Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nso2.tmp\InetLoad.dll
- %TEMP%\nso2.tmp\Math.dll
- %TEMP%\nso2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nso2.tmp\System.dll
- %TEMP%\nso2.tmp\Math.dll
- %TEMP%\nso2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'zpywusffoionxscnu' WindowName: 'vgvhflbkntnuvfncznfvf'
- ClassName: 'afypjsmkmcrttalsmjkuwz' WindowName: 'xxqxkwjyulgkqhwqsyxgvqqeljtndjzowqxw'
- ClassName: 'mcoulzfnydcbhffqgemzrjoqzvqf' WindowName: 'wkudcjpdukubxsywotwtdxzo'
- ClassName: 'iukyvyuxpbzimvdgiejxuqupjcdf' WindowName: 'smxbgzubjbbdznlzd'
- ClassName: 'odpndhghifyptilfk' WindowName: 'spzobtrvwhzebrl'
- ClassName: 'abozqrdudtrjyhpkkemwluqd' WindowName: 'ubntsudyptzrdvoknunoy'
- ClassName: 'gbodhicmtwpndksjycjwsezrpwtyhmug' WindowName: 'ndcupfpgnteyilvapkqvkzvybsy'
- ClassName: 'toywpkddyagfzlznayfwlvmho' WindowName: 'gsmexqjtazslihbiuartmsantfgjvio'
- ClassName: 'qskhuzuautksbmofrgnlvdbuiidyt' WindowName: 'dzhbbcrczkdyyelblcfyyutzrycugwcft'
- ClassName: 'nnxwyyoaerjfyoaleummguwcclzoygkhq' WindowName: 'leluxdylrapicokgcqlw'
- ClassName: 'intoorcmvrieenlhcqoicplpogggqnmeninr' WindowName: 'swgopnszmejqcodhzsbkkybmubhtwfnanw'
- ClassName: 'fogdpflyuqgczcyd' WindowName: 'bbworcmgtpyvikdssz'
- ClassName: 'wizrceabkgsbxemfixsm' WindowName: 'cjtjbocqolbcenskuqzrjrengxdksbymgsr'
- ClassName: 'jfcptjlxexemdthka' WindowName: 'voxputarjewfmbebedh'
- ClassName: 'tcfdudkmujpokpgqr' WindowName: 'lsflvdaoqsjkffrqzhhnnjchxqdpbddltnp'
- ClassName: 'otginizjgkqgqrtnjpa' WindowName: 'vqxykbjyitrbanhpfirajifqgekhrvqiu'
- ClassName: 'ulbynbsavvqipkiokzdoufumvunxchmfehqoc' WindowName: 'ltopmgzunpludpdnvsydejhngtjtqiedxxkn'
- ClassName: 'fnqcgxrerxzxwxcahaqmjdgwjuuygtukbkcxpl' WindowName: 'bqmgferzdmbmoru'
- ClassName: 'przgqrdrpcyzhcwyixecaa' WindowName: 'mlxzdyzfzseutqpyqsfnshj'
- ClassName: 'pkeotqabhfgbhihkzwgrkpvgkdz' WindowName: 'vlrieesfhutaghkhddjebljmqopx'
- ClassName: 'zemqbuhenkiajbkyylldjejdbv' WindowName: 'yvvoivmwtyvofxgjktrbjwyrwvawoluyqoiokn'
- ClassName: 'nqttxfkekmgzuuvkcnstngkcmpmralcvurc' WindowName: 'ndzolcpsizbodsturxdweas'
- ClassName: 'qvqovnahiffzkkbxopnsweiv' WindowName: 'mnnbkkgdfxzycenjadgkvpewrfxr'
- ClassName: 'thwzkdrvubymowyvwbipfalurnsg' WindowName: 'gnbpbbmsoxseazcnlkrlxp'
- ClassName: 'rltfaxqtuxlmcnmrgyosatztg' WindowName: 'kpjgnxrttvsxhnlnyckcvmlvbyx'
- ClassName: 'olvlncjnbcsqvoealrcijywfgqvcctyncwdftb' WindowName: 'iysprqtboazfejxfewbybibfnqcjmwsyju'
- ClassName: 'apidrxhrzajilsadnxkkgaolye' WindowName: 'mqqrbwbeqieshvqdwp'
- ClassName: 'cvtidztzgiaheesiikxl' WindowName: 'sfpmpsvttcexgrwysutwlkjldwberrkmvgzin'
- ClassName: 'ezccegztrepdybwloegjngslmsosiyefxkr' WindowName: 'ocqctbfoohqbbnybbryscgdieckexmcwcaqg'
- ClassName: 'txgbqiozflgximjmw' WindowName: 'xvevchusnulfzbxnvhuwurwwqynyovrizdg'
- ClassName: 'xbyptwpukkkzremkzfiuqdkxglfvlc' WindowName: 'zcicysfzhhznttsmct'
- ClassName: 'zhzjuetiwkeeevftmzhtoclhrvjqnqlzm' WindowName: 'wbvwnxvwhcbgngnunhipolvypnuemv'
- ClassName: 'weudtgktnwyyqdtcprkaakb' WindowName: 'cnxngnvdqtuozdktkbsdjozjqb'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
