Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsy2.tmp\InetLoad.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'cyurxwpplovfgmnspayzyzbwgeuu' WindowName: 'cfshcmotfakkmlaegbselimefuziemqbh'
- ClassName: 'zyguwptjwpjdcilqqw' WindowName: 'wcalfxtafoeymnu'
- ClassName: 'chubpdxkagpjdezfhdvkvp' WindowName: 'jvqomorebijzllidtjsutaodqwhnxnmjzzarn'
- ClassName: 'idfrfuawafymbhfhrr' WindowName: 'ibgdizvcmbrymlhjughfrxxqihryb'
- ClassName: 'zkvmtaqabtxubnikcnzdyzto' WindowName: 'coyhxomhsiuznojmyxubhoitlpodmdkxzdeth'
- ClassName: 'npigyhyehlayildyvqshuksbiz' WindowName: 'erteyofyrvfhjjfpgoxafpghlociqnjpj'
- ClassName: 'vnwuvdhrxczlnpxsjrqunlzdrpqgpelaqp' WindowName: 'zdojvesjsvplfsthvevrltbcfnieorbljifw'
- ClassName: 'cyplztxgoxqkmhohulcfuqweqbokmpstkdkv' WindowName: 'pojcqprlfkrwnyywklj'
- ClassName: 'mzvqlhwwsdruskplzmcvof' WindowName: 'pgvceyssqtukvjuxmlcgzcqrhuawn'
- ClassName: 'vmeplvjrecbbpvnzegxgkqcuoiprjfwdffoy' WindowName: 'hhzoztozwndiguqtaxdm'
- ClassName: 'wnfpuosoifpysrjgfa' WindowName: 'coexrkbaaufukyz'
- ClassName: 'choiuyemwyexxmyupmtrwyn' WindowName: 'aroohtnqvyglybjkdzjfqqs'
- ClassName: 'nfuhmbpiivbugrigfofsysmeoyirrxgkwywd' WindowName: 'idzuxcssdrycolwpsazzhebvjxeiwqvzxihtkgm'
- ClassName: 'iozasbmeohwyrbkverarzwrhbmgzhzzfha' WindowName: 'qckuspmtwucehcureanrehf'
- ClassName: 'zyaasbaatdanodasjzpxaianxby' WindowName: 'olnvdeqppxqklovdqluddqnf'
- ClassName: 'vlqrorjlzscyptpnzzyxyaixqeknzmg' WindowName: 'azatvjlleetqjjyodvh'
- ClassName: 'auxicgfpdvtlwrfxwbiseeohdcqgfwljnny' WindowName: 'abrtceknvkymzfiwqegkeipvs'
- ClassName: 'lpehshmgxkdebkfbxxmnsaaygzowxtuhrsvhll' WindowName: 'byxuufejqlbudmdgemofd'
- ClassName: 'loxdpfyjogledmpfoxbm' WindowName: 'omeynxitaskcdtjkcmeylvdtagcmpfg'
- ClassName: 'bynsexdpiqgdtigenoznnswvqnszylxxap' WindowName: 'nfhgyyktojllsankg'
- ClassName: 'qidmskxklqebnoitkngs' WindowName: 'ymoyewuiycoktxqtuzulgylr'
- ClassName: 'zmotzijegekxypavxblzjptiaebgklr' WindowName: 'fuccvcycqpmfzjazzuqr'
- ClassName: 'tsouvqdfhmnddzyftthyzbylwc' WindowName: 'gepeqekkftowwnxodbsgotuiyhftaxlzkdjfq'
- ClassName: 'atqykonerusjixpdiqlavbwznahqqghadtbdkb' WindowName: 'tfpujnfdecpgvkfbxzylngmav'
- ClassName: 'bmhdkrktkmumkxcjryalw' WindowName: 'crmilpvmyunotlprxukw'
- ClassName: 'pjjzcmytcvtsilteptddv' WindowName: 'jtlxdflpbdfnxotcefrkxqyhgfar'
- ClassName: 'cupwacsghjqwjmhttybqaatxsfdhxpoykvlswr' WindowName: 'lqpmldxxpuvlryulejaazeztngxgtv'
- ClassName: 'yhlygehpzycplyxiypbh' WindowName: 'iywjtnxuxvpgdyswoqndrbz'
- ClassName: 'oyemlhoqwwzycqmlcsex' WindowName: 'plwnpldfebfcqtixqupbebkbvhecccnsk'
- ClassName: 'oncqoyslqzswwkpdwbgdwonpjyuvds' WindowName: 'vxxacyzbaonuyeuogaophqidderpsgkfenbcx'
- ClassName: 'mtulusmlwhldypkyporjtlgbh' WindowName: 'vmpvpppslzjqiwllngufzdrhgnzwsmzywxfcc'
- ClassName: 'bsegtqllwufripveqyxxvyloxaekuefmtbytqy' WindowName: 'ffxmlcgagzubjpnhnfeywjafgbjvlnugdclgq'
- ClassName: 'dqvatkwickyychxnknyltcvjol' WindowName: 'uahzxbcsnqzdcneziwosmcciveqkttwcwhencbt'
- ClassName: 'vvgoeclmmeqvpumgxsotp' WindowName: 'uxttgncydlwtxoqjgjdnjyhlzaqkgxmb'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'xzwmrmvetqvexswkcaddxtzscvonw' WindowName: 'qpzbpzunmprjcoorhnzgnps'
- ClassName: 'ilrwitiiyhppiigzitfzkftzxenywgvnwwer' WindowName: 'tbwhspgmwbggqfydvypd'
- ClassName: 'allmhsahqqnvzwpakhrrhettjyhfleihnzkpbrk' WindowName: 'paqofbmimrtlyxpqujgdz'
- ClassName: 'jsatjwdvehwtxyhskfmkw' WindowName: 'bnzvcxnnkenzkukiub'
