Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\InetLoad.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mzdnqftsmndenjfoghkbosjxohzxyah' WindowName: 'pzarhayaqcssmtgaqakjnffazivsqi'
- ClassName: 'ahjtjtrdieuaaidwdtaapqteami' WindowName: 'qjgmrgclyofvkvstntmgehrgz'
- ClassName: 'wzozjitsqwzduglorwcghoxldoakdcavlzt' WindowName: 'wwbquyvheulqszujev'
- ClassName: 'bpdogwgixhwncstbapbecaokjdg' WindowName: 'whtbbrakgmwggisjvcutcvsefbfaoocopgvwnic'
- ClassName: 'geresbehgfdgbemwqbnwadagavljzicyyio' WindowName: 'lfrwixtrmdnkrsxcfkr'
- ClassName: 'hpvgvdldwegwoxmxy' WindowName: 'tdeihghruftrnaexcfp'
- ClassName: 'eamhdbopmpyepdjbutstamqgt' WindowName: 'iyvffapazwqmifc'
- ClassName: 'xuurbnokqidsgduxcdgeuxbxqorlnaqmreqvs' WindowName: 'pkdxqmqtulopmfoysjfhmspofm'
- ClassName: 'azndjekoexsnfjiquwgrrgqonnwyxinai' WindowName: 'lohkhmdqlwinvzociiblnw'
- ClassName: 'lpqxmtwyqdyqnilvjifzcv' WindowName: 'matizxkftaayozctttmdr'
- ClassName: 'mnvxxxuvfbcmzrwppczxojqwrxwbtprwnhc' WindowName: 'acslnrvgmlgkvwb'
- ClassName: 'gdgkwpjxfywqyycnujjakwtmudtsdicnolkd' WindowName: 'dixduseckpdchjbrpyyqfecjqbtm'
- ClassName: 'sidjmpbwlsnzcvm' WindowName: 'vfkmvvjutzhojrnkdmcotxgfhhxncjhzljns'
- ClassName: 'gkxpfhvowrzzycoxekerysplintga' WindowName: 'kpaqgvrzvtlbwasmiqgtjnlongxtfwugldhwx'
- ClassName: 'zqhmdjnoylhonhfcwfxddfpogpfnz' WindowName: 'tvujbtivlwvkscffvsvllfmkhhxqmehiehp'
- ClassName: 'pgxfavuzusxxdwm' WindowName: 'wuklneugrnzsryemfxjwnw'
- ClassName: 'pzozpmirjejaeocqywsoeqjgeouxjgcy' WindowName: 'yyldagexxhypphfilumdeeyitnbcnkob'
- ClassName: 'aatssaggxuthekkwjbrmanozhkjlbzg' WindowName: 'vwxcoqsziyzmerohlcmujozh'
- ClassName: 'nqjrhbpjjltdddgdkdmzlbhoqqqnsft' WindowName: 'nldslskqkztnupiwkiyqbocjcfz'
- ClassName: 'jlppcbhjnjuepjoaykyvkgrzi' WindowName: 'txyezcvsyshhluxsojfpwxngplnqotbj'
- ClassName: 'yiflqdsathikujerpgfxljtjwux' WindowName: 'hijtgbcmlrhcbxmntiycunfpwsnoissgxcquup'
- ClassName: 'zsbsfrbvrwphrsjnhnna' WindowName: 'xwvzdnvmlkcuorffactyjszf'
- ClassName: 'kxufufjfiklbraztx' WindowName: 'roytodsacbyracugpykyrqzltwfdffxyiyoan'
- ClassName: 'keuaoczhmxacftykpdtsaub' WindowName: 'bwilrlpxblbtmdgypjfpsgdomglvx'
- ClassName: 'fwfmqcpscuvphdgkbkrekwcxvpdjiciamybvgmk' WindowName: 'fedsqdthznwjoysxlorkbwniafk'
- ClassName: 'iujgtbzouebtpgvn' WindowName: 'awauvnggbohijdqggbzrdoabvymanwkdr'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'pxsaagipzqoklmheocmupuoupre' WindowName: 'nbmbwokrmrelndltseqzjrijozx'
- ClassName: 'yamtcfapmpgctcabruzpezamoeppsahxctu' WindowName: 'zsiotxobnejuyrldtwpmkeyfuvbbdubtiquago'
- ClassName: 'jeixcbbelcofcluem' WindowName: 'ouxlyxrzshkaadezlhvbcdnaxw'
- ClassName: 'evwxqdslzmdqzfdszivfpdpchcdyr' WindowName: 'amzsagfcpxrfeshzjdkzqkc'
- ClassName: 'mdlfzzckblngpneyjqjcbky' WindowName: 'hmjbgbyzagmsluvkauedyojfhfjsjfxxgqkyx'
- ClassName: 'tmxitdrfbuwlpofqbigxk' WindowName: 'htlmckgkvyuyremypvmndoxktaw'
- ClassName: 'ltpiyakyegkuzvtr' WindowName: 'bqnfbfewpvvboyontoeoqbrpdtesnlj'
