Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xauvpwbwdhyzizbxsukrmv' WindowName: 'oatauwvdisskdgayzmmswxzlbsqxomercts'
- ClassName: 'zewhwtdycxuiyphoqotj' WindowName: 'tuqcmieahiyjnordtckujtekybquy'
- ClassName: 'lknecjvllbshnedbdmrmnffcwwebiydl' WindowName: 'xoiuashpelbkdxb'
- ClassName: 'xlfpymabbgpmhlell' WindowName: 'tetrznmudysiczwqvagqbtngifjribn'
- ClassName: 'pvaqpxxieeyawyy' WindowName: 'ufiyntmygdtmfjpwa'
- ClassName: 'azoqhnzgjkwlvnxqptqnfrlnuzfrujaeqigdg' WindowName: 'jxyfaxtgghswbxsujfaaqrwdznbbf'
- ClassName: 'ujojbgifxwsuphregxkuwpfllrkgblrwmcumk' WindowName: 'dmoyhboibsulpwspzqsngakxhho'
- ClassName: 'zhyjixkhhozbqidlfgkxrjvwqjon' WindowName: 'zrlnmttnnlurtwahisd'
- ClassName: 'iwzufzccujspoyrfyspgkxmnwvb' WindowName: 'wuyqnvlumssgyouarrmzvbhlpyrychoulwtmdq'
- ClassName: 'rjmnlcavxqccjgfppkl' WindowName: 'gczwlqkrwmfmczg'
- ClassName: 'aafgyjhiivcinkaelobfddkkzs' WindowName: 'pxpxybvugwivwjbvfkqgatuulmuwwgiqc'
- ClassName: 'avuxzldsnhbtbxndweztvhrixeyalyznpswdjfu' WindowName: 'dwcgcderlrqpcpapzajorxciviy'
- ClassName: 'gxmzyalnixicvxrbfuparjwdpadit' WindowName: 'gnkkvynresjccuuzwsamq'
- ClassName: 'lkqpkfgfkaqrchefpqkwmkiwdk' WindowName: 'gcazbhhbyzgglktsaunuvvnjhczzzar'
- ClassName: 'kuvifwwqdmdgpouqzbrevtpvc' WindowName: 'ydcuefgsgmohnzxewgymgbwru'
- ClassName: 'scnijkdbivsptwymjvmbzsjtumwyv' WindowName: 'pbwxertoofmcbijgkfma'
- ClassName: 'spumwenakmsvueq' WindowName: 'wqllorbtxezgfhwqkd'
- ClassName: 'higxzcqnpbsalzjacdauqtuvy' WindowName: 'awpujwhsglpzfkleqmfvyc'
- ClassName: 'ikxoezbsbxpezcfzsqizsosxlyzhhuuqdpgn' WindowName: 'jjikautflvwmihrxvdoazv'
- ClassName: 'ixtdexbiqakjjqqlaegfeju' WindowName: 'aukcunqfgmqhlfipjwro'
- ClassName: 'qdugwgvczkvkagvvhvkr' WindowName: 'tgmgrceceuuzpjreyjnvigl'
- ClassName: 'gzxxcumucqmmindgvdqv' WindowName: 'jrzovtpuqtaubahyzydrytlpyqswflsfskekf'
- ClassName: 'dnegzstyfdtargvahadiinstmigjtteotqjvolk' WindowName: 'qbxfmsxrmwfeuyopzayvhhbcruidkklbji'
- ClassName: 'zvtubhnfeosievxlhngbewaxkomq' WindowName: 'pfdesxeobgbspukurevtodeedxeowgefrcocm'
- ClassName: 'ivjkdmotadmyrwejrhobuzdvs' WindowName: 'hyoigsjmpxtphlbaxbtzgzuzuocczksocvlvqe'
- ClassName: 'hlbarujxaamyvnhjpodjfamdkkccsxohlob' WindowName: 'hofisrefedzmfdroflxdvmgxwcrmyp'
- ClassName: 'pscdxhivxmllvkcrlxhyzzxjfmpi' WindowName: 'qrvexiikrqffguyhjtbtonmcjxfpx'
- ClassName: 'yybqythfxzdlpoopkrrjkvagtvhfjleqtoutrnb' WindowName: 'blojdwkiqwwjaphekmkfakltrl'
- ClassName: 'ocyqicpbsofkojihbbdlhbsxdhoe' WindowName: 'dunikhavddjgygvjaujizlo'
- ClassName: 'xnuxbldxgfbbmddlleweuhvbkoogjf' WindowName: 'axlffsoiwbmtjqfihjpiahtzqlknofvufvp'
- ClassName: 'wpxhilaheqhppqgasojfrknpuktfmz' WindowName: 'kkiifyjozpscpoaqtybgrmaf'
- ClassName: 'mapbqckhljqwjjmozmmiwglqkjnomch' WindowName: 'styjzinfehddaownqmovkwctrfxbc'
- ClassName: 'teclpelrotovxxykrrpyr' WindowName: 'kprhfnxrinswtslghcw'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'aqnczqabublzvqin' WindowName: 'lfnjesttrxzcnlslwjuexjkbocawigrwjpq'
- ClassName: 'ejjzzknuangercobtdmdeyt' WindowName: 'ggqzmgqhzrnxbejikltwtt'
- ClassName: 'bfjnmwlycnxucgdvahombifcdctqbv' WindowName: 'akqoswqlfmiohrfkubqexrzovafsbrasjxvzwm'
- ClassName: 'mgomekvnrdkoljaqqcergrzetpxuesecrytrkw' WindowName: 'cveyyqmofufdjkkaxrayfrfc'
- ClassName: 'hvvroionjroxfnhy' WindowName: 'hezcflzbkqhibmx'
- ClassName: 'ndbjeoijmvcfnjvkmsv' WindowName: 'bylemqatqnibgwfvuojmhmucwocavmatefrh'
- ClassName: 'lbdgifnixujiyfrlywelbmvqwglbzkuhknxp' WindowName: 'afibyzxnrdujvkgwmuuyvtvdcpflkq'
