzoeswoeucwvatpwizftplahlmwvqpolc' WindowName: 'tojzjxkxmuigbavzjybsfnuxlk'
- ClassName: 'lhwaqoqmqzkbbirsserqwhehifm' WindowName: 'itoihollyqlbokj'
- ClassName: 'ddfqqsjnfljvjbbpyvtuzbzgeu' WindowName: 'gzcymfxhylvdbldjxam'
- ClassName: 'dbnjtnouuvweulfagdjiwxgzgwdatnokolkynzd' WindowName: 'surjznjzlgebbckkncdwhrrvkghjhvejbjjb'
- ClassName: 'euiitioyatidvvlyqdtwuaaguqusivxliwyip' WindowName: 'qjcfjunjeqwnkaluuhbpakhvxxbomukvw'
- ClassName: 'fjndirlpzuzrfjkmddoemagehukduxlnoggehhf' WindowName: 'htofqtitdyiibkuwdbloc'
- ClassName: 'llolrdxpejxlxgrztlwcacrowlwjvy' WindowName: 'dzenmipaymjxwdnwxcq'
- ClassName: 'zsihwyuaqdrrwezn' WindowName: 'chhlkcaxcwvffhouydwaz'
- ClassName: 'virzgwmjopqjnhlmvpuuycppjdodzgziyrafia' WindowName: 'rsuwqrbwhertswefwtpyvj'
- ClassName: 'scmeafjzdsbsvsipjmpckrlej' WindowName: 'ujaaqumrrsrzfvhjbrkzyxgtjrjwm'
- ClassName: 'jebesavoysenrlckkrnbysakwpokde' WindowName: 'fjfvssamdoibuzolojhdvavyouikyprp'
- ClassName: 'bccrwaopenpokfgdmulbcjswidmukdfxynv' WindowName: 'okgcjadbmfnjmarijgfidltormgkcjtyyhuzk'
- ClassName: 'bjwmyntxibebqvzey' WindowName: 'bmykhnwvpmzkjfbea'
- ClassName: 'csuthzifkmyocshnx' WindowName: 'rtufgqkjqirgkunyaieicbdzpssrdj'
- ClassName: 'qbcrxvlswnaafhci' WindowName: 'nhotlefrrcjaoiskeokmmcehlegujtnq'
- ClassName: 'akgyaaewrxxekqeywkvcbdlge' WindowName: 'rcxbizlcyhfnwxzubmhhwcafnoomibu'
- ClassName: 'knlrkuujxoastxcjimaefismcaryloxz' WindowName: 'ykzakirntqttwlgctbjcpzrxpedztzkfocsukc'
- ClassName: 'ivcyfperadrcjptayeoors' WindowName: 'ykmdwocanbxdtztjdzkpfdsdlsh'
- ClassName: 'mgeezcjawesqsghzixeban' WindowName: 'yqhhtzmvsuuodwbwuy'
- ClassName: 'pzehdcyprepowbfesqtsigvgdhghnd' WindowName: 'pocsathrbztauzllulcqosihxbivp'
- ClassName: 'yqhmvojffxalohtxcxyxcvfen' WindowName: 'uuvqynehwblxdpltztqqbnxctvll'
- ClassName: 'zferooygmmibijqofqmlhwxh' WindowName: 'wcbvlqiyodbnefducvnfqloarzggmwpm'
- ClassName: 'juhivayewnnlgbbkiymup' WindowName: 'fcnppjcccrakmovfmyuwdcso'
- ClassName: 'nlenxpmhcpywudf' WindowName: 'lpduuoksxgbojqrilwodvistqw'
- ClassName: 'gjykdbimgqnipdtkpaybrpxyqnqwxr' WindowName: 'norfzvdjalejmgnztreacanyuhghxouu'
- ClassName: 'gkcgusjxjyovpyaqiamkkfneykwndfomirk' WindowName: 'jebdzbgxunwiufdnlpgiitndcbqbwms'
- ClassName: 'vyowwdtqyrnjexyogkfadovcvorlaxgl' WindowName: 'laztqinanscxteylhbwuiknotdfzhhf'
- ClassName: 'osyecqiyxqrkirtsiysfuavjhbw' WindowName: 'xdgrwkykvfsixbhpcvyqzsqppsbzk'
- ClassName: 'dzsciesclbryiblpxydgxelambcjrwvcdcaan' WindowName: 'glauayxcadoksbkefetztuznawkrqp'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'wndbhwfzqgjawhdypeyfug' WindowName: 'mttitpzypuzggjifxqujvdnf'
- ClassName: 'mwtqpsepzswgvyinkibmp' WindowName: 'uuqgnqsgtmajqoxkenwdvwh'
- ClassName: 'mctyeuqgombjfslkcgwfivvaoaaqoto' WindowName: 'lqqyuneqawpipxixtquahackgdrtr'
- ClassName: 'vfcttxaalguniqocqtsihcvwbulluzw' WindowName: 'dmzikhtieizimeqeodntthaywbshnavzh'
