Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsa2.tmp\InetLoad.dll
- %TEMP%\nsa2.tmp\Math.dll
- %TEMP%\nsa2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\Math.dll
- %TEMP%\nsa2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dcdrvfzhugmhvulpfgkpasqtbbqydvddklppix' WindowName: 'ybddselbhessjexbwzvtwqqhcecesoebudqted'
- ClassName: 'lfizdhpwpcungxfkyantqswedabfq' WindowName: 'eidbyqbyyjbhxbrevqoljgbire'
- ClassName: 'ogvmltpkpbkvpgfgcjmqzbfvtwmjzmmtraq' WindowName: 'dwgqxnqrnpqbpziufsxvpdjftkdrsedml'
- ClassName: 'xnsymfyrpnqrvxfnnigbuq' WindowName: 'dhchxajckpibgbud'
- ClassName: 'habuppyhhukvoip' WindowName: 'clxxpfttjqlpjlmihudqjordfzfbetuvdvqb'
- ClassName: 'zprzyrtipwdzgxfyfqehxrdtmxjekvbhaw' WindowName: 'zvmgqlfjrlkyuwbqjfc'
- ClassName: 'himdvhkspydhwrhnlycoe' WindowName: 'mmmanewikeppdwbi'
- ClassName: 'cplkphngwzvfbkkldpebswchbggkbsivrakqmqp' WindowName: 'adybgvajjfpaodgzqtztolrppdgyr'
- ClassName: 'lgkuvtivtjmqtzqcxpbvvpqkqd' WindowName: 'hqjegseyrgsydpebq'
- ClassName: 'qnrkxolcuhkruwezmosnecyayotqiqopwzw' WindowName: 'pwaamsfhfulieibayvyreaoxrooyqlajlpoqfng'
- ClassName: 'dakioieqijeshmhswjpywbhmyuryokon' WindowName: 'depgnqirjydrbejamdrdegr'
- ClassName: 'kbtpnkmbbtoxllhychpbvqlimd' WindowName: 'zpbjtrnmyxaowdxrjhjypdkezrqksgfmeuuhn'
- ClassName: 'mbgkmmtjijxmbeduumxtbzojfvhuids' WindowName: 'vpxggiwggvrtwqzuyjrlggpggyvavkqdsnvkthe'
- ClassName: 'hqfqrwqwzalpyojfoelyxpqrcnvyfxv' WindowName: 'xbbrowpmynumpslnregdylakajisxhpxxkoucoy'
- ClassName: 'jfjqezufalddlujwgvucjcmhjzvvkysdcneurg' WindowName: 'sgmelymodkvppajhittucbedpxqxrwzwoxub'
- ClassName: 'jqjysebrhogxxhvehsbpjdjfotreyjxcr' WindowName: 'vipbdfbualecfesukhhglnfuqkpufej'
- ClassName: 'hnrapsdgbmltoyswwtd' WindowName: 'vpvwsskpwkkkecbmffjejzcpak'
- ClassName: 'mfkuieczvveqkszzlpyhztjnwtfa' WindowName: 'mefoqwnuamprgnsqkxptjrjromioqcq'
- ClassName: 'wbpseeevqkivfxzruagotlkn' WindowName: 'mdvayciokcmymagmnmiqtoh'
- ClassName: 'yhznuypdwvabcqpktx' WindowName: 'scfuxktfzdizieolppqczc'
- ClassName: 'vfahrrdwsdfgnexehcquzgojomybgety' WindowName: 'dcfdzszyvaodbtdyetsfgrhegkrrgbs'
- ClassName: 'awzvgxmwuvlcdrzywbwotncqhgatxq' WindowName: 'zgncssoqxsdtnfwmidctpdphtsan'
- ClassName: 'iikcewdfyovpfzacqp' WindowName: 'jzuhvybjjwuirhjthpxwmfuwzngmeurbswvfj'
- ClassName: 'cubylfyoblxnurucvtacqwgjbceqhyox' WindowName: 'fgcqriqwbhrptwxysvyc'
- ClassName: 'nygiyvofufpzgmfrfppzzgwwgbgsnibgo' WindowName: 'uiyzaqvcchvauaqndwdojkytyxlehwwyql'
- ClassName: 'bngkvbosrtvcnkxp' WindowName: 'iupcaidpfafulfnciufxyqfprgykxucbjjdo'
- ClassName: 'lazpwcpitrhmqolblm' WindowName: 'zenonohoytlqrxpfqeewyyk'
- ClassName: 'urbmryvrslcevntionupocriyldg' WindowName: 'zgyxfkrgvxavobuvvfqlqarlguupcumwowu'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'gsiiofxzklnspwxbugs' WindowName: 'oohmmvolivybppbvrmf'
- ClassName: 'vepiqmtmwmlxdpouqrdgxv' WindowName: 'vbnkhgiwaovmyytylamsoebythmuwqpjzh'
- ClassName: 'gdmirvuxunyhjwrfelgsi' WindowName: 'qrzeqodsivqliqtmqrjfdcddgo'
- ClassName: 'eeumqphaxntjyxgtwkvs' WindowName: 'chlxmslztcfyddmqyvvqdooksnsrvdldpur'
- ClassName: 'luvyntkqgpncebzwayxovwtwfirgdvgki' WindowName: 'eetvfpnzinbfwumlxotgvbtyplwh'
- ClassName: 'nmwxppiyeyvohwiubgbgeuvhxgjxaea' WindowName: 'nbnmkljvnumpbhwkygldosmqtmakbipcpupo'
