Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsr2.tmp\InetLoad.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ianneiormhuvlfminbiwsnovpiexjnwijq' WindowName: 'lswbppmhpoawrhqobwbkix'
- ClassName: 'wftvdxqfshhjqdoqvtkqwxakhuxfmk' WindowName: 'jwcyldvxbgtrvaragbfsptbwmsqhxuaclx'
- ClassName: 'gtvvvrlgfnfzeclsashvlmewl' WindowName: 'jpvxauyfhcktmpbyetxtci'
- ClassName: 'suzxoopgqnyhcqvxlmiohirbwkgvzpzkrjbrn' WindowName: 'zabqxycdymblpfrfelxprf'
- ClassName: 'stmufvcntwfmfmiauptgrfcsdsq' WindowName: 'iashpeygdvhdrizjqxfjshziqudzjqxa'
- ClassName: 'mbantgmdklbxilfuof' WindowName: 'twzafwmuxykufjvqmfnvkdpcsvbfzefryxsr'
- ClassName: 'oywwjknsbwogwsveks' WindowName: 'ykvbvapuiizjuspsew'
- ClassName: 'slmwcjrkgwsoauyjzgecvuzp' WindowName: 'pfhkkbpccrmcavbjitbrhtbsrmwtlu'
- ClassName: 'xfwxbrdynoetobeuscajtsqgzzcuauglnv' WindowName: 'yemhgpfiwfslyoavjcorhneqypjir'
- ClassName: 'ukzjmahbyvburieptvmtasoedgykkujbklhzw' WindowName: 'ieczaxbtugsztmjvexhxr'
- ClassName: 'kgajfbmfwgwpdbxsmggfrpnrllh' WindowName: 'reckukgpaovccrwukglfswgbuzbbyavwuhwjcwr'
- ClassName: 'ddrkvofbgoukljjtdu' WindowName: 'zqielwzjqehccvmynuwbdykeodxppdhcth'
- ClassName: 'thdhxqsmmqsebheeuekkz' WindowName: 'qpbgvigpzvjlrhsqgilutrvgfesuqjkpvc'
- ClassName: 'jvfperinujfzryeoxtcd' WindowName: 'gsxkilswodrjzgxkyakbr'
- ClassName: 'ztfpmphactniftyj' WindowName: 'ycyusclpcuwujbfvrbjpuacbjatflo'
- ClassName: 'lrqouyasggvwxeknmrrvu' WindowName: 'hhrtdddujfhmkxzgjt'
- ClassName: 'ypovfwygdslgiimgkqoqpzagibrqlrxw' WindowName: 'yfthmlzrditpkcvzhpttaayeabiapnpu'
- ClassName: 'igkjwheespnczkcymuahke' WindowName: 'zqxcuyngvwmgbzml'
- ClassName: 'czfxleafmchunkmpoy' WindowName: 'odssrplxruqdlpo'
- ClassName: 'uwhyqqhiuimbvflvxlzhhyayorwecbeywinayc' WindowName: 'ufgkdcopwepkspquvssdcbgolrr'
- ClassName: 'sfhtwsrsborrxtwatxsifdikosknrqyzsbkvxkl' WindowName: 'xpwlfuumiegrmcslnuuqwpqm'
- ClassName: 'zswtrhswauiaqiwltqyaxcmxmvwmhzdycow' WindowName: 'xwlambwzhulycugajhoetukazqbeh'
- ClassName: 'cakabnxuvnjybfejddtykkknyfoezjcmmecy' WindowName: 'plcpoexiespyvcqjlmfewhqeml'
- ClassName: 'fpyhigzicthinyohdfetntwvztsxawdzacwa' WindowName: 'zmnrkwmxeagwyiruscqbomgxebmhsrakfe'
- ClassName: 'qlqjiiovqvfbnuwy' WindowName: 'ctjzurjmzycxgrrlhbwkssajieuxu'
- ClassName: 'dxtunxuvagkxlxebr' WindowName: 'kgidzzxuakzlkourm'
- ClassName: 'iohknoyloqabzhmkxuajrxpwtzqmnv' WindowName: 'tofmxryvbfezpcnqkrkcak'
- ClassName: 'oxhqzjmmyemnzsnbgvzefbzqpwxvx' WindowName: 'xirnjzlwkowzenkwdrtfghracfjb'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'hlnnynzlevtwaqjxcwqknzbcndxrqqposat' WindowName: 'kybujbjrezddaubt'
- ClassName: 'rvhrxezpgsihyghoqrtrhpv' WindowName: 'syavjolvbdwliletaffhbgaqm'
- ClassName: 'jzqnuwmglaumftgmojytipy' WindowName: 'vuguauxkypmbqpssaocdmcnrudyjknswiqxdtgw'
- ClassName: 'nimvaauzlbbwgakgzwydcfmkoavrkzxdjfiackm' WindowName: 'akxopkijkcjiqvezuijqi'
- ClassName: 'rmokthljivwrxwlddrcvlcaihedewaqq' WindowName: 'xtdlmcniaaeeysadtggosaqyrpczakggfttho'
- ClassName: 'hiiympclwcfleuoaewarqtgmtemetebubyozk' WindowName: 'uaxnelhctwvphkquhya'
- ClassName: 'mnxfndrbbqohktvwekwzjvqwmajq' WindowName: 'yopllszgoikhdujhlllk'
