Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nso2.tmp\NSISdl.dll
- %TEMP%\nso2.tmp\Math.dll
- %TEMP%\nso2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nso2.tmp\System.dll
- %TEMP%\nso2.tmp\NSISdl.dll
- %TEMP%\nso2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'tiexjukggllyprpjslkqjxihhxofdnc' WindowName: 'aalvorarzetxmaoklsyhssojcnmhflafndo'
- ClassName: 'fvmganziystulibldiol' WindowName: 'ikvjvbesriiinsewvhriii'
- ClassName: 'ouwhxvrhkxlmlhxtfudahdwvvpemnfeaidmhdo' WindowName: 'mohvyywsmmgvkhrqenvmtraejgaqnhpahn'
- ClassName: 'ipewgffuurwxjhbxsul' WindowName: 'invikngisrhsypzxx'
- ClassName: 'ofloohbkgcmzeepcnb' WindowName: 'wqkfaehpjllkefsnrglxypylyqx'
- ClassName: 'tmvsweqiwoqiocykavxvmtspxvokslqtxsyumuh' WindowName: 'xgcqjowwjmitupwrwfqpmlb'
- ClassName: 'hhcrjpyepfbcpjwoihddozgurxgeogqp' WindowName: 'vcxpvrpurybzhwebvlffl'
- ClassName: 'cmieutudetweiueqeaoymokawcntdlqelrvbb' WindowName: 'ldipzcshlstuzlri'
- ClassName: 'oowyadaeksruwijwgcstaczbrssbgzxmchr' WindowName: 'klpsrmsrzwcvivsmdsjkyukrncvwmfxiho'
- ClassName: 'crksqekivjopubgkzorwsvkpeb' WindowName: 'bdvdmszltcnnzpyefihnjeaaaglgqqhkdjsaemr'
- ClassName: 'ovgytdketsscvss' WindowName: 'wcwasxvtjjpcvakri'
- ClassName: 'mfhpghkuuoapmqsvslunthqoqocmsry' WindowName: 'qxvqdvtoeeojxcvqkqjlzupzpnuiuwekzcznaua'
- ClassName: 'agfvtyzfzhtgtpxllbwud' WindowName: 'lgxldkinpfshcetgodhpf'
- ClassName: 'cjvripjknqspwqyqcxcixcbaijdepnui' WindowName: 'mmmltmamsklhoqelxxssossqlpthezve'
- ClassName: 'yehewviyemtazpwkjphdvpzayvwshzcbslo' WindowName: 'evokmqkqpjsppulwcl'
- ClassName: 'cybptqkgfpzjxazjncxue' WindowName: 'mcxifmtabxncbqttrcjvwfnlybog'
- ClassName: 'oablaqwkjslapivgeawiafarvfqfqsoqbxfdg' WindowName: 'mnfwosaqbpysaudcbegmudvyjzfbuxikkreely'
- ClassName: 'fluwnkanbmyfylbvjffsjfkbvwcxvgocgxjahxo' WindowName: 'hhehjmyriubxuidplqfdglemkm'
- ClassName: 'usjhckiodqrytqfqk' WindowName: 'gliajkemkhtuanttqbcgkr'
- ClassName: 'nbnzaspcstnmbgilbgkq' WindowName: 'gsivccliwbwwzpnbftlw'
- ClassName: 'hxpeffddmrzttsmeqezxhvzuwvcnacn' WindowName: 'zzjxwmiysuahxjqkdlyah'
- ClassName: 'guzdjzuucjdpmzovaatbcjiazxkx' WindowName: 'wwjwrafiibcdifuzqqrbbxzoczlziaodol'
- ClassName: 'fqcrjhhxuqmlfsi' WindowName: 'jctdhutvtdywhiajygztbpejpknmq'
- ClassName: 'xgkjmorpbqdwqaolppqxttkywby' WindowName: 'bapjneajvepqaxojduvaw'
- ClassName: 'vdezdmkosaqfbfi' WindowName: 'szcuikwywdtvtkjbeezekltnczu'
- ClassName: 'pocsabyzprrwfqyxkanagpx' WindowName: 'noinfefhwxnymkosmdznncmmarznd'
- ClassName: 'jmvtdzmqgbvqmpwtlbjmjkaxasjuqbdyiklt' WindowName: 'seqfkzediwhjfvblwfpxdalrqcdj'
- ClassName: 'sfdkvbymwkavsouxavjeeagaqsll' WindowName: 'eqfimkmekrtwfqosaizdaifwdppiefvrn'
- ClassName: 'swaweenoihnlkyqrs' WindowName: 'fskctmkhrstqjpijiwkn'
- ClassName: 'hgdbglqapvohrgfdewzrognmupwubokjkxwiac' WindowName: 'ymjavznuikjtziezwbofbvpm'
- ClassName: 'lzezxzfzjttvtqriszfyxsrj' WindowName: 'ikwesaktahgtdzktwtkfjwzeg'
- ClassName: 'ohuwikwhrialqkd' WindowName: 'nigkqqhgmlhxgtsxrzhrrpqxjo'
- ClassName: 'uimtkfemsdcnxsfyyntvfavvgohp' WindowName: 'kvypkaybkwqyzbroalutronijg'
- ClassName: 'zblzoeaeujnmhwskumlqhnagggxnqskwclr' WindowName: 'plbyubdnzwwpsecyyviea'
- ClassName: 'iiotruvycwhrxoiowwzknyjizayuliboxbnu' WindowName: 'oqstlebiwipnnnkfwurqdryubatsnk'
- ClassName: 'yuvplwtwriyttohtjvlmo' WindowName: 'gmshkqdvsmwqdmkxsdqa'
- ClassName: 'ewpkpfhdgoabejaroyrrhaxdqyds' WindowName: 'ebbukjijsrbefihkru'
- ClassName: 'unhketczkbwedowyjiraugryhpmuhfpcaod' WindowName: 'wfqygsdzlqtzxgnhsijowcogrrjjq'
- ClassName: 'neafzlubrscxuwguzozbqgqndyqhenfkwy' WindowName: 'okovaerqeddipygeylk'
- ClassName: 'tlpmlykgvmmvonz' WindowName: 'vzevgzvlvfyjnrqkbkazhtxusiczsimilmlye'
- ClassName: 'hevzhefvylzyssehzylpxqd' WindowName: 'tyemjhdnzpmqzgpuqk'
- ClassName: 'hhietwdnwjmlxbazwlhsrucuvhatlycvgmsybim' WindowName: 'jyqacqlymdwymoswrgacbnl'
- ClassName: 'rggtnvvenxzopkwox' WindowName: 'yubfvdgscplfwxnwcyr'
- ClassName: 'dfyccczzxeoadtajljpdmscrllpb' WindowName: 'tgjzishoclhfkrrxyauwzkizn'
