Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\InetLoad.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jkuhdxfpdvswwyfawbncrcsuwnew' WindowName: 'wiprolhsnxahykdidemsnyhrfqdjllawhkjvfh'
- ClassName: 'ndfzthndzxgdnfchuer' WindowName: 'bztinjvxykvxfynqwylgklfam'
- ClassName: 'uwhkadulvjxaeyvyprodiaynonnoupcbec' WindowName: 'whyxejksjgvnzqulvfkbxqakdza'
- ClassName: 'phnbeoyicjreygasqnxutnbyavmd' WindowName: 'muhtfvrlhsinxhpbnpyxgcddwarqauek'
- ClassName: 'cvjxkgqtzeukbmuwvvldnfzxvxoivifbxqgq' WindowName: 'vfeqhhkbnlptmitahush'
- ClassName: 'jezivqenklxgojekmuqfipkaagaelqddcbgfexp' WindowName: 'xdcjojfhmqfmwph'
- ClassName: 'vrgcxmyqmmalbquvppchlsds' WindowName: 'akpuranadtayzxgdpdx'
- ClassName: 'cyuepmnwbhzwjwvtkigporeykxjw' WindowName: 'savjjbuzkoszzqltkfzwitvvdctungrnes'
- ClassName: 'fbqspmsfreuvejdgeul' WindowName: 'qavfxpkyctkwgvjsragneihs'
- ClassName: 'hrspptwklzhdablpzcgkmgblnkfs' WindowName: 'yjwrsiuewxjiyhjxddiwqysiqq'
- ClassName: 'ymnafshltugkptlckycezwr' WindowName: 'pjhkzgeffqwwydyvyzfcaramlnpozmcn'
- ClassName: 'heegukugituktsoz' WindowName: 'jtzempzhoileiqypvzwzhkupgafah'
- ClassName: 'abqgabeiespnbgjqvuryhgtihbphm' WindowName: 'fbfyyienhuimeqo'
- ClassName: 'mrcdgqdvcyiigbsttwaphbjoyus' WindowName: 'jzzpwsipgxlxiyedsttxzoofkkxdzd'
- ClassName: 'illsrmtlmcvwnfcjdhwveshkoidqtahv' WindowName: 'swiiososkvvrbtffarctnbafwwbom'
- ClassName: 'fzubsmhdfdomwetvugmtavmpmmzfacthvcnb' WindowName: 'bjtdnfuznejlipnerbnfxnuxyoqngfrpkflxc'
- ClassName: 'xoepszzuzabfqsivyaanczksmepwjwi' WindowName: 'udsvezppgtefrmpbgkzhtkfbmyvqramyjovp'
- ClassName: 'jsibxcpgnxikmwyptwknifcebgzbubvl' WindowName: 'wcqqpsnkdylcirflnjkwbejto'
- ClassName: 'qoqjuatckneqonxrwlrdwfduogt' WindowName: 'qlorekgzekxphznbjjiegwjifxmlcqljdak'
- ClassName: 'wplovkiqrjaenxufemxoazlspmpzvqamd' WindowName: 'sambpsjfeqhrapywcejromcpfelmo'
- ClassName: 'fgamshkwkkcryhkqoaszeznhfzqcfvswl' WindowName: 'wpiwkgptsmxnskzhsrzikxke'
- ClassName: 'dnmsrzjfglyiourbzbogdfpnlfyhtyirltcrrmg' WindowName: 'shuvqlvngdxredllczuhtkptgxtose'
- ClassName: 'ccsavaykzkwcmkqloryihcnwrikjswkwwhb' WindowName: 'dyiddkletgaacauuwrocrpznstlamlak'
- ClassName: 'gvqwhbdacmtdsjscjvuoelmsczxpdfsnyga' WindowName: 'gfcsiccammuuqpwrhdsnhluujjctipgs'
- ClassName: 'iomxcbneuvnbklxpo' WindowName: 'maiewzzkojbbnatqdozumrhqqwcr'
- ClassName: 'ofybxrtyggiwqgsgwudiu' WindowName: 'vxgqdgckazwlbxtcwzertaeqlerzzun'
- ClassName: 'ujoqdtnyaqvoupgwx' WindowName: 'owreosolyajjofbswnxndokqkuuidrnqiraam'
- ClassName: 'rmrbwckvnvckrcbkefaqjmysis' WindowName: 'udzbumkrqeklefhgraymoraaykuqctosei'
- ClassName: 'hukcqksmjqxjtiguqqwehowjxcdaymxafv' WindowName: 'obwpltihiihnozeggidlfgprlgsiwrty'
- ClassName: 'efhcwymbgqieeftjtnxzvxxmkcbpb' WindowName: 'dhcjpklutplzahzrfaslpqdlbpescevsajt'
- ClassName: 'uysaccjkjonkyxkruyliurajvpzqoy' WindowName: 'gerfiaawbzcwpbqfzbjfxam'
- ClassName: 'kbdnqlofyhsojtlshilbpmihsadvujaak' WindowName: 'igdsovlmcpnlbtumbotajsrzhlqj'
- ClassName: 'tcpoejcbyfxgghhflnimwn' WindowName: 'qwvdhdruxwcdmttrhxcvlnfob'
- ClassName: 'jhmqsqriljhlsvxkxzjaxdyxbokigykgxteksj' WindowName: 'zgdrvwqnosjnfuxdnpvnvdxbritvozrggzgahdm'
- ClassName: 'atavtrhexmpugqrrzswt' WindowName: 'sdzovpxajhulwpcbpkvywy'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'wsjddpeaznifwynfra' WindowName: 'dmedukcmbicbxmrshpwarpuwhsxns'
- ClassName: 'ffgamovyvxisctrmegmhgmzliijalhtohctfolx' WindowName: 'bkoxzlyxspamgyhumbouhwh'
- ClassName: 'fmndagbnuxrllnkhrzjbfotudwkhookakfocn' WindowName: 'ujwftfcfveaunmirvipdfn'
- ClassName: 'nnrnpyeqtbmqpgdozwncbzllxcfyt' WindowName: 'locxgbpfprasctkkf'
- ClassName: 'khiznpdlvqppakjtpujrya' WindowName: 'ehcoaaxpqbvqiue'
- ClassName: 'cholrpmddjxjttuxwhootmlnsmz' WindowName: 'makijxapcwffbjclogmgujassabhqwlkrsqvys'
- ClassName: 'pjhwxezwvliafbisujjhccziyovmjaqqvpvbbl' WindowName: 'ijmbmhfsztnuuxpbzgjlyatnqy'
