Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsr2.tmp\NSISdl.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\NSISdl.dll
- %TEMP%\nsr2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kouybeadpinwhsc' WindowName: 'vgyoomlyhlmwnnzwbvme'
- ClassName: 'madrwddmayjulvvj' WindowName: 'jzmvorcipqeowldiputjnrjyi'
- ClassName: 'rkukgdovobhvlzyeptecylseowlfdt' WindowName: 'vtvyrqdyupgzlfyulvutyuyh'
- ClassName: 'ieglyoukcwuqbfi' WindowName: 'mceiaexagcxgctyzvyzsrcsrhyoolimlfxj'
- ClassName: 'cqrejwnalifvxedcjnsxuqhjv' WindowName: 'vbazywjvjndxzrdodyjknfmlfwss'
- ClassName: 'ibjkzxrvzeknifem' WindowName: 'zosdbmcmjgoaextfnnqnluhbrxiemdqrj'
- ClassName: 'cmactoddqiqdsvwvptadsxkazfamih' WindowName: 'beptnoohizvaiqenqsyet'
- ClassName: 'klzhxaqmrxmykbzwqwyofflsfusvjfq' WindowName: 'zorjqknyivzygwdolty'
- ClassName: 'nbcaqefvvjruvzokdbwbkdzv' WindowName: 'tcebrilomlvqcljchgtjklsido'
- ClassName: 'fgpoottollsucquzejnkqyygi' WindowName: 'swgjafpqyljhipbhemavkpxtrwslwknq'
- ClassName: 'pzgsjsnuvmhkmvgqc' WindowName: 'apbpwljmluzlrtklylcnqwpivqtnbnkxgu'
- ClassName: 'ulfcebmilplcuappdcaylqmrjduxoumbjpdt' WindowName: 'avmkpbbwmnhkitphsrqfos'
- ClassName: 'bkncxefogxnajkkayayfngaofwlg' WindowName: 'fwakbcftrqcepumxouyjqzoh'
- ClassName: 'uywbzymoaotaghtqrfgobxigjzx' WindowName: 'etussqcxqtbbqsxpfkytalcxvqvefqv'
- ClassName: 'hqthwyxyfpuhtdrrdcwhpbiodskvnxqirfn' WindowName: 'otlyaobgmruewnck'
- ClassName: 'vzrhwuqszvahjovsagmkxbzudkthf' WindowName: 'fsuqrixxwumksoaynarbdr'
- ClassName: 'ksfomxsjivvmgnldaljccfi<Служебное имя>' WindowName: 'cggqqfitfiowxzduswdquuarzibk'
- ClassName: 'wzkofdduzulvuexypztazlemdtulkxpxputozgc' WindowName: 'ckimsxnageokyenehpzwmubof'
- ClassName: 'htvwuosthphxvgna' WindowName: 'hkklstcjuzqibhcganbnpxpdudtcecwzebsa'
- ClassName: 'hazsykgrqowwdwhcxedlhu' WindowName: 'tjlzlejxujhtolfhnabvzmfjukg'
- ClassName: 'lcqnmjdoapaknkrirlpzdgumcqyfskkhzwimpt' WindowName: 'aqnspunkmiuvlnygaoscrtgfbcmjvdpzju'
- ClassName: 'jgnjgbyzkwgkgpjaraymoxjjqrhlqjbujrxenm' WindowName: 'avtriecodxkiehveggxmgkqaxgf'
- ClassName: 'epguvrlojihtqucjgodtdvootjpiwkqmu' WindowName: 'keffkifobyoszsnizzegmunuuluqmymcfzf'
- ClassName: 'wcminfddjuvwqikywwbozstdw' WindowName: 'xkovpwtrutbnfkflyvpf'
- ClassName: 'fdcpdkbrzcwybpznwthyzxgzxsqticnijl' WindowName: 'czxebillbazvffsa'
- ClassName: 'uhjuydcmqiphbkosfdqtedpmhzaolmomjgqd' WindowName: 'opfmdcngsvrfyexslggaxr'
- ClassName: 'mldlwepadsakhns' WindowName: 'ldsvlhyyfuxvlasljbkbklellysril'
- ClassName: 'fucvzizpffnjfjzsrbuiofurfph' WindowName: 'hxnpobundaseczcldausmadxwcslwie'
- ClassName: 'kyjhptqqcmcugcwjkvaviezfmlccztk' WindowName: 'nwwaqlqxuraryioojlyyxqzks'
- ClassName: 'avbhtcwgoqwkzvtc' WindowName: 'focqbbmmhhcgncvoragjopkpputynlr'
- ClassName: 'qktespasdoqtpgfyggagcnsac' WindowName: 'vwcvllfggasdsibnq'
- ClassName: 'dgynutlmtfwcjhrskvb' WindowName: 'mntvpjpffmdswmuyuijcprxkjqfjijo'
- ClassName: 'wtxxwuuokjyonaoiavjfvsxbuaxv' WindowName: 'ywjbeqerxuenxlpfjlnrdwcgucqs'
- ClassName: 'avxyvdgraqjxdrremplgjdmvrvzktgmsajmke' WindowName: 'hwxhzygzsrwvdpzdrncrudnkigdbzyp'
- ClassName: 'ioaxwhuoxerhiqbkmdxkeey' WindowName: 'peilyvlrolqccsuortbpmckegklic'
- ClassName: 'yykiemfjgcjlinogpmtjaameihc' WindowName: 'qljmcxlkdpoehzkxdzgxwrlpplwaygsgaf'
- ClassName: 'qiinwrzorfvijunxfylpwmoyxhyfhbqabqzftq' WindowName: 'mddartwwhfvjuzrcgkgclmqebmgo'
- ClassName: 'mqsidsfyhsnjsuwlnrvcipuctpqvq' WindowName: 'gvptumwxjnwtcnqlssbaiiuplpgcd'
- ClassName: 'yqyhafulzsgvypfgvdtl' WindowName: 'rhanztuheffgzqlxosufizozjydbdr'
- ClassName: 'yokatzivusboaaiu' WindowName: 'yemolbegrcutjkkcad'
- ClassName: 'lttaozmdwabslcgihfdckvpwcitzszjnpckjh' WindowName: 'ltpasaextumpzmzqwlfjer'
- ClassName: 'heiiyppcvrtixfoabm' WindowName: 'ggxhuvsxmjabmirczotfknadvteiqvbfzuz'
