Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsb2.tmp\InetLoad.dll
- %TEMP%\nsb2.tmp\NSISdl.dll
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsb2.tmp\NSISdl.dll
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\InetLoad.dll
- %TEMP%\nsb2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bmcwhlfrnqqsdsyncxvbvbnhihedpc' WindowName: 'glbaoyzdzjltzhhdqcsyki'
- ClassName: 'qzfknnxxsimdcnusy' WindowName: 'vkbyucbzanohdualysylcgrfzk'
- ClassName: 'zikwvpiincmeejk' WindowName: 'uqwrnyzfhostvybbsowllckliqozhieirkbahe'
- ClassName: 'sscojfndgthemnfcigdofexsvne' WindowName: 'olpdjqyovqmiiicgjjiwnsljkzracg'
- ClassName: 'kjqxjaajulircsurwsoc' WindowName: 'lfefpwxuoazxnopgvpckrdvhtkbmhudzgtbnkl'
- ClassName: 'fifobhvumewpmorgzpwsqlqztsisahrlhhdbfor' WindowName: 'tkiipxkjexazwkirdzpynkggydh'
- ClassName: 'kqghqhyllqafrgllzaevourffw' WindowName: 'cscuzdbjrzyihcetotvlijo'
- ClassName: 'hyssgkzivklhpccpuxs' WindowName: 'jumopiyohkmycro'
- ClassName: 'csmubmdtbpkbhdocnkjmljgvd' WindowName: 'tzpkmdxilymoiyhrywyhhvjmqrvq'
- ClassName: 'maorskmdsasdugguarhuaj' WindowName: 'cytfimjyavxuxhrymcpwyqycrrpuruwcljkoro'
- ClassName: 'ynqqqicvmyjlbgzsehagvhmzdpm' WindowName: 'ysxlsbogwahgwopiteuhffdompd'
- ClassName: 'xgbomeutlymesiwsixezbodhavonhslyrlljvvh' WindowName: 'ijkcyitlorcdyzjsudzknocsesr'
- ClassName: 'kjkplpgpmfawsagjb' WindowName: 'rdqcpzztihgmlztrgswriabrpwwvlkm'
- ClassName: 'ycdavgztdwmpglgxejemoumi' WindowName: 'dsdtcznqyiwclmwwtfnnazblosz'
- ClassName: 'bujarrbfybqjsxyvewz' WindowName: 'nqjnnxoxippcjhotadsnf'
- ClassName: 'bextcwhyzriienqwetqaui' WindowName: 'ttvqtxvhrinjbhd'
- ClassName: 'qasqjurywfqnfopcrqrzcyoloucekzvnrqk' WindowName: 'eqmefdqdbzjzpnzukqhb'
- ClassName: 'ihzsyiunsakcabulwkzmtlebrm' WindowName: 'ccentodpjfpoegjj'
- ClassName: 'ybxqzkbdjdtlltvxxmaadnszfiqhmyfqztzhht' WindowName: 'xhgctdbyjmplbjlystaconcuhco'
- ClassName: 'apjprxovhkgjbxjczxlxbopyof' WindowName: 'damcfmtmdrripkyiuryje'
- ClassName: 'bryvkoryiecefkjjlpxcufgndxoypbean' WindowName: 'lztriltujypexgrjfipxjyayxeriqznxtjqwwa'
- ClassName: 'rrrotjrqdjczvgdszqyhngb' WindowName: 'ygmumvsxwflmzlfgutgdgorwmuqgfqnxzfkfyll'
- ClassName: 'pqzbaanmxofkhfwymj' WindowName: 'lkzbxayycbkrprvwrrohrybehnsywkkozwyii'
- ClassName: 'vnsnsikmqgjxdgaivspgdwzeocsiqaa' WindowName: 'umaleamufdvjgwwfsxwylcfgkepmvqyifuocecl'
- ClassName: 'lxptctzgfwzvcxxawalehqbqwajfsq' WindowName: 'fkhwwtaxaqxmkhihqzkhftjlppxhlvlxaoa'
- ClassName: 'fxvelctmnarsqbzllotfiyytr' WindowName: 'rwfigvbjxbjcmzlkirsfxbzcewjtql'
- ClassName: 'khgpgpmavrpajqrrifdlrcufneej' WindowName: 'jjcefbrwsezsukvjdjrfbo'
- ClassName: 'wxdwneyvnaqebdfcdqognanocriic' WindowName: 'vqtmtwijjlcpvckvzlewogaowgstohhhol'
- ClassName: 'mszeqmfajoilowukwvlawoeoindnxwgcc' WindowName: 'ybqxbhvtixezqvddguqgcjwrpxyvm'
- ClassName: 'kcurgubwtyewpulz' WindowName: 'pmuenvnipiesusfzbrwslihxkewouukcmz'
- ClassName: 'umiozhmivainiepnjmwdbjaviuxmtnk' WindowName: 'iilbvfsabpkwdrllfjnpqvodri'
- ClassName: 'oqgytsidakbmprksnimdrocsyilyvkqcemfq' WindowName: 'zeztpeahpqxyfgwodfmymkmasguudrrhzf'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'owvtikegvbdmfkvzuvraeiu' WindowName: 'gtfazzfrtnxygredrqoxvpysbrkhzerxapeksb'
- ClassName: 'mlmbjjzfoiuwlrro' WindowName: 'gnndlgcvcyzullewxgozem'
- ClassName: 'anlcublvrijobuacsdynvlgxznuc' WindowName: 'tvuyltpcxbycrdqckqtxsa'
- ClassName: 'rjtpjfegvzheagmiwdoikvvswjpupaxvksvex' WindowName: 'eaeilteutjcxstqv'
- ClassName: 'zoegylgiuvxzbsynsdfcizhlmag' WindowName: 'jfpypzvzuofpygltek'
- ClassName: 'bbdbyjqnwbiqvinirowsmxyscarljxuu' WindowName: 'mbijlnkewxoehtjlv'
- ClassName: 'mkmhtotsskoaxeevivlzslmhdmmqqgnjqm' WindowName: 'zqfppjmwmsitnojlsm'
- ClassName: 'eggjxbotfxyqzpnhfbkftxlxjrgsiaezlfum' WindowName: 'sjdnmrnplnoqcgfnigrlwsxqcicyuimugdaoh'
