Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsy2.tmp\InetLoad.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\InetLoad.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'nsrofwncktywiuqyhporwxmskjvd' WindowName: 'ytmnejcsturvhvfhpbbkwgvkm'
- ClassName: 'tcccpxyzphazkdsjqofh' WindowName: 'jijonpsbbpvvmhpgeo'
- ClassName: 'jxaksfvwbgzudnagqquwidbmumyiamavyvnjp' WindowName: 'dsldtmlcqngebxwardfnvbrberpb'
- ClassName: 'vvdsgkxttbhasygqcucaofvoyvzszmsxtvoef' WindowName: 'qvjfweisrmukhhaehchqduurjabotorcido'
- ClassName: 'nyyiityvjfqcqcxsdtrvjjcrwunysh' WindowName: 'jgeacpxdmwudayixbasfednxqk'
- ClassName: 'tyulxjzouikgweqkoszx' WindowName: 'xvgerfxnndhpameffspqugyekd'
- ClassName: 'mxwkbjfknmgvmfw' WindowName: 'mdkllubiucquwvlmilyxgdrrsdgnsqopwosoybz'
- ClassName: 'ktkamahoedtadnpuwqyar' WindowName: 'drgtpegyutcagldtyblbot'
- ClassName: 'dnkonnkkfrzlcmaxtkn' WindowName: 'lzovhzdmgiayeeswfasehqfkuctvvaiurlda'
- ClassName: 'daavskwdmndngzhqqwfawwbcklt' WindowName: 'ltbgtlbmqckpsuuwsknbwnjphoisfnsk'
- ClassName: 'ajeujkmwgqmbirccmkwektssoaadlqwkrqtygz' WindowName: 'stlnulimqeycbeibom'
- ClassName: 'qpatvomexvbfzdcqnulmnmjismwwqsubksch' WindowName: 'nreefgvuoymupkvtjrxnvvizjva'
- ClassName: 'sqxtvychpchgbepvrxikfoumelrsuwkylsphkaw' WindowName: 'eqjnstbqfmdccqussumkm'
- ClassName: 'dkpifzivgkmnvxehmdkkvsatnto' WindowName: 'iahwegpdpfhhrirkmbglpgtllhntsslznkg'
- ClassName: 'wrrslzwzpszplpf' WindowName: 'ebumdysznbuekozfxmavezmo'
- ClassName: 'ktvwnhpxwjbjoyuliqe' WindowName: 'xvjgfxftazusnpmwahpvwjaqmsrl'
- ClassName: 'uajbntbxajehaacbgej' WindowName: 'ehwijpucwvpdvmqybcqfabkr'
- ClassName: 'coqilkivfpvbyngbdodrzpqukzqtwvhcbci' WindowName: 'laqbttsbwwogtmvhqjdqe'
- ClassName: 'rytppdaqrlehmiyehtsrbcffqiuqpwytaf' WindowName: 'ygcnlfqhpwzufvodzqeaof'
- ClassName: 'hcrrramjyftmpaxwtspst' WindowName: 'kzrhzrbaqjwiadrcwwcrjqzjszjlueul'
- ClassName: 'divhzxaowdmiwmc' WindowName: 'tszfghqpepbefyhqjstywx'
- ClassName: 'ndaeekioefffudggbewxbcupxa' WindowName: 'aursozbzhrxsapakgegriqbnscjof'
- ClassName: 'mqnakdoqxwnbwxda' WindowName: 'zhndmhvlvetbosidvgy'
- ClassName: 'tacjtlpkjwpxyeayvtopdkrnla' WindowName: 'iwhhycfwqnsxqnvjzjxrrjghcphvpnylwd'
- ClassName: 'rdzfywethhqptins' WindowName: 'wjhoxyirelrqogyhy'
- ClassName: 'iwscldwzslwkwkiiuljxdwmybfwrr' WindowName: 'bhnwlunclslgnwkwgwqpqraucekipzyrgxaf'
- ClassName: 'nvztyjhgsjebebwknwxfocwztg' WindowName: 'ncjyqonayudvzzmnudjzzrctdrixfuvhisqwr'
- ClassName: 'nkxwkpjwwzsvsqcxpdlsegruozahlhpujvhjgxx' WindowName: 'yuighetkmkmnecaznlanxpiwnpcfhrhwpiw'
- ClassName: 'eermphnwnlthjavbdqxdusfrdcoquz' WindowName: 'gjbawbrruiljzjpymmdojkbtk'
- ClassName: 'wmygttcelsnyxwsvqt' WindowName: 'ryfgdnwxvjceklstmxirvi'
- ClassName: 'vfkjrxjxungfuijyxwrdonzvpdqlgkqzjrkj' WindowName: 'xgundqarsfuvmjsrtdskohptptznzsoqsxrpya'
- ClassName: 'zsvtqtidsnladfjyhxqjlqigkqeexgmo' WindowName: 'jwaszopkctidoljhc'
- ClassName: 'syagqivkwualktvvjpggkrovryk' WindowName: 'dppvremsvisacaezoxisatjsjyosbxwgbvj'
- ClassName: 'cpuvfyfrfyfwagqcwrnmphblmwcqhqtsc' WindowName: 'ecpxycryjpudstbzhhzrwozoptj'
- ClassName: 'uaqpnrgzxeslzpacfbddhvog' WindowName: 'upbpwmkoqsgxzggu'
- ClassName: 'paahdfagzqkexpyjdymafdr' WindowName: 'fdhpdrpcjfnukoypjzyoj'
- ClassName: 'ljqqbmjdjffsxjadnwuknxxwdvngbumxygd' WindowName: 'rsxenhoybnksfunznlkywddm'
- ClassName: 'glntzewkytcqoyuldbwochfghxwkhanujmlyx' WindowName: 'jtaknrucfsobszdptoluslpy'
- ClassName: 'ywktlnqhamuqxieswblqcwa' WindowName: 'wpeiohnhiyabatfrxpyo'
- ClassName: 'favtjjcbnldienmekpozbtyrljnwbih' WindowName: 'qpeixffilokcfsdgniqitxmvnkkvmlecgm'
- ClassName: 'rgvlxgyqgpdpkzyr' WindowName: 'bdflwykjhjrdvfqcnsygbwzbc'
- ClassName: 'wzwalkmeiebitbffmloxzdpuuxhucxk' WindowName: 'mzgkpulfedtmnygugvhttcvmruj'
- ClassName: 'rvznzboczsgrcqqxfidfamiakwfjilftlnn' WindowName: 'zrczeszaawvjzcetpvoddyixivftciwiaih'
