Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsy2.tmp\InetLoad.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\InetLoad.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'yffchmwrnhljrffcwaupbydknvq' WindowName: 'uzlfxiakbspwddboncpgevtpdskwtdsucwgkqrc'
- ClassName: 'qjbrbtnkrifjldqnisaa' WindowName: 'ypobvtrlfpjsmaujxjftam'
- ClassName: 'dzjndneltsrdokxbftgx' WindowName: 'ninsvlvdsofbvkyybcomfxebujhwhtmzfrwma'
- ClassName: 'yleldyneoopofdpcpivcfidqgtfs' WindowName: 'ujibblpygvhohyteunpvknzahrkdiutnfixu'
- ClassName: 'cntxntvlaczoruvboswcasdsn' WindowName: 'owrvgzkbvyymjhuojdszde'
- ClassName: 'ypbwrjemumeadmrxrrs' WindowName: 'dsjorabqateodsdmtykqoldxrhuqfkadlgogmnt'
- ClassName: 'kpihaqvgjrppypubjqxogcjtoglwxebcwg' WindowName: 'azfahyszdnyuuyzzpcxplzdpzipnnr'
- ClassName: 'yarqhobqiwjlwanuawhoao' WindowName: 'dgryfgatjgyqtgbzt'
- ClassName: 'ntoiizfbhjnttvxhfltnpkobywhiapa' WindowName: 'fvgfbjftlybwjzqbpopjpblzvspwznvf'
- ClassName: 'vzefxkdybkvueennidhwstbd' WindowName: 'baecbrumewlzjhika'
- ClassName: 'jdlcwgcfpqbeplqfxqubshtnzggjpuawr' WindowName: 'adkofvrwrkjwvhbbwdgvoswwyufrfpytts'
- ClassName: 'aweejvwzylizvbdbbqsbrdycbvqnuwiaovdzdmb' WindowName: 'kxidponeaukwtpczjmqdtblrspvap'
- ClassName: 'nqqcotvfugatufejstnhao' WindowName: 'owocpzazokwrkcvuurryjvizytihr'
- ClassName: 'qpdgapuiqbqpazbgtkxdpl' WindowName: 'pttmzhkrmiljwckbusuxl'
- ClassName: 'laexbpgkgduiewlqofpzeoitubqhj' WindowName: 'bmlyhugfqcdomnvnwfm'
- ClassName: 'zeaeludndcfgotknqficnarzboqtsyvmhug' WindowName: 'lrjfqrgcmppkcbpsqkrlejwgeoq'
- ClassName: 'xkaeenqenfwznmqcbxttwtzlpvzcmdcaf' WindowName: 'cstxymeyahgwahnljlmfoipuzefenrqkdm'
- ClassName: 'fqsbbtoiwzkdpqgzqa' WindowName: 'fcrxsnejpixqkagvzfrzbfqauey'
- ClassName: 'jlfxtgsaqszfzepvmspwf' WindowName: 'shklaaiognjjnfvafqcxzcnjr'
- ClassName: 'gggvmzigltyonpyvaacvpmrlnm' WindowName: 'tyebzowzwbtiptqukqnealmx'
- ClassName: 'catknvigjsiyedqqgobflkiqn' WindowName: 'qksuzszoxydxzlgkqbrdusauobwbgphm'
- ClassName: 'nhdmznvuiecrlepjloq' WindowName: 'dppyzjldpqmpbuscrzwavwtulqvxf'
- ClassName: 'anslorqnhbenoxlugbreywvx' WindowName: 'ujuniogvljaththprbvanwyyggbeqpnqihyrdx'
- ClassName: 'ovjddhrhucvoffwinmyzoyy' WindowName: 'pcjtfpimoohewdsdegqlulhwhp'
- ClassName: 'keumfsflkrsgsuddnwnf' WindowName: 'oamlqlrxwrxcirusrjqskpp'
- ClassName: 'ftdbmimimgmztxqqrwaby' WindowName: 'rnwenszyxuvtmzjzlnhddsacygn'
- ClassName: 'krgptyjrjthrotigwjbdrice' WindowName: 'wygfielxrltpqwhq'
- ClassName: 'ygqlvaxfitiotkoguvofuyyeylzpqzzo' WindowName: 'opvcpurraiieavbdyfxhqqbkvmihkulsbnngeg'
- ClassName: 'maziogpsenxdrdjdlhraqqsbf' WindowName: 'xtjycoymugodztnzpsgzcgnfbygm'
- ClassName: 'odkneigqmfgfblgirljyjqm' WindowName: 'xhockantmnntdkeffnrewkrygj'
- ClassName: 'rkurbtntqbuaskndlxclbipf' WindowName: 'dcisnxybtkxfowdlcodbeqlrqctc'
- ClassName: 'jglxgrxetogtoeb' WindowName: 'lheqractizdbpiilheezv'
- ClassName: 'blvgudavloyceywwaeggiorumazjmpzz' WindowName: 'avixiexaspgglyirwkgwlancilfekvi'
- ClassName: 'eoubpqvnwndzjuaeupsyfxhxytzqi' WindowName: 'fvynequsualedtatwaycgrdavxrwtsgcieaegpj'
- ClassName: 'jzudxsctpsxpiyjbrywmypixxoygvr' WindowName: 'oyxwyqgeoakotlvhozcgjwmpxehnl'
- ClassName: 'apizyhyntyrgtlckmjfzqqiiosk' WindowName: 'knqtsqtxfxzpmykjbyezqymajiz'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'pduxyujljkwiqqolwnscgyv' WindowName: 'ppedhnwomkecgcmiehnwbormgfjoniwjmb'
- ClassName: 'nzliqsvejwhivgqp' WindowName: 'wjprcqokwybalpveuqqlcktm'
- ClassName: 'ucriojrpmgpuakscigsgfh' WindowName: 'pfhqsdnlwtjhoaank'
- ClassName: 'owembfcprjywbnkaizmp' WindowName: 'wrmqxlcpftipvpgelyh'
- ClassName: 'gsgexhbyyojfbxyaphngghatlwxfaqgilbouhwi' WindowName: 'pcqpcwsnsuhyosgintdab'
- ClassName: 'bqodwhffsodkflembmbqtog' WindowName: 'guqstcilqyyudboyxinehdcuozbwisrftj'
- ClassName: 'rkjvqzuqzaovjjljwybtpbhjkueeqva' WindowName: 'gnbsfnvztwqizkctkuwwaevtpzrlstzcvlmbzys'
- ClassName: 'twgeldpyxpnfibtjtroiqqdwiwcbgb' WindowName: 'ipnttmxmrotdxilfb'
