Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'auundlyzpeavpiphieszl' WindowName: 'qsqvasbilsgaekrpfgiccnl'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\NSISdl.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\NSISdl.dll
- %TEMP%\nsv2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mayvmnprmstyszpaf' WindowName: 'xpjpoiophpsweualomrjcqzazebjqvqftnzsy'
- ClassName: 'cspzkxmvkcfudfglwsunmzxtkm' WindowName: 'iimrfexskphtulveljpysjwkswxp'
- ClassName: 'dzgjlaturcpxishjocmb' WindowName: 'ysejznrfitysmztersoixlprk'
- ClassName: 'gawouvpnntlreqkpjoqxibpx' WindowName: 'dyzguownapogmqbmfyyk'
- ClassName: 'wahqdfaqybkoepgzbwshwl' WindowName: 'qfqawudnspgkcbrwawwfzzjgjaja'
- ClassName: 'fijsrcyttmntantljncmhdspksglfhldg' WindowName: 'tznxgcfwwlfveuooxpeipvebuyatfdcxjbgecmv'
- ClassName: 'yykwobjddkknvemuhcsxwmhehu' WindowName: 'gubestupjsoehfzeusqfmgejlcflphlzmt'
- ClassName: 'mkhmzehimzfijdaknwkurdjpebhsuozvxxywuh' WindowName: 'ryaygmenuunxcdwmjrvbf'
- ClassName: 'sepedxeosbhgbngmihupgjyysid' WindowName: 'pcznvothutmddvdfamchkrjkllwwp'
- ClassName: 'yjcajnvcqgcpdnkzhagcctxwzqjbzequarzd' WindowName: 'aivwqwebwbkhvllasrbvygyyinqqwutkndgpl'
- ClassName: 'lcgaexxhewcxmwshg' WindowName: 'sefdkexesryuohudvxakicklxydshjdza'
- ClassName: 'yrdbihvvwzglnpnsvgmihjpsjpnknuybvoeiwo' WindowName: 'mcwhixyuqtjfvoheodubi'
- ClassName: 'fymyqzfbikaijbdhhttgdjdfscudvytortl' WindowName: 'jbkrimidaryustlesyutpvimii'
- ClassName: 'xivkcquwgrwfumgwjnfmlmdexg' WindowName: 'utsnkuzcxvaytdur'
- ClassName: 'aeelhzhosjhsoqchqcacinfsaug' WindowName: 'izzqbystxixpxndybyr'
- ClassName: 'twldjowihdvoutrinnxtakzeaa' WindowName: 'ndfadhimpsxvnvvktpivvwddzpfspxgwqzdu'
- ClassName: 'ulmewsrctcniewmtglfwvfvrmtdrzk' WindowName: 'gbfwstwbnowyymetddby'
- ClassName: 'xhiujkazhcsllnegjthlblxfo' WindowName: 'zimxxgnixytoiqjbuvodewljpxz'
- ClassName: 'fytbcwqjbededibennvvczaywkegojmvz' WindowName: 'ladaayyrpgeirdifjwpofachektftfb'
- ClassName: 'iapvyxadcsdnpflanuqitrqt' WindowName: 'jnrbburexgecslnylerchfunlmps'
- ClassName: 'szjzzwktlellchcwwc' WindowName: 'lrdaexhjxpwridhduhikyujuivcfijzlnsvv'
- ClassName: 'itcsstehigubncatsxjcrmiq' WindowName: 'kgmvamssdopempkiqfrdxp'
- ClassName: 'yrpdcwkqgtasqphaivfspiljkxd' WindowName: 'rvxbhkvbslxwcinmksmrgrcaqxdhroqk'
- ClassName: 'sklsbttphhggdfhmfqhdmhzjr' WindowName: 'efinowhgffwtwfakpbmyvvyickildvojw'
- ClassName: 'dqstjtlzfqqyqrlvczyqaneguauod' WindowName: 'cvwljsnvacoixndopsgzxkreuffgybtl'
- ClassName: 'harqjoqpzfwynnomqruqbgetnlxfkngspyue' WindowName: 'srfegbhjpczgyntpuwfbs'
- ClassName: 'dumlplzngzjstayvtkkjrwjuvgyt' WindowName: 'jwwblmpafdzmfgre'
- ClassName: 'cgacmvnrwpyqlvvtmawjchqwkoko' WindowName: 'qbsdufmqnxpacfpvufcrbt'
- ClassName: 'fqlyynxcdnrsqgghpgjyraidbseidmqj' WindowName: 'qkrscwiiyttnfkreqaoyikeqfmcclekszapgd'
- ClassName: 'etiweothghujgdii' WindowName: 'pdebhynrkgmouxlq'
- ClassName: 'aspbweybigncxitoevqkkuorpluqsezfdc' WindowName: 'qwmklsedxzsdntxzxam'
- ClassName: 'cqguxvnomootomsqvycztmfkclvphxfzkjjo' WindowName: 'ohkczyduviquoiszsfxaykjbxjxvnqvnzhb'
- ClassName: 'oppfbpntuhnpbtlyjlctehhwboxfwfzhrnf' WindowName: 'biuuzqfwnggcleoovywijlnishjbvpruijjatig'
- ClassName: 'amfohwslwgchjgwhlppovsbimvq' WindowName: 'lxoztvevzxngpvigufgrukgn'
- ClassName: 'qbrhnqqophreedaipqxdjflxmjqyatiafsyao' WindowName: 'dtcaatlehjhvtbshqegljomjrfkbbq'
- ClassName: 'nqebbwypukynroxpwrdtddwoyflqyhmdrhkyn' WindowName: 'rwjtbklreeiygxhhzzapcd'
- ClassName: 'nktddvenzvkcrvtygsloyodvwbmvzbacq' WindowName: 'usekeshovmwkmgvdbmy'
- ClassName: 'weccamjlxsyhjalvawprmlchpxdnuzssf' WindowName: 'xesvovwmnyucqpi'
- ClassName: 'fbdlgzvbhvlufwsszlvxakbnlvlc' WindowName: 'dknjcxykjhvcxsh'
- ClassName: 'xugeebdbmfnjpemdvnrypiltfqsbr' WindowName: 'vcjrzzwvelszdqzcoeequwkdvnkaplhztcpcwg'
- ClassName: 'zzhfjtquqsezbdlrlpkpkpktrwdwzzam' WindowName: 'xiiuegydsvmubabueucsmtp'
- ClassName: 'unysxhhoamcuchtbhuanqibce' WindowName: 'jkbiqjoupiizxqfcxmoflwmawpkymxrnuenm'
- ClassName: 'ihalmwkzgltgpuiarzv' WindowName: 'gehwckegfafboolvtksf'
