Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\InetLoad.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\InetLoad.dll
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- <SYSTEM32>\PerfStringBackup.TMP
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'rsxtxtvephpbidamcijzne' WindowName: 'fplltjradymamfvjjirko'
- ClassName: 'bsdaoapsvdcscbwdwrhr' WindowName: 'jugpytzolyegpmlsomwzmmcobino'
- ClassName: 'emcilqobacrwpelntcqbbkkavfvsnepzu' WindowName: 'sosjueflmvvfzwb'
- ClassName: 'annlemhbeioenkbwrdb' WindowName: 'oblfzzpcjeawgxhupqodtkikcjx'
- ClassName: 'givrdcaagpcoxoi' WindowName: 'olsqkqowugykcdainholqrmvitqevudyve'
- ClassName: 'emjziuxhbzjuovlizksautcwf' WindowName: 'qxbbgtrvcpqxsonaxgzdbfs'
- ClassName: 'mhljkzacxraiqqyylhkauisvegipoimhpzvk' WindowName: 'chbwximyxfamxaiglqvyvebiupnhpnwlwj'
- ClassName: 'rzfsiuggyvivaopqpc' WindowName: 'shsoqefxsvbxwfrurhoqzgrwvg'
- ClassName: 'vspiwuuysdzwuvezjwflixcq' WindowName: 'pbgyzqjamaddfbydyhf'
- ClassName: 'mmfuvwdlvdzmvotiuwlihmbsgbigsmsecujf' WindowName: 'gnkcmojwabdbwkoybnyabaok'
- ClassName: 'faxvnniethbymmovjdcjmusfdgqytjcuqmj' WindowName: 'yvjknqngjngosbnkizssywwx'
- ClassName: 'fnxqrbmjblqnjdjpyesfiyirtfeghfafelqmkud' WindowName: 'jctimabtlgdylkozebawnsyoodkyy'
- ClassName: 'sbtoabllszijixrjyssdbsauwmkzxhwkx' WindowName: 'uogevbjmvyfvlmaggeubeermyngnrislsdwio'
- ClassName: 'lgzlfmilfefweqflhvcorxgxhvxve' WindowName: 'uvbwkofzverewayxxysyvjgomkazonvds'
- ClassName: 'dzqcvmwqrvbuusncdcnn' WindowName: 'vvtjsztjullbvmfgbnbd'
- ClassName: 'dchmlszsyntjyqdhimtuxfvyosqcqovhroe' WindowName: 'qostgbhfmfivvxjliscukoqkrbbaikxjkiaal'
- ClassName: 'epoqrckctuveuhccdr' WindowName: 'rdcxhrwjhsdblfpffjfeihnmzqwsugllstcdln'
- ClassName: 'hlvuqjehqxhodbevtyazvussvmpjsylicgkvhbu' WindowName: 'fejjlfpeviqvdcckllczcmixpuhoafrekbtov'
- ClassName: 'tkxvfomcqvhgfpqsijxwh' WindowName: 'jwymntittrqqgjrbgbblrnpi'
- ClassName: 'rzdcwglgzckpnwxsacdbekeooixqzpcuqmc' WindowName: 'awlcswuacoxrhjykrgzvalwiwuacnqgrjyi'
- ClassName: 'izfaankjyiwiaofa' WindowName: 'aptbkpxhoegwiguqeuxiahzfkgljrlvyozli'
- ClassName: 'nxjwnrfifdhcbyftlwqgckg' WindowName: 'edzpawtybqtqbxwtmcvrjovpexnl'
- ClassName: 'hxkftmzjbpdaxfytrwstecxfldurkhgepfjyljl' WindowName: 'ybgxlkfgwjxqdezqwipnvjvwglxvlyn'
- ClassName: 'vkdyuqzwypwnyqv' WindowName: 'skywsldfkxmlvnfgox'
- ClassName: 'sghlhafstgbkfwvneqlztjwgve' WindowName: 'puetzcyaqntuflglkklbmvpis'
- ClassName: 'derrwylsbgnzqqhvfyxrgpaufjtixreqclnx' WindowName: 'emcgskelztsiqzpbbwk'
- ClassName: 'eccjcrqdfykkmcnixgvsdfhybqpfgzdubrwcl' WindowName: 'xllykumyyfupqtaccjxqpvr'
- ClassName: 'gmynroceshewegcqismrhntykepqlivhzscz' WindowName: 'skbdlrfaturbxaxgtljahvrkhqaxfzupub'
- ClassName: 'xskpajabnqkhpfp' WindowName: 'oxyxmoiukbvqtulrvinccpj'
- ClassName: 'xftjehbqmhhdzmafengzqvhkfgmqantzxlksm' WindowName: 'lokfhilqtedmwipehvucaioulrwhrslihd'
- ClassName: 'mgavicsujzadzsmh' WindowName: 'njjvyekoyxtaysopjcnqsymkmueowto'
- ClassName: 'nvepmmavhcheookxldlfuznbxglcolimosd' WindowName: 'lioykccdwmmlhyzszefl'
- ClassName: 'kanmcgcghltolvl' WindowName: 'vfbcpyhvjdafpmhackjbffowljdidvfanvvxgsa'
- ClassName: 'rjmiifaqdiufdvbswafktbqstwiahmvsq' WindowName: 'tkykadejjczvharhgdtvxxpwk'
- ClassName: 'royrehicdzddnacstimzfxtsbbrrksdjabuqi' WindowName: 'frtvmhrtlpdziptboatfbov'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'mxrrktfifeevaxnemilyqjtpjxdmqorvbmkex' WindowName: 'uwzgvwamwsfvhqvyybffoujbtxwss'
- ClassName: 'dcqdwlzlkegzjkndwgiyfkgujofgy' WindowName: 'skqspfetbpxuogtadvjmqsnnxcrsvsoaupjkvrd'
- ClassName: 'pvlnzrsjcpcgcvirvsxqcyuwunhhztua' WindowName: 'phvpzbydandkhfwklrxxqmgjjmyjtqvuml'
- ClassName: 'dbvjieyzjurbvvocfgwrspgqzje' WindowName: 'nnkyapqhgzwgwxtcdtzvv'
- ClassName: 'bylczyjacoouqiwkzaplybavwxhduhycofrymay' WindowName: 'pkslgnohgzskoirxufew'
- ClassName: 'ruaislqveludjgpwsjjvdruzpmwntltqz' WindowName: 'efbiyfynuoicbhsgbugcgvypzdnyobvmniu'
- ClassName: 'oxnqoejfgpaoghohkyoigficckanzzd' WindowName: 'hcvedmjsdkildbrpnctmja'
- ClassName: 'dammfijirnrqoctxkcecemwnzr' WindowName: 'jybspcdtpysswjflogvhbiqiqlwn'
- ClassName: 'llegmqjmojmfuakyzmpbucalvkyafrkyafgeqvx' WindowName: 'yrufutgyitkchpuvvnxjwwrvalemlafh'
- ClassName: 'rchcyknlntgaqntdfdtafsc' WindowName: 'plitqxzhbyxwdyaianloavpxcaah'
