Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'awgmzilaadtlysuxjwjqcaggtdmaajnkavpflqx' WindowName: 'sntgpcmmyivufsrquwiwqqgpqhifgsl'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsq2.tmp\NSISdl.dll
- %TEMP%\nsq2.tmp\Math.dll
- %TEMP%\nsq2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\nsq2.tmp\NSISdl.dll
- %TEMP%\nsq2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xdyjaskuomjuzrh' WindowName: 'weequstrefbfladiu'
- ClassName: 'zgtleqojqushvuksvx' WindowName: 'otdxtkjuflbxrzqkmzysvypjpuafjbjgb'
- ClassName: 'zzksxkfhkhycpjsviimzmnqztqb' WindowName: 'ggspwhpknucdhidmedujeorxyagzmpulv'
- ClassName: 'slwxgswhavmphpbqbjsscjfzxzuzexwnmrbt' WindowName: 'ijnmjvkmdnppyjbfbihoqxpkwtzmmovd'
- ClassName: 'ovacelajwckhdbwjh' WindowName: 'kyqwhawtrogilzwcyov'
- ClassName: 'iqjsgcfgibvukiqxzfmakxvuyjqlqudqicbunei' WindowName: 'dhyydkscnfteputdttbqfq'
- ClassName: 'myncbtwfxkcbrxuboxldbmnlomzndroyjuh' WindowName: 'zxvpohxqzpuvmkmsqjfafa'
- ClassName: 'dyocppzumnuhveonux' WindowName: 'pdprsbvgerfhtmhpuwdzmnxnlkakpdgyhibch'
- ClassName: 'kjqotzanjzmtmrzvvbvijxfzhnwovpwrgv' WindowName: 'potbibaiocgeneumsa'
- ClassName: 'ngomzbafhcfhlrm' WindowName: 'gohoyipqsjchoicfbamjfzwol'
- ClassName: 'giavctrcqdtymdx' WindowName: 'kuronhdgudwhozwrknciawtyl'
- ClassName: 'rczvjznbjjztsgljtyxebsfji' WindowName: 'kogoiftwriprzoqbquwjq'
- ClassName: 'mqblkoqmdrqlxnfkmcsthokzsaoshmbkoxpbmdy' WindowName: 'rdguwkqinxzanwgpwgikkljm'
- ClassName: 'qsmbbdhytvhcwtlxxtdeadvxvpegstj' WindowName: 'dgpphlashcnfqcdoacddvnznqcnstsj'
- ClassName: 'cvsyvmgqywhyyxbjqfmlst' WindowName: 'edrlelooptxnycbwugbvteibvewdmfmg'
- ClassName: 'unmnsjrfxejuxgbaqkfdvuvhoroe' WindowName: 'tobvnrntlvcumziighjiijhyprywm'
- ClassName: 'kfzevdxfcpffczhwd' WindowName: 'cmkvlupfkapwepadejedtcfxbikdibfddffuggg'
- ClassName: 'xbxvwendxutyzcgapqiwhuamgyw' WindowName: 'xqsfktwwpmxbsjksgirhgbqcvmnt'
- ClassName: 'zazwlljfnvlyahzlrmzfxfiglwtrwhtlbd' WindowName: 'asezgyazgugbudjmhqjsrw'
- ClassName: 'iyfyiizngdojjeci' WindowName: 'ffphbaxreneqtall'
- ClassName: 'hrqqrwpyszxvppavxgixo' WindowName: 'cbagcovevopymgfnibmjd'
- ClassName: 'snqnwwrgdsnlgnumqwiajjkilmsvvtdfzjbgdsm' WindowName: 'tznojgbrjehzyxqhncn'
- ClassName: 'kaqupdbwctvzccgsjzsuedlzeyzhbclaxnm' WindowName: 'lxssgifzydgyiiiak'
- ClassName: 'wftgxpyeozzgxvoyubjqwxpbamhdmmmnjceqg' WindowName: 'rosdjhwluicsxgrcwzgwogvworupyzbyhhxujj'
- ClassName: 'ailwacmsodbknknlqciwjqllutmhdoidxujefl' WindowName: 'immktmtjcsskflvixrfmsfa'
- ClassName: 'rztanabulafnwzqaimzazjrvc' WindowName: 'dyoyjpyrttlvveijxdbeivqezrvxdawnhbkoo'
- ClassName: 'bnwlayxwfxobeqwqdyjecblicv' WindowName: 'atyplatwdydnqnnhcnvguab'
- ClassName: 'ueqbnmsrivmtzbmgyzxwvyffgdmg' WindowName: 'zwbkaezgvdzgsheijwchppqgcpyvyehvcckzror'
- ClassName: 'jkyojjinyskriulkautmfxjjilmaazyouvc' WindowName: 'tuldqhtxtehmvcjffodyyfzicpz'
- ClassName: 'kkyoiuarceaxzeoxbnwciifbhww' WindowName: 'kepugqcogtpxwvj'
- ClassName: 'ainvigyrxridaom' WindowName: 'moanbccpinxdscafqlscbstapfyqezqtwxmsge'
- ClassName: 'fomsobjaeqwoboxrinqrkjxbvmrs' WindowName: 'iaxfhmgexijrvvkizvvihtkxj'
- ClassName: 'evdcmoblihwecrtrtlrokrbpakmx' WindowName: 'ldkprzvziezhepisqzuccanuuacsnmfrqeqidg'
- ClassName: 'rypeihdoalnkbxadvtclcswpuwjuqfcz' WindowName: 'hyycrjqxtzmbddcrjjykikuo'
- ClassName: 'xrjduetquyopnkdrfxsuqzgpd' WindowName: 'trjcpgwjpawqiucbsydnfqvskn'
- ClassName: 'ixladefoqhotwxhtpqvqqmjpvwkbnirp' WindowName: 'wczhbdnrvyiehgiyisbnyibqe'
- ClassName: 'handlpxwzlziskfzrnjjjgte' WindowName: 'tcnszdopwzixzybdnfgmpduxagbabwgu'
- ClassName: 'fdasoymhupcfrruhoshqqhhqlzeoqeslyzohcr' WindowName: 'cwpbqohaazqynflmfqmyky'
- ClassName: 'yzeuwsghzqjzifusmxbejcqfyryvdnlg' WindowName: 'aebtaetkwnrjqcsuzcmsc'
- ClassName: 'hybwnfmesqomwrhfkjbmj' WindowName: 'wnfrozqovzqpysbslmhyuvpnqg'
- ClassName: 'tcntwdkyildxxicpivlcpcxgdmbeayzlnt' WindowName: 'wpzccfhxtzvhrtesgkemsvfw'
- ClassName: 'cjtlgfisbzjbdpljjkvylenfyauuqcqjvarxoew' WindowName: 'aoisyqxrtnplyizuyrrlemdwkpdcv'
