Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\InetLoad.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'orpmoiioqtxbvvqjwosvfwkjt' WindowName: 'zueujmbuoqqyilfyc'
- ClassName: 'wubmlgyidmqvlthjjkgkscewgctb' WindowName: 'szrppxypdkdkqgpasvnmidtazcok'
- ClassName: 'mffcuvydbprzxzluz' WindowName: 'xsqxtpcdkbimiohfetucmqkpjkzknoyfdaimy'
- ClassName: 'hikbwzjdqfdvdjpldaganbkrfao' WindowName: 'uwqzfpvyzguomkabbptwrcsuzlprpuxh'
- ClassName: 'xqeckiwricxtllatog' WindowName: 'xbfacozgwddgczdpt'
- ClassName: 'egipokopeiwycbpg' WindowName: 'mzhkdfiahnreatdzbjxybkcoltsiased'
- ClassName: 'fckpgyhbbjiiuiifbddjnofkmfwk' WindowName: 'vgglxlhacqbvgqyb'
- ClassName: 'xurpapjglepmrkzfjqykwawcfpaqslrhy' WindowName: 'ynmfhfkhrwkaayvvcdwefahchkktkspunlzb'
- ClassName: 'ybtezntkodkaryk' WindowName: 'eqkxvcskqopbwimlleqdvnpg'
- ClassName: 'xgcuxdpsunwxxkmc' WindowName: 'arkzbqsbizakdpusfaozjlktcbdxpgp'
- ClassName: 'qcfzzhzrobspobyjxfbbve' WindowName: 'fbbtzvadzkpuossnbjdbbbxycnj'
- ClassName: 'rwqagyvdcifdsvqnhfuz' WindowName: 'hpzuctrnfbevynlaqyin'
- ClassName: 'yxrajyaxydzpirdobhwyzfluaaptfcoi' WindowName: 'ztkpyipyrwnuqexyqrqurnlhbaie'
- ClassName: 'khjbevclyjofrakxzrrkgcg' WindowName: 'qfejzfevmjnqvgozflcgvvuponwavo'
- ClassName: 'pszvtjgpdsnzcjkqc' WindowName: 'zqlknevhtnbgzwsypabfirjquvizieoeiqcx'
- ClassName: 'jsjxhuhauonbqaqfmzq' WindowName: 'ekifodbhrnfmnewcvf'
- ClassName: 'fvvfkfxsgdzcfcnaapxklrgfltzciauh' WindowName: 'kbzfznehktluejefxisjwdurvhixkp'
- ClassName: 'pkttbrsziulbynxntrmnwrhrrryzxalnsd' WindowName: 'hnrqoktmmlkmtfqmssyhjfscoekgxsc'
- ClassName: 'itgsawaisiwaozknzqhr' WindowName: 'fepjtoilwjblpuhrczbsxzcboeenztjbsg'
- ClassName: 'lqoxmqfcqgcebffuyoovlehtnmdkzlqpqcruruw' WindowName: 'ituatieplqhlouzqrey'
- ClassName: 'phdtkufukmxgtbbsvgbookznjllpnsads' WindowName: 'vxlhsmclwmkcobaabv'
- ClassName: 'qqjuzuqhdpqefbvnicidoz' WindowName: 'tlnfwpcbfbriucqhcqhnzirmxqrge'
- ClassName: 'vwayhfcdmmkdnvdydjcmyespcwqq' WindowName: 'xquhgqekxrbcyyaeruzebaduoqklghsdswngv'
- ClassName: 'stgwavvlshbfcyz' WindowName: 'isxjyhjkaytrxuymxtcplcwti'
- ClassName: 'sxsyaxqoeqcnpvwucrj' WindowName: 'jmmlxywldsihxqdpwzbtpja'
- ClassName: 'soyeujeltchntwisfxnowyw' WindowName: 'mpvcnnqvzjzrnwjgiuuekb'
- ClassName: 'ikutvzdmxdspihctvderfgjstvdqrfmd' WindowName: 'djmskyiqbwjhpfnfgbwtewjvmmkgfqzf'
- ClassName: 'uhnbbslhgytvzxhezfdm' WindowName: 'aevpvnbugnteikdptukbkfdmtvjmgsoy'
- ClassName: 'fjyaxdlqoqzzpmradfrhzeuaytyajvyqt' WindowName: 'fikzcxaixylhauysxesacbrgbbrzuxgl'
- ClassName: 'hdleuciosgzgxbfcwxssjwdadkwxf' WindowName: 'afbcdgihjgnksssegfebcuzdzojf'
- ClassName: 'ekwhojesanraawputmuxfmrwrjgcvmatl' WindowName: 'ypabyxteotqluzexwk'
- ClassName: 'xsyuyoalurmraaitp' WindowName: 'ajgoadlufcdszpkqeapiwyfggcynun'
- ClassName: 'zgouwpwyswoeqaylpryavhgwkycddga' WindowName: 'nbwetzskhakuplbqgkllkgesxvqzrjlutfled'
- ClassName: 'gxmiwahddsrehuwomoerop' WindowName: 'zdztjullgynpeloihslpfwkbeex'
- ClassName: 'kbdcqtqbsqgqilfqtxifcjqyglfduq' WindowName: 'hrbmxeyljblagefcmbtfbtoq'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'pvvucvsgichknvbbbemgzdcawdwtejhzb' WindowName: 'tdhoiwxnzprgsemmhkmrxodcawrowxusvq'
- ClassName: 'vhavnomlarmvqbnpolytudcpttsh' WindowName: 'zauakijlailuikyjubelkkane'
- ClassName: 'zsdolowqykbpbaqfdbspmzlcvysxl' WindowName: 'iuogklnqgrrhlvqyfqsjmnngnkyjafsln'
- ClassName: 'pwzpsovsnywieobvdstjbsfbqgtwwun' WindowName: 'smqmyzeekmpcmggaknejwwjfilyom'
- ClassName: 'xhgspwmqqmsasplqxapbqtutcpijuxxlb' WindowName: 'zryrhzmopuighmwyvhebimmhbp'
- ClassName: 'jmmntobonnzszmxbwlztasdis' WindowName: 'vzasuoqcvgzqslsyaucymycctjbiaxxpdieahb'
- ClassName: 'fljhdvaopvyjqkvoapydigtayhh' WindowName: 'npgldjzjdfxxlywrczjcuxuyxbiftflmi'
- ClassName: 'qbzovxplnzcqpnheojano' WindowName: 'imlqofstsfbvwplcbbwjypjvumdqylbgxzx'
