Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'odsbhutavploybs' WindowName: 'hjbvcyjfaaeksfbzkmeelthjkwhfq'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'osstggmyvblywce' WindowName: 'ymegsqgpcypceflyxsdkrdqwzov'
- ClassName: 'hemhegaytetububvnhji' WindowName: 'wpjnnrlwcbgkxxfhehjaygokpjckvbxg'
- ClassName: 'gyceslpbpxywbhcxxaxpiq' WindowName: 'xuxyotyzficfpyreodeovi'
- ClassName: 'lpzhddkqxqrmephnkyesrrpwoddgljrf' WindowName: 'zimugzbxrhhepmiit'
- ClassName: 'bailsyuqmbrzjzzfty' WindowName: 'crplyqvgaiueehvrmusbxc'
- ClassName: 'lgkcwxulrfemtxvpxwk' WindowName: 'mcmlprcqndjexcgshkzsgznahimsbnhlzebxtmz'
- ClassName: 'wsyfrhjqaibrttprumqvzrpcfkxhifidyzxbp' WindowName: 'pvwcsnqlnzmxvnvicwlgcsivenfy'
- ClassName: 'vedbjzysymuqfeacsnrjanqoz' WindowName: 'zicoejgnphzzenkhuqjmeuqxq'
- ClassName: 'zfxmpzygpiyhyojbvetjakpqznkiddhxjcpi' WindowName: 'uamrndckbsphbdgasyuwgtsbgkjuiexzai'
- ClassName: 'vfsgxwnxpusnbpieoudnkpejbjytxfaoeir' WindowName: 'znxcbkddjrqbvdrjlrfenee'
- ClassName: 'alulunzolseehuwajbahmdzrtjwqspbfqaqu' WindowName: 'gmzdhsdnuukpuuirytzllebbzbjlsbejoruay'
- ClassName: 'gngknjmdkntkqwezqyebcg' WindowName: 'uxqkzwrfiqzjudskcgxroemuscwkcjkmok'
- ClassName: 'iysigfvywjbcfevvsvhqqpdssuu' WindowName: 'bdjkaqljvmoakbgyt'
- ClassName: 'etzzlykhgpnwemtxlfkszqjxx' WindowName: 'udsspvzhovgycedangnyquqfmtrfwhmtbmdghk'
- ClassName: 'nqcoezwsebzejlhvendcrn' WindowName: 'swngmpwuylegldia'
- ClassName: 'jaqblyqrrfpbaztrivbdudllszxnkjtglt' WindowName: 'swofchqnvcdimgxnyltsxsoryigumg'
- ClassName: 'aiogxwqciypbopaesrwa' WindowName: 'kpyjxnsptmtbcoiuzsbrfjcphadvwmlshuqdq'
- ClassName: 'kzjixdmgaibxdfwvivnzwtecdzydnhhmbwu' WindowName: 'qnnphouotlvhnyyfhuceyrrnwrn'
- ClassName: 'kudqagvzpxbyjxffhnlxwtesxqniqtisxqb' WindowName: 'cgulvguvejoysmmhdgjeaheapdlhlvkqvfiavb'
- ClassName: 'tekpgswxfmhmaidhuzcoxr' WindowName: 'kawohfznsfqpisnv'
- ClassName: 'bmdghntbaqnrocqomyefjzsahaoqgnmqpnnwp' WindowName: 'uyvtmhrywuelqkqxtupecytmjr'
- ClassName: 'axqzcwpliokzdgrjecahoprespjwmrtxrzomuf' WindowName: 'baksingdniogmbfgdvoqgtaedpxzjhogm'
- ClassName: 'npseceahnylluusxvbifhqcuqjtnkkdfbtzmoau' WindowName: 'cowvbcaghskesaye'
- ClassName: 'ikptbpueahskhns' WindowName: 'fskezqhadyvcatypkfaixldwxcgtmfjwrhqiav'
- ClassName: 'ahdwyzkccpmgurmdtzgyfqaoykfdinmqgyrean' WindowName: 'alpxhwxepuiwkszpuwgyuvgx'
- ClassName: 'zrlpawcynectqqnklevchxu' WindowName: 'ifncfdsaefmpyvetrzon'
- ClassName: 'pqxejbyimfyqljconudgpirswdorqrzwjs' WindowName: 'elfngmtjdawvoxjsbcbrbwlqvmrtlrgkbsvbobw'
- ClassName: 'vugkrzowcapezwbyl' WindowName: 'cmlkcymidftnuhvyrjvoknokm'
- ClassName: 'mghafvnvquuappryrvnuhccztlkpmtwl' WindowName: 'wkylnhfvtndwtnwelcof'
- ClassName: 'vjgqelyoyxpcvydngyzxnhv' WindowName: 'xewilkcffccayicnriapzhzplqbbs'
- ClassName: 'cnuxowzyjrlfchdrkqzflypauotqx' WindowName: 'keiosggdagduuxzsqafdtyrkkdfhcgwvpxun'
- ClassName: 'ybmvnmccrijvutabjnydmr' WindowName: 'pbtejnirawomchivq'
- ClassName: 'vadtboethimhjcbfet' WindowName: 'gqovzmasfxxwqxtty'
- ClassName: 'jhvfgksbcjxpriagwadwk' WindowName: 'oxaoepuwqulndiwa'
- ClassName: 'hleayqzjtwjunymotdezhqqsijrm' WindowName: 'grincnvotnpozpnuivuibonbslcbuzl'
- ClassName: 'roxzptkdqwcykfftnbmjtujxscwlazm' WindowName: 'abglwxccqdgzvspczvtnnrxivohmmemrkqwp'
- ClassName: 'jhkmwpqmumqpbleijriyuixpwya' WindowName: 'iwaffqzcqhlclaqizcpfbdmpi'
- ClassName: 'jrjrcmtsygtdvram' WindowName: 'dyrjuucktokviegjabjbgxoyyxlkjxy'
- ClassName: 'fvbtcjgnyixbxwrebqhtxuyedcpvwga' WindowName: 'ipvsjdhiteqgbxztegtobmjlsdexmvmwq'
- ClassName: 'zooaeravytkojncwxclloqyfgtpehdczkozvocf' WindowName: 'ekotojzejgvyelfojf'
- ClassName: 'zinegbmwjyuajkyelgufafhbnuwxoy' WindowName: 'ygthmuizfvdxvwyxydtlljpvtgud'
- ClassName: 'cnqimsvywpkxkczphhfgopdkenxtkiwduxibcez' WindowName: 'wxyxhszjdlleaglqilkj'
