Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\InetLoad.dll
- %TEMP%\nsz2.tmp\NSISdl.dll
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\NSISdl.dll
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\InetLoad.dll
- %TEMP%\nsz2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ziriinpzmdkeooxvjxytw' WindowName: 'qfveawwnqrpiysblntmihjatkbvxkxhszofsz'
- ClassName: 'ukbohjbfukgpqajfa' WindowName: 'ztjqbtqbivqmsmrwrzljdrfgdy'
- ClassName: 'sxocdyagkjsakgkxuqmxzati' WindowName: 'ltxtxegstmrqdfcv'
- ClassName: 'fdiytnaktgxtccekql' WindowName: 'wqgpiosaxtnsmprpgziokxigjfcbejbg'
- ClassName: 'mnsamthkdudbwnkkglaaimsrhnythcfhnbn' WindowName: 'htybeqzvcbmkizatyjnapiudfazuuklkguisccu'
- ClassName: 'kgcimjvzpekhypuxyx' WindowName: 'mponysgywkxaenfals'
- ClassName: 'sbtwdtwzvtuhxbsdlsvnzoroabuhuygpthxkucw' WindowName: 'wwweyyknbfyfvikqipvzpayuebdy'
- ClassName: 'rlzssqperclhvatebfmfm' WindowName: 'hwubbhcoajwcaohzofamoeunrri'
- ClassName: 'rrtwoilbbwmpgpwjvxotikgmwulglbj' WindowName: 'ilzaketlwkqiuwcmrkwgdpwzixgdovjlibkcnwa'
- ClassName: 'hchzexwlrnnvmhaema' WindowName: 'zzhpgywrcdntpcvpozdpvqmpcg'
- ClassName: 'qzicgyhwrjkuinssoumuun' WindowName: 'wjkgnrfngfnmxwysjxmlxyxtshwamhhqkke'
- ClassName: 'tyobxkvuzfnylragcdpuvg' WindowName: 'nuozefxmvbekjtajfc'
- ClassName: 'kqpmwzatpgeuaollkzphh' WindowName: 'jizbdhkwjmcjnwwzujagmbqrqsgzholnkjxbi'
- ClassName: 'fsihjlsqrtwypynnpczus' WindowName: 'imcaiukvvkxseizlwdufzrbxnz'
- ClassName: 'cfhoffoymjlemdttgkzbuqay' WindowName: 'gpkdqctuxqntgjmi'
- ClassName: 'bfzwypetuowpswxrqwitcylbpwjcnseoo' WindowName: 'kibmhcblqdpsmflyjaahwbqwsct'
- ClassName: 'dszfnizjiyhjorvsjjqj' WindowName: 'uocmedzjlochcluhfljup'
- ClassName: 'mheuftlmizixaadmsjyfopuwb' WindowName: 'qrgltdgkwigicynsuvvisvqtxdmmmulmnzypuz'
- ClassName: 'wtcnzbwttbsyzghqlnegymxbqoftqqjrm' WindowName: 'hmdvncvunbedaqjtukfklgxw'
- ClassName: 'kkzrliowipnczofwblbcpxxcvkbimroi' WindowName: 'rtsvuaehsaznjolvhb'
- ClassName: 'xbyvnitmbomuzrlgdczcbzagjulp' WindowName: 'qvuqtwxnwgpgbikiqzpkcmzqdxqmf'
- ClassName: 'ygqaeuxzpgvfwdqvaaqigqkarvmhbijevhxuuej' WindowName: 'arhsmcnvrcmimkckmopmildtcawl'
- ClassName: 'pymsxrhchtgxweqmidpnduy' WindowName: 'ecfmfamtatnpdksmbdexciqm'
- ClassName: 'pshryfknvesctphetkjmxhbhskzvcxv' WindowName: 'unrniznzaapdspyhabudqt'
- ClassName: 'ldwaikpltapiohkfilrlrjdbzejpqtv' WindowName: 'sdaistyrzhxttekytjumhhxnaapwnjkft'
- ClassName: 'aytahxxxpkkhopnkmggztannowdrydoznow' WindowName: 'roplwxqnbhkgewmwmmvqiz'
- ClassName: 'jdqqwtioyaqgdllyjceumydspwfu' WindowName: 'ffxdzwuviopbjsywhzreubwkigdlpjvobkxdz'
- ClassName: 'nympqwzctwgzjuaw' WindowName: 'wnabdlnsxbfqaociyxhumabivjkmtmysz'
- ClassName: 'kvadzgqwouxkqpxobyq' WindowName: 'ufmsrmqmwdbipzlleyqbtnexpenuxtfbmj'
- ClassName: 'wnmcuvwfhpqvzatqmlhmr' WindowName: 'wkmteuhmtctswdraks'
- ClassName: 'sunnfaziuiceqsbbsxkriju' WindowName: 'kjpdqmvkoeluxrtsxdqwtjllvhluxpo'
- ClassName: 'melbtpvhuzxzcidsyfcgcqmwc' WindowName: 'vapiilsnqtllrlr'
- ClassName: 'qfddxsvldlvrjnondekqita' WindowName: 'dghltqzopyiitnjtudhmisfiein'
- ClassName: 'dxqldtjcrdkwwfdzgkftdcbfavs' WindowName: 'lonlrbmzennhhdszelpdsstqqztaprdxngqatrd'
- ClassName: 'vxsepldiyemwoapjjqarzw' WindowName: 'isuyagbwgyzspovoifyrqjmjmbngm'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'aexxujnaizsxggnogrgie' WindowName: 'qcenlahbiftcgrmoyhsmlatdhenxl'
- ClassName: 'pnefgaptvkrhebnckjdtthtmxplbqigxmgph' WindowName: 'ughjqmrpjslgpipyfddwkrvyq'
- ClassName: 'fwisgkvgtxwlylsvurlmhrxrwnksmaflvexsz' WindowName: 'oinbmtceelgrghhffcugnot'
- ClassName: 'bvkxapehunlcxxvyaejdgwpwnwmhiqtibit' WindowName: 'rtqrnfesfncyitlxeiy'
- ClassName: 'xptgrfcxounoqhvaessswujuthibnoewxkojr' WindowName: 'bxevprxatqjwrkmvx'
- ClassName: 'swuzorlkhtlvtffb' WindowName: 'xqlummzozwkesohoj'
- ClassName: 'hphnqgtdebpzvnystiiwwyivbnjikxbsljjjmur' WindowName: 'xkiqgrwdclfbtwvpgtzxmriiwuanqztecmo'
- ClassName: 'igonzfztuqmukmli' WindowName: 'bxupngoflddemwijzsr'
- ClassName: 'ahecamqckdjlkhyydgdyd' WindowName: 'gmsbbyguirtzxzxydwjt'
- ClassName: 'pqqqovjlxxiupbnpehelovrwveckwjtomduan' WindowName: 'prswpecotfigtzeutorlcor'
