Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsr2.tmp\InetLoad.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hcmmwyicohhucuxrnkecammnvpegleijmjxtat' WindowName: 'vispnzwxoeeqvtslek'
- ClassName: 'xwfsrmhefbnyazrqahsqmk' WindowName: 'jdjncbtbmhgdlckpmvoibkwgsynuieeqloqaln'
- ClassName: 'giqqjryuypvglipkkbcotojrgwymqd' WindowName: 'tljnbznbaqhhgfqi'
- ClassName: 'dwitgebejulkblrrprdzbx' WindowName: 'lqaozmllgkxulgvvuwxipifvz'
- ClassName: 'gejedateujnppymeavaplxocpnhogusi' WindowName: 'zmrgpqdwrmplaqsrkwvhgyrezdaxftlolsf'
- ClassName: 'gmoaokjvqvfkqunqibc' WindowName: 'bcdvhkzwkfojigbxdxqjlmzwkq'
- ClassName: 'vqeayqxikxedoxnpdyaufosdmkr' WindowName: 'jooajpvebofcrutrff'
- ClassName: 'evdqshpmccrcphpghmylhus' WindowName: 'jhsfsdnmmaobzqxghhlcevakjunwrxqci'
- ClassName: 'ixruypdsvbazpwrwocrupb' WindowName: 'efvgybryoifiymbtj'
- ClassName: 'ixgvmvoyijmyddvihsphdlsvwei' WindowName: 'ndjrwkncsauhzarjmkxfecwqogcugq'
- ClassName: 'qapvhbbwmpzmlsdfowiubxofryj' WindowName: 'mtcnarstzfuqtfnuerpjazvcbkmzmztau'
- ClassName: 'hajjyiavigyjwlocajxhumx' WindowName: 'qipnhmheonjvqmgbpmyqfjfpemiiz'
- ClassName: 'eksdfdwjlcpgfkslbbynzkbvmjnc' WindowName: 'kpwsrhmrsafkaecyddvaurvbuvgjmiotsaolwuc'
- ClassName: 'krjljcepenzhxajopdeevsbmpmdymbowsxzyigd' WindowName: 'axkkigtitlicldfeqeczmrumgsraexxmcvp'
- ClassName: 'sqfkklcbainwuoiuyyqxdqsjsqgdinxg' WindowName: 'ezevjpjjhhlghifh'
- ClassName: 'ahlvcbyawxvmxbrwkhinfczssqenvnvyea' WindowName: 'csbrjmhooqcexoirflvbs'
- ClassName: 'gmshumdtsupgifveucoqcoljqpmahlph' WindowName: 'rzhjfyqtwlmvzrwbciypscosyj'
- ClassName: 'xlbcjqbenbfhjtydarlocylpy' WindowName: 'zjkedxikexpcetqtnqmsmoiqzykwgvkby'
- ClassName: 'ztzkircpnbxrfgysauevxdwejsqqslyqm' WindowName: 'vpgralqtlobamovrlkhqcegvtgj'
- ClassName: 'skdptljipsecmfx' WindowName: 'heevkmlkfylsapujiywsqes'
- ClassName: 'nugxzriurnigsjpdfzpfjrtktpfidnvoo' WindowName: 'fattwysbuubezkdjsjcwrq'
- ClassName: 'yswrxxjvalubqrmosoaptuqbf' WindowName: 'qatstclwwjqohgvjreezczmibbbolua'
- ClassName: 'tfpsobcxckywpoepocyimketqsxekhmltuay' WindowName: 'luhmfhxiynelqgneig'
- ClassName: 'aktsjxhziezzpnk' WindowName: 'ztosjfbdlanckuirvuhp'
- ClassName: 'vvbqeyxdnecamshcalxofprvj' WindowName: 'bwugrmmcujdqqvjs'
- ClassName: 'qkwneksdhmnkhtayqcabtnsrfqlh' WindowName: 'gzmvwkpqrmuqznosblzajsdxdyokvmhktutn'
- ClassName: 'pjlxxhxpzxvjedcjwyrv' WindowName: 'kllabzemrectfwzhmloufnsfatfxcp'
- ClassName: 'zgxfitbzzhicjafyjbhbsd' WindowName: 'hcsltbgcsgeumngvucpakmokcgneykoirojsvk'
- ClassName: 'nxwtdfvbbobndfkffftgacjidv' WindowName: 'pcxclouhfvlhylfgiepgxcrbsraaag'
- ClassName: 'mxpjsjauxxvwane' WindowName: 'vyimvqmkqezhiswszwjdhpwronbjzdegbqnq'
- ClassName: 'xneexufntyaxwznskn' WindowName: 'zntdldiaysmoavmjq'
- ClassName: 'enptxapnvlqodkolf' WindowName: 'ecrjqxpvpmshhfnyrefo'
- ClassName: 'tpnrtinlktlyeiektkwvcdkrklzypwiqxjroeh' WindowName: 'gpwygdwtctdhsuiueqkkcuquoplsjvykwjy'
- ClassName: 'abhqdxifvljuodg' WindowName: 'xorjkqxbhzfjkgjv'
- ClassName: 'vaykeydhmpgfjrbkfe' WindowName: 'pibyurkrausygcbetopnl'
- ClassName: 'hstuujhxklmhwubhqqkiuvgvrlwdbzvrkz' WindowName: 'ocjcryelslkrseazjudx'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ezwbkxhoxzgyrpbzpkjxtmbhmoijgzqxdwfdre' WindowName: 'kfwdhhzhvvmmowgwxhtiwthrfp'
- ClassName: 'ftfibxzcchmgktvsktgpxavazngcbz' WindowName: 'vpyemnpzxepelijbxmdzeyyjtqcquisicvqq'
- ClassName: 'jssbjofvzochsigkeotm' WindowName: 'dguopodgzlpxfibmzeupgwcerhifsb'
- ClassName: 'wbwuwmfsinpppkltdtrd' WindowName: 'dkorilmunqtsvcyvyhhdrqnehstzrfhqlsqywwz'
- ClassName: 'krdwugfilfwucgxszvsnty' WindowName: 'ulicxemxguxdtzfjiilvat'
- ClassName: 'fprtmfinyuseammxsysjzyfncnkivwut' WindowName: 'hplcgzmssqbmbedekcmwdcdyelgndtkwwoqbxn'
- ClassName: 'orxwaiktjkjtjtqgytytnysmzwi' WindowName: 'koyqiugphjizcwgyljncsklia'
- ClassName: 'odrexsfkofvhjevnge' WindowName: 'tapruswpmqwafbuwzgauuxmuwthjvpqv'
