Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xpoznafnunnzsrwpo' WindowName: 'wmnzhgvltnqjknsbjuxudiaqrdsfynyypmtsmxl'
- ClassName: 'afboswejkdwzpnjfzadelbgxffdrmr' WindowName: 'cyqqegfgietpxwpqtqkbemxyojlbivve'
- ClassName: 'ombbtixjwgtrxzsnozgcmkszjqnfdujjpgjf' WindowName: 'ramjcsaiyijvszvonafrznly'
- ClassName: 'cvzddkabkzptmfyz' WindowName: 'pgoambfruubudkbdclyzkposstzhbcbuqccd'
- ClassName: 'qksriexhfwgnufyvmg' WindowName: 'nhwcunqtnnqkpopxcwlchdnyab'
- ClassName: 'yhdcbhdmnyhfylfndrnuwvzaak' WindowName: 'rzrktirsurbcxgoksekg'
- ClassName: 'muxslabjwoysitooiliidlybrsfwpmsyxy' WindowName: 'nwplnpkzvloukeulokpefn'
- ClassName: 'mtwihnfcynmmbajinjrkuovrfsckcagilnzqr' WindowName: 'iqludqmtlimqkhpxmuashgzytjopafyk'
- ClassName: 'itwfdaeccmuburawyosvszpegdjii' WindowName: 'fagvbrkmbmkrrswipacqnvyveuqrqmp'
- ClassName: 'qfyufcviiyhhxyh' WindowName: 'jqpyfiroofuawxzffeezbhylutohweaynbyfe'
- ClassName: 'dgzruxpltoeeevk' WindowName: 'swlbxvjkqlzdfhjkpowce'
- ClassName: 'yxjvyeuhxamxixbeoufmvqzcejgxiffhpd' WindowName: 'xajuevkgstfhvvqu'
- ClassName: 'vczfhbhzzlnikphbyufpnqyezjgtonmrvjqrtin' WindowName: 'mcdvxgoydkviciugk'
- ClassName: 'bhwtxyzlsgeyyycfatx' WindowName: 'ichjtaqoheecnvyxfwpnaqzrcrtrrx'
- ClassName: 'hqwpjeiyzrpklhabdwlavsijgxzfqcfy' WindowName: 'gvyofbbpeeujlsjppdhounutomdzbjjl'
- ClassName: 'xzjvhfyfqkmdqyozsqvmagkbimaujcqk' WindowName: 'vvktcbesrcrnuxdmqkqbzu'
- ClassName: 'gadaopyozcrcpkmsia' WindowName: 'thbhrnrgmpbvhaghxiybvqvvawooyssqyfkbabq'
- ClassName: 'sczkaovlijnrfhxxujxptarwh' WindowName: 'nopzluwaddffejnyssxvpxolfvcleasi'
- ClassName: 'vqcwrvitwdehlszbzjpjkeveekd' WindowName: 'bepqrocgrfvuicwjpnfithlpzjjw'
- ClassName: 'rtrbkvpzoijxszdlext' WindowName: 'bvsebnycehwwtigtinm'
- ClassName: 'qnaggjenkfuhkiytzwcpcbbhxvqqqxuxtmzxtha' WindowName: 'czfwqtyzetzpypagogdtidlehrfnakrcfut'
- ClassName: 'uvfgfcxajswzkigkzvu' WindowName: 'nrklpzjxbvmtnmbnamuttpalfrxmxvk'
- ClassName: 'whyqokvnkffkhmpqevstbiycscx' WindowName: 'bgjhpxdgkjrmmpkwthtmzxd'
- ClassName: 'gqmszcurpzcqeagktjgx' WindowName: 'wmvarjisetauwpfdgbkznjudxkelnjwnlzxb'
- ClassName: 'lfnmnimtddbujmsmzjhfbznraje' WindowName: 'klbsxgffnwejsnsfbfnezovfvzcofnnfiheho'
- ClassName: 'wkvoymghjpsftcunsxtaglvaxgk' WindowName: 'quktbvljkoxojuhxolprjxydgfjkerjddpgfr'
- ClassName: 'cfjzpnsjrgdvqtneoffmdpx' WindowName: 'foyaqxpylkexnlndcendokowzqlyyuozjalsaqe'
- ClassName: 'qumiwwtjbsvzmzcpkkmfmogjskmyeaapx' WindowName: 'xhjrsrlozdodndg'
- ClassName: 'tmmfopfiwokquikof' WindowName: 'cjjiaibbzkbbtadhrxvwcfpjutkvej'
- ClassName: 'xpoobdgbqxkqndhbruwgaojjthil' WindowName: 'kgqwwanoapdfahrdjijmkfjxsnhtew'
- ClassName: 'gutlbmerujcrsmmiqjqxbzjlhthvrykojv' WindowName: 'rqcmdwqpicqgpcpldousp'
- ClassName: 'ccdnzzrrvjxmyai' WindowName: 'fiefjkxixxcvldtcpyhgnjmshjhelsaucq'
- ClassName: 'nvgkudwyedexfnnyy' WindowName: 'nxxwwgtkugbehiavfiwzjtwgvcmmieehjcv'
- ClassName: 'rjuzwyzbprtedmzlhelrnrxyg' WindowName: 'nyjvevushbqrajrgsnu'
- ClassName: 'szscutsepalhgptygptjzzdjkjecyn' WindowName: 'ricxcprwgbqyjaqgvdjkrosuqedfelkv'
- ClassName: 'ehffynkdrutcuceqlhanggsyycsqybsmzfw' WindowName: 'bpzkqacejacahpnniffzoh'
- ClassName: 'bogeyozzwowfngdskddvxafazgcrokjhc' WindowName: 'faxbxbkiwzumxeejzaoiayeig'
- ClassName: 'wqbgwlzrubuozjyts' WindowName: 'ypfnzwlsyshdptrjqtfejvfzqdnxfijxivz'
- ClassName: 'rlxarncwasznarjcfhlrimfyycqucq' WindowName: 'mllngnfqhmfpvovnmkqpasqnspnwhqlw'
- ClassName: 'jgncissxtposbopzlhsmsi' WindowName: 'hlwjtripxxiqggy'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'sahoumzkkjbuapjnmtqvoqukz' WindowName: 'sdxuorxsvajzwggdowukj'
- ClassName: 'gwyjuinwljnyxedigvimszvnuwsbvanwmjphhg' WindowName: 'ddznyuysbcsokypmtugfdetehv'
- ClassName: 'xososuljekekpwuqjyjopdsdj' WindowName: 'gxqpauijohdykmyxoesukxydyiwaegn'
- ClassName: 'nnywnqyrqbnbjlbbdmvucklvxomoerkj' WindowName: 'tngcnmypkehvahhfqljrrkqwe'
- ClassName: 'golkawlpgdqlabdf' WindowName: 'xzwvaebcfyknkqconxkyu'
