Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\InetLoad.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'coqajitzmvojshtfwadplwd' WindowName: 'cfxxcqzjzjgwtruvkywyyosvogggtnddkeem'
- ClassName: 'ovhcqlyhxqmcyhbiuozaavgyytqhtp' WindowName: 'qrwijekitlvvcocywaftkjmilrbovdhskf'
- ClassName: 'woxdghjfmtijqssmshycethqbjkumvbomamnpo' WindowName: 'uojruisassfpczeifwhz'
- ClassName: 'xfcccsajeayndkbcy' WindowName: 'mpextyjhghrjlpsqwvcszxzatnqtxdn'
- ClassName: 'nkuevxkhxsrzyhhjufmeqrvriddkhhb' WindowName: 'rlkwzgncnzbhotnlxfut'
- ClassName: 'crqeopidrwmahfyugzq' WindowName: 'cvdqbjxikilubyatrrugqutjslbfo'
- ClassName: 'rngvfjxfmqezkdqzcmzzxpzxptnw' WindowName: 'dgtvwlapeavlwlxufqddnlcoc'
- ClassName: 'uhwspmmurjzloxjgzlqycavgyjayjm' WindowName: 'zzpsseguiikrbcfffelxjqbrro'
- ClassName: 'qwwdczjubhzceevmzgmtsjmilmqd' WindowName: 'ldntfhfmygsobmpkxdfqcwafjqxm'
- ClassName: 'qrutayfswktqouqdjntddvikuajmkovmpuem' WindowName: 'iljacnocfoatpgezdrxndxwdzgdpkkweum'
- ClassName: 'ktbsolnwpemqtgfcbwbtnyudlhmyldrrc' WindowName: 'ghftcoweorxmflz'
- ClassName: 'jbmwqxgmcpiilwocrvxtykxtljurquvrsruuyd' WindowName: 'gatnmutdjzvsqnwnhyfid'
- ClassName: 'txoejfbwkjkigjeafgyigfhn' WindowName: 'wdrjyttcegggkxuwsp'
- ClassName: 'uhriovumzbropfrtsdemsnqdbppsqydvod' WindowName: 'cjrzewqtidhvocbxqmzmourczm'
- ClassName: 'nfenylyzswboebbhovnmpnqkzuhizod' WindowName: 'cjlhjhqrnzxjcngzvro'
- ClassName: 'qseaoncblyxyymfwnawmltyts' WindowName: 'qqmpaduiehhjbioczrpntnhytovhnqs'
- ClassName: 'ibfguohhqmzprnietwzcqc' WindowName: 'pbrhavuuueoptrcrchd'
- ClassName: 'vnjbzxxjqafsqsfpfmoozmiaogor' WindowName: 'omopesrbzsapwrdkfirrhhsje'
- ClassName: 'dhfgvbolgzosugoeojqhzlodtdmagkl' WindowName: 'fujddikkcpoeudbmito'
- ClassName: 'ncooygbysmaawne' WindowName: 'vpuerulpyfyjkwofrbsymmhqtbfcgdcwdljm'
- ClassName: 'yghulvnljmejabgkhhvqiqjkchrely' WindowName: 'jsrtezygsydzhbwx'
- ClassName: 'brxutfcuyimmthwuif' WindowName: 'motcqxqefwuexgaukkosbfewflqldm'
- ClassName: 'vazdkwvqtvtdpqpd' WindowName: 'okbtiaajlwcpfortxbchenpkpcdyxwcslty'
- ClassName: 'ztbciatnhiziigkbmketvh' WindowName: 'hclaheusrzdsableekqngkhurpm'
- ClassName: 'dhhpayczvcnjdvpthpbwgedz' WindowName: 'uwauigncnoszfvbgnstloqfgcdrx'
- ClassName: 'kkojdjxhamowuuqmlvixmquguwmvres' WindowName: 'ffoqdlobmasxazkoibzlpuk'
- ClassName: 'dymuderjqpsdjpji' WindowName: 'badznmbibfxkuuxntbisgxgb'
- ClassName: 'mxemxpliqrloypmouliballpfuaqkvblfutb' WindowName: 'qnnnnybrilppxdngzbmghrimvecwrhbmmrg'
- ClassName: 'kuyfnulyovinreaulknawrahflaatkxvwhi' WindowName: 'xrdmogubbsjzewtgsrkaiixctmgom'
- ClassName: 'perexlxyariznaqblcfieuknnphj' WindowName: 'sdjthsekvxfowdhs'
- ClassName: 'agrckjxjgfpthfeagdilbaslaltmwbscjd' WindowName: 'dhxoxrgkcyseeyifxnabigaexx'
- ClassName: 'zsdivphezvmqebwbmibodrzcjvidzwucfuq' WindowName: 'ycervgznodghfgpvqaszopmde'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'hbgzosoglacgenuczbakkemhqehk' WindowName: 'lzscqrcdvlyfpigsppukquzeiulnnkemliax'
- ClassName: 'arpdjewvktqjvsmctdwjpbgpwvkohxws' WindowName: 'gziynjgcoclwchroxwrhyvlsprjmysn'
- ClassName: 'dvqgvrsjyapuxxsgzwskxp' WindowName: 'taimtyeonbkjzqpqvcztpsdrbshsqeg'
- ClassName: 'ikgjcfnnaqxorwaswdzgaozijzexavokpi' WindowName: 'nwaqrmpejyqgiapmuvbmw'
