Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\InetLoad.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ljymmtwgdfsnfgjmrieaytt' WindowName: 'agijsybcjvunfirlbggxzqxzzo'
- ClassName: 'eunjwxqnctfzbjcclmis' WindowName: 'mxoxhlpteycgcuvikrdvbgqichbmybrm'
- ClassName: 'tngpopetntsrkifblm' WindowName: 'aektusgkmskcasvavrcbwfkogoovmdraqted'
- ClassName: 'lgdfdsvhbdumrctdceuvsnalyk' WindowName: 'gjwdwwmkcsjbtng'
- ClassName: 'tsnzromeyanmaslp' WindowName: 'ddjhtesxkdymeycitxcsieoisgplibxcrcms'
- ClassName: 'cyctqnszxvuanemzowyezh' WindowName: 'sbptqbwqpboeteyschjhxeiporuwtfxyvsmvs'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'svrrrfrzffymcjmuevzpdocopfe' WindowName: 'srbwvrpgyiautgfgv'
- ClassName: 'enonzpwirxublqogbrzymmqxnhedyd' WindowName: 'bjivrjujmiadosxqhhguzfnrvxujbjxdwiyfi'
- ClassName: 'imnebfhyqlqammmiuirjjupystciit' WindowName: 'uwyxwodiavbtdimntgm'
- ClassName: 'uvnqsxekmqnmyenoxzcfxayqrorn' WindowName: 'mumhfzndukwuehyqpwd'
- ClassName: 'rhpxcmqdhjqftezckfh' WindowName: 'rrewhroytxnychhgiwuxy'
- ClassName: 'taydvndmeqgjlqccgbsylp' WindowName: 'nxlcyibislqcmbfnrmec'
- ClassName: 'qqrrtkzordjtytzonmaquxrxi' WindowName: 'mdywcmvgtezxhxjrctm'
- ClassName: 'ngymiliifawqulxjwaradjx' WindowName: 'qqurdwbgjtlglxjerseatfkqq'
- ClassName: 'ihphmfxxewxcoaemtxvtyxtlwqjoqi' WindowName: 'kvlzyecblumtmdvcmrbphialigjnz'
- ClassName: 'bioxwjtkiutyidzxwzonqxlehcmyoh' WindowName: 'seobchgjqayjedrulfnawqmowaaxn'
- ClassName: 'ejkaldfkefobqwev' WindowName: 'qskthyodvfxveqdkfkasqojllqny'
- ClassName: 'npryjmgogggctdeekv' WindowName: 'yhlgthjrdohhrijlbtfpzsqym'
- ClassName: 'tmebxxpikaycigmqkrezzei' WindowName: 'sgpsppgitsuwbjwoowpcbo'
- ClassName: 'bctsvccmllwpsshvoeugyxumwgfkxdh' WindowName: 'vpfkjnexsjbrwmoookyprszzbdbkghqyrq'
- ClassName: 'fioqxfwiofsavjm' WindowName: 'hejkchextslsolqnx'
- ClassName: 'vnmzsqzlgpfxmxxlqmhstnk' WindowName: 'pljsxykwmkoquokne'
- ClassName: 'zllekqpfnvsdqzksio' WindowName: 'udlueiilfaoeznlkcsvggb'
- ClassName: 'fijirccypivtysohwjddeyxgtpwv' WindowName: 'fdihrilkilogobyxhuhezlqoztblsrg'
- ClassName: 'iebbeulekoofxur' WindowName: 'hvhjfhsqsphhsbhngyaxukdzthqrdhnwtlij'
- ClassName: 'dhjussjekhygmtkezivyebaahinvnnwzfizdh' WindowName: 'blzdrmbdoqzssuzsgiyjxdivcewzifokn'
- ClassName: 'jxiwtncbgwusmfisqsz' WindowName: 'lwirycjjxfbbqgrrcqawcqaruphwmpzmz'
- ClassName: 'wkffjcguxohskwwgtmupxmvkuz' WindowName: 'yqtfrubsorozsrjsqk'
- ClassName: 'lxetpnmpvetezxbxepkgviszzzzprp' WindowName: 'udakmcfxqoxguubsgjaszml'
- ClassName: 'qhfszhgdmehqkocbgywrtkuruxdmo' WindowName: 'ufecdeupvrzszmswm'
- ClassName: 'hrfljqbxqelnpxiwlxuqmjd' WindowName: 'jksesfiepqobvzsmakqygqu'
- ClassName: 'tkcrintzghqbyuggxabwtrapvxigxwml' WindowName: 'cxewigwogzohyvrykdqxlqfahlzrhwapthetkti'
- ClassName: 'ftnbxqddsnalibl' WindowName: 'xgaporsdivzxsfbxwlsasaqtpdlpwgxihp'
- ClassName: 'ejbgexwhmhfefbcaibyusgnxvrsswljf' WindowName: 'zgmsvacpcdkjbulliyoghbgafbgj'
- ClassName: 'uxpmdiozhyvsozh' WindowName: 'hjttjldmzkdurbujcomsbjvyfqkxqdjsap'
- ClassName: 'kpimqgfbcelqceisdqcssyxmdzdjhbkpw' WindowName: 'ecqxqmejpwrjpsncwnqekulcnurxuhssuyrnm'
