Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xgwmosjhukwzpcwhfmp' WindowName: 'jvaqtzexxfozmfrhy'
- ClassName: 'rxirjubwoywtnoa' WindowName: 'motgneljpubzdhyoyujxeiecrzu'
- ClassName: 'khwdjpzrypcnpxanwth' WindowName: 'jcgvitdujdazsqnqjamirxvogqq'
- ClassName: 'sahnyxidnohikalkrgqyahwwmiouifqmgkjddq' WindowName: 'pbefrzfvcwnjntdcwi'
- ClassName: 'rpbufadzlqzolixqiwtrrrzqyixy' WindowName: 'ilnqwgposwhuuqasuchiz'
- ClassName: 'myxpwdqzwqwuptsdaf' WindowName: 'modpatssmdlrgvlhvltjttjmdzauxlewohjeel'
- ClassName: 'chgpjrxaycbuequijlajqos' WindowName: 'keexalrosokqqzfeubhglxbvp'
- ClassName: 'onwfhtxolngawbxqx' WindowName: 'kjuzfaabphmuizyokkhnhhyowntpowlu'
- ClassName: 'xkzovdjykoeafwdobymzfkkxn' WindowName: 'gtrkkzweexxzzdfb'
- ClassName: 'rwwzsufvbzppjnidhlropuqyh' WindowName: 'tcpjymghqwhhrjqezjqlobwksmelozubons'
- ClassName: 'rhuiihhtkzytemuhonyhbfjpxazmli' WindowName: 'jwbdmawauwrozjcncexxpd'
- ClassName: 'hxzsbimgfiujoequwuoxpdklihpduycpqmgfj' WindowName: 'oidltdowpmucocnxatd'
- ClassName: 'wpgyntuehjhqxfva' WindowName: 'wlodvfhtyilhedfriqhzounrv'
- ClassName: 'wqnywxgcqphxfitbtvzoamt' WindowName: 'yojgiqjjjbuwmxiirrjkamtqkpfepyld'
- ClassName: 'acqmfhfgkuwdxfwgmg' WindowName: 'ejihpukhpykaywzujsmgwncwciydgeftyj'
- ClassName: 'hlqzjwjdqqqajgitiqws' WindowName: 'hopdiieyimudfyvyrkgfzjoumyowblvbsnjlknq'
- ClassName: 'fbfdwhmgsfzditocyjbgrxrriqwwg' WindowName: 'iepchouxffwpdusgstqwtxxpbrr'
- ClassName: 'tmuavqfutlurhrhkhfdue' WindowName: 'mjipiuwuocgujtulysayisordqnhjgledmivayu'
- ClassName: 'hbgpproomzbkyfqupftudxqdldaorgenw' WindowName: 'kftklkuwjxjidqfas'
- ClassName: 'zydxqgahlpelcty' WindowName: 'dcidpfbdsnhvjiltuwfiblc'
- ClassName: 'eefbfrluwvxorcloncrralood' WindowName: 'fuqomtuprluirdjekopxajifbtzcxrivasi'
- ClassName: 'ayaditvcawsagbuysvfekarvgcyhawyxhzq' WindowName: 'ekbciwqikirmrqgdyifraliwlxby'
- ClassName: 'bchxcfopouxtpjmlbiiwxbiwgojvox' WindowName: 'awaevgjmuxigwczdwi'
- ClassName: 'oqhyhknogpmlrvqqbycwxrsmhgjblk' WindowName: 'cibuyywkgxfrlnuwiahrvphiigsbx'
- ClassName: 'wltddmkdcjmrnrafwgiwaiwsptuys' WindowName: 'baqyoqguwcewptmzgorigtodovtmvkjqhfursl'
- ClassName: 'hvcvkdmqykzrrmbtmvigewjbu' WindowName: 'qhagajhfxxnnagoxtbxhfhieeqjvpp'
- ClassName: 'xwgdfhbufcuejmeenstejptfwf' WindowName: 'zvyikclhxpdruhjyhal'
- ClassName: 'jrryoymkrsayzuiagfwgfkw' WindowName: 'pbiwrqchbekkdjuuoanngbozuzvadjmt'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ydubcrihhbjuypxzmkeahhjjtkhe' WindowName: 'rmyxjgwpdarypnnmgqqkgkkjni'
- ClassName: 'xebbwdluoetsmfdorhrjg' WindowName: 'nzwxgkzlseyvgjkimbcdjrtzinmteiy'
- ClassName: 'emhpvthgdylyvcfmadacnkmcgr' WindowName: 'sktqxrdxzqrcowfha'
- ClassName: 'gpikemqpglazpofbeusbvwlhktxkbi' WindowName: 'qrvbpiqgbepqpegyxmihxsmrgady'
- ClassName: 'qahvvvgywzkuzbqkiwaqnzlhnohvqevic' WindowName: 'raswlzwqtjobdgvqxtcfavrvvk'
- ClassName: 'opcktyhoehcqlxqsmqysvinyuhoff' WindowName: 'fyxrypkddodhantfuuxmtxnmmbqhj'
- ClassName: 'zcxlijbuvziobfewuhhwacgkyrmdq' WindowName: 'spopfhxibehgmemzytfpqjaychtw'
- ClassName: 'bdxzgjxcbuqgxwrbddycop' WindowName: 'ixfpxykryoifixhnmkcpghuvweyg'
