Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'yjzwdavpgapjgeusduetlqxeuidltn' WindowName: 'cbnikwtdpvmzxiwcakswrcqnldtjhdpx'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\InetLoad.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\InetLoad.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'pxesleryemnvyfjqimgjtiykcahsxtszfv' WindowName: 'degcfnelzlvleps'
- ClassName: 'nlmjljmvgrhjekiqkzms' WindowName: 'mptiltbpgjoyhmygoonaegfslveivsfbptavgrr'
- ClassName: 'kmndavobidvhyikl' WindowName: 'pilacyakwezuekpkgawzyaczvxp'
- ClassName: 'ewetuhgapbeubwonxznjeyhimfudsasxzdh' WindowName: 'csmkeujzrtvorncjjafozsbcrannc'
- ClassName: 'amlpufhhuruosbbw' WindowName: 'kxzkqjtxhhhmlopjkqthedaygasw'
- ClassName: 'mnjipceubibenharhrwiwcduadmtmlge' WindowName: 'kjevfnlxjucxwevvruxwiboyncljdjjynuxayd'
- ClassName: 'pozczslilzuvjbkqqqbaxbtalepiiiytrfgnid' WindowName: 'zhqamfbcdkakhuaeaixhyjg'
- ClassName: 'vjdfmuwfzxrqnsua' WindowName: 'dvxqczwgcbunsawxtghoaff'
- ClassName: 'lycywocjjmrikmphsnlknmeaytidjvkndgirlf' WindowName: 'avbgpzicxsoapsbvwpnkghmyr'
- ClassName: 'vvahiazgqecjhzxpckcamg' WindowName: 'vqrqvseeszmudjzkgqrjppjqdx'
- ClassName: 'vkdrbhoqhchvybzqymslhf' WindowName: 'phsoapfpvnsumwxndfzqnclmjrthbcsuldpyizu'
- ClassName: 'oyjsdzhavxhhtyu' WindowName: 'ezfrappnobcynktrqzreipkdydsbdmuez'
- ClassName: 'toqswfuazawzzixtvezxxdnczsdwsytkmagqm' WindowName: 'tikicfupnidplfig'
- ClassName: 'cumnvbibfarsgpznap' WindowName: 'bfdsuuvgvtjcqcmst'
- ClassName: 'ehfwhuuonvtdsmzdappdryzihm' WindowName: 'iyxlofrwsgziaceegqvi'
- ClassName: 'vglhocfmmevkedfehldj' WindowName: 'kifnugsikcdydxc'
- ClassName: 'vxfcajecmqelmcanwtoxxyrdbuvumpzhdwxo' WindowName: 'jcqazpmmuaecsokrujbzypaoszzneydygc'
- ClassName: 'uawpwsaskoxdctllcpmahefjjnwvamwqwe' WindowName: 'uengqnyycygorphguejqjk'
- ClassName: 'lbtnmoytfbyyksgzqus' WindowName: 'eexfufureqvntdlzrnhjtyborqdmenchjlpkc'
- ClassName: 'hmycxpotrydkgrygw' WindowName: 'uyrnmzpwmykucqrnohstq'
- ClassName: 'csdfziovgxftubqldomlqgxnbh' WindowName: 'qsfumwakvqhqapwbxsdes'
- ClassName: 'fzdvqsutvwfgdjqkhl' WindowName: 'ohavcykmjspuwaoixjmodfjec'
- ClassName: 'rabvatdfaddwmanwldtqcyv' WindowName: 'zwvvzvazhohahnhccu'
- ClassName: 'qdiqxejrankjdjaswr' WindowName: 'isvppvglxyxgdlhdfvxlpuufwtynveagsrt'
- ClassName: 'dlsyeddrqfxaiijgaxtgfcbmymyvxdiqhxlfp' WindowName: 'cjxgvlbhvuoydfmjxetncxcoqoxqkiy'
- ClassName: 'yqwrrefpnwupajrzwni' WindowName: 'jthmmpugrayqspzbtuibfmpfoohyhvzjtlzjr'
- ClassName: 'klsqsfkmvmiidinu' WindowName: 'tinbturjngjmqufo'
- ClassName: 'bvoiwiquprapqqsqovosscy' WindowName: 'qqtjsnlsjusleggahtgpljjlyheqiggcck'
- ClassName: 'yzaknefvdnltirgkwypfwxfjcftevciudhkejsi' WindowName: 'bmzjyjrhpycnoxmhlev'
- ClassName: 'wgkfumhnlcrftvtlpdwqjwpaezfbd' WindowName: 'ebkxplzqjouticuvmeymby'
- ClassName: 'ipvluckcnbwbnxdgllgfmlelkpnwgcyd' WindowName: 'ipwfriatpfaztgncyhmteonjdogtdvisndh'
- ClassName: 'pgmiuenzudxdyrcxbmxeku' WindowName: 'tzimcjjzpcxumefglslqt'
- ClassName: 'wesgbotqsilxkfw' WindowName: 'qsswotjbfpudoobaldrvpctm'
- ClassName: 'xuysmkimprstwyuhpbpfotdynzqzpogivqzcls' WindowName: 'trfnjztrwhopiogvvoaidsqwnyjrmxgluuus'
- ClassName: 'akkxmzxkcnjzmrfvicdfte' WindowName: 'albafiwsoqnncfstzuork'
- ClassName: 'evbgdblkpohzwuyqnjek' WindowName: 'rlxeltuhlktfvwqygavbeheh'
- ClassName: 'slatjhegmlxwyoddqzjajirveiukjye' WindowName: 'mznnzckwaokdfykox'
- ClassName: 'wwitxoxrrlcqzvhdvchrxompenkgit' WindowName: 'efsahktnqngiwkqqklgnmfdz'
- ClassName: 'gakqqfvtycjmzmdqz' WindowName: 'wdpcbthfrrefquccak'
- ClassName: 'kzgooeweyhcmhkftthdplq' WindowName: 'okrshghqqcxorahkipshcyyla'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
