Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\InetLoad.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'rhglfjqeygpzuoeszvbfogqhhydaapubksyvlz' WindowName: 'pgqoyulidztjcwlgscsgw'
- ClassName: 'gjzjdgktlwhzazwf' WindowName: 'oithihgtqowfvqngtwxqaenbokjhciitp'
- ClassName: 'trclygtwzaukdtzwlfnnbfckumscl' WindowName: 'hmcmggwxbfyflzetbwgupvy'
- ClassName: 'yxoygkxjdftplhuhamfqjaapgnyvnvskxqakl' WindowName: 'krhwusxqrtouyidtcbiycsoffuboplv'
- ClassName: 'ttxpdsqaghjkypkfbgysapwonguminhgfjbm' WindowName: 'xhywjczbipfcqjrlsdgmdwwydxiib'
- ClassName: 'zbtbcwdjsamiibmdz' WindowName: 'fnixfvzfzzuebyvpcfkjwdd'
- ClassName: 'ngmzjyhrvudpwdyses' WindowName: 'ehpaqyumjwkijscdjepbwblwi'
- ClassName: 'kaatpgjzfqndtlnsjbgvktqapxlf' WindowName: 'clhsmpwvsjspfpyvxudwurfpffkeihbo'
- ClassName: 'oxdsakjgtfilxvnpawmw' WindowName: 'pqzzoqyiipgbyuwkbgbgfscpsrzjuhf'
- ClassName: 'qslblbngargdgki' WindowName: 'anmbhfdpaqijwllbpotnqhr'
- ClassName: 'topcvmldfnrzbabyjludpkzmcne' WindowName: 'ssvphptpvdwoorrkwerq'
- ClassName: 'vvapigehkipgvlpjfcuiljrtjuhcsobttqlluhe' WindowName: 'gvjmgudxyxlczlfkvofcngqwt'
- ClassName: 'tqseztqewywlcshxhggfjsbltuob' WindowName: 'mapmawemktkgwrgitnrcxfdfzbvlcmguppdr'
- ClassName: 'aidzapwdtxtltceqkumlzggodoylijkyg' WindowName: 'cimzjidhkjqgzddfrrfal'
- ClassName: 'hmqwhkchdkibysqykzbcvwzwvtav' WindowName: 'entsuyhbzgaachenadjziqiswzgafnoffsswrm'
- ClassName: 'cbltnkqqmfewlpacwce' WindowName: 'nwootfojvhhgqgwdulsibumdrsxtlobgpb'
- ClassName: 'cfpvreqxwjauqngihlvndnsyvhtwawizup' WindowName: 'aflyorweaatqzmmtiihfsggz'
- ClassName: 'zujycybljxyjnuazwawmtiifedwrzqsiodgnc' WindowName: 'zulordehaseoqevufepmisxsie'
- ClassName: 'qpkpgvveqzrcqtmqzp' WindowName: 'hvvajzmfqpwcofhyyaflzrvhgucxwzfiyklmdxp'
- ClassName: 'kmxhpbsdjjwiasmvhyvibistqsajmi' WindowName: 'jqbkudfcyrdxvifazta'
- ClassName: 'jbungaezpbzxihirmncwzy' WindowName: 'uxunxolupwxddrlkobmzxejtjnuipwibhbvtfb'
- ClassName: 'nebvqqgownurfvvbyenibyflylnox' WindowName: 'ndkubioeqskyzofyepmfnfrqygpouditf'
- ClassName: 'uswjixyqomvpytcaovfjwnbugvaxqkh' WindowName: 'rbljywmcbwtaxwpairzqpalcaybc'
- ClassName: 'ufxgbjaqcacjyuyizritlcwjdkpszifv' WindowName: 'iolcrxciaslsthbdmpyvhkjuhktyxwmmeenvh'
- ClassName: 'gryocvqmaohedxnegu' WindowName: 'jzkbsomsepohaqzwqiv'
- ClassName: 'cldpbvrmelaftgveztexrgdkuxyiarl' WindowName: 'jcuhodmtiieolhcux'
- ClassName: 'lahwofxwezvsalyyqrnvwhnq' WindowName: 'imzedfpgkgptsivpgplmfpteltoxkb'
- ClassName: 'angzmirgslgejaeokcwhliir' WindowName: 'uwvbsisvpkamtkdhwwfzfnlvns'
- ClassName: 'rutqqpvwawxxikjan' WindowName: 'knvnfnirhrnuattgyqwkwvkmpuwl'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'tihlrabcjsfthtrvinhucfdoifpwpdo' WindowName: 'bagzzlolhrqkjfwdyckxjwwvllsxpojsy'
- ClassName: 'naeanzpmycayyimdie' WindowName: 'lvayqxhancinhqwaohtujqyozxptzkg'
- ClassName: 'xqsiszcrvyovgzvwcxomotplmiikshccszjgbo' WindowName: 'vqxmkoscyutqfyqyeidydwbjlyidgloqdn'
- ClassName: 'fjoleezeqrfxbnxmxpkndfumvyw' WindowName: 'adoosrchtdxecnssnkanw'
- ClassName: 'igoetcxewwejgkmwsuewjcnsfpzvhecu' WindowName: 'vgacctvswdmawgscdfznveganzdoirkggtrdff'
- ClassName: 'gsrfaqryjqczcnigjeqzgynpunnyoo' WindowName: 'aiqjtmqostezbgeplggtcdymqz'
- ClassName: 'nhskijafsuzoohlinpvxflbpjoioidiihbpq' WindowName: 'xxpetuqhcxuxhfemxbwlaxkpwmrlyc'
