Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bktwmsuiaiblqbyppbmjf' WindowName: 'otcrghjzzhwqdqtuorvzlk'
- ClassName: 'sigcmkzmiovufuotqklkx' WindowName: 'tjfrntivzocqqvcrcggg'
- ClassName: 'fawxksvnjuavmuicuhqqoxfivvoagiwbfhv' WindowName: 'hhgjuytarybuclxzfprrr'
- ClassName: 'dxsbqxcwzmwoteqdnrqcrlddp' WindowName: 'roiotbvrjneftswphjdyauxdrzx'
- ClassName: 'zpxmddxsnqwgiyvjneapudys' WindowName: 'ouoeeelzulvtrjighqil'
- ClassName: 'mqxqdcmeitfvxslhthk' WindowName: 'mfwlklnexebwjdelxxcpf'
- ClassName: 'tmsekvszaqmguxlsns' WindowName: 'svsmlvlhaimldinrlykpwl'
- ClassName: 'tcrurryqqnqihcppz' WindowName: 'qwwucymrnlprsfdtdowbursqtafzmucpqkg'
- ClassName: 'ncfxozptlibvwoduuoblche' WindowName: 'nkutuqolhicxgxief'
- ClassName: 'kunbomntwdtfdntyocawlbesllecfv' WindowName: 'uifrnkpasdvuklemmukbhx'
- ClassName: 'njttneuvgffxvmg' WindowName: 'eltmuamebobqgeguewsycomfvpxb'
- ClassName: 'ggutsquwocupmghi' WindowName: 'jckdwlfuagdooydkjnxxrzvb'
- ClassName: 'jkfnayykmihrbfamhwldvtjikmmwjnxqynk' WindowName: 'xwozotkzpwfcnalshyyjobzdbewdnivekbypw'
- ClassName: 'rgkbdtgnnpyyhzfapol' WindowName: 'nuqkhsuhkvppzsmkaillkzphhxcaehnlspux'
- ClassName: 'instpzoiwzesfpukuwxoxuwtwfznstf' WindowName: 'cckultoefhfffxgpkqbuqyqlnrywveplsfjlmc'
- ClassName: 'osxfqmvecipqliaxgxftlfakuxgtpiwdi' WindowName: 'wvygycolsovbnqsvrmeyedfckmbltttdm'
- ClassName: 'osrlawchecdtbflazsdsuqrxtpizgufnrlst' WindowName: 'zvrhcoipmhjuobetrhogcobzxm'
- ClassName: 'yrevumracutkiuyxldvxqykiuhsbmnoiy' WindowName: 'dqiqxbzdaojvhqqanxidltlz'
- ClassName: 'gwnpswddbgvsjvnyfaa' WindowName: 'czesgckjkdwvioaokx'
- ClassName: 'pfghushcrnppqsizo' WindowName: 'nymtayzfbognonajghvvtbaigkoyurxdh'
- ClassName: 'mexfbhlzbsfcfsrhiwgjtfftodtmojteh' WindowName: 'ihmhhpvirlxmjjlvspxmuobjzeaixnkqpokbk'
- ClassName: 'hjibkypivzpzrrvpbpmzuxxxjgjxlxlfnwavk' WindowName: 'vtuinaofgmsbwzkgjgaweovq'
- ClassName: 'kjpcezcfxfvmohvuirjtx' WindowName: 'xmucvmsjxzvutjjbzevjsclhdejsgkg'
- ClassName: 'tlaobyflpznesxqgavedcehyapk' WindowName: 'pbjapxwzwiugiqhqgau'
- ClassName: 'jrbuejbnpkbazsbkbtfxwhoaczrtt' WindowName: 'oosdtpnjiescbgzgwlsuwniicn'
- ClassName: 'djbnvnmsukvbigoteyjkzkwyyjyqqxrzkgjmdd' WindowName: 'rvgkyopblykqvmbtkkoxvdzmbmb'
- ClassName: 'nucxcsteiprjeqvbugptywpubwbnjekbh' WindowName: 'tcppkatnpmikrhukufxub'
- ClassName: 'slgojauffkfbcfivmiymegxl' WindowName: 'mlzhiyumvvaijnluonxlyuqpbojozrpcqfrmlo'
- ClassName: 'dwctlxytezsybxuccnopyjpjfj' WindowName: 'kjuommikzxqqthqh'
- ClassName: 'xbolaeoyvewqqghtydzupok' WindowName: 'ktitmkqdscfdigkbztzgnjlrrqyuyl'
- ClassName: 'wcnejuphgxqwxzlrrmrr' WindowName: 'gqwtaakxmivaeggxkcx'
- ClassName: 'ivbqizbnrrlzsxlmkqigfrfrhbhjn' WindowName: 'xxbzgwscntjegaxkabvmkhfvgdaw'
- ClassName: 'uxlxhmrjtauvepukcmhiis' WindowName: 'uizuyjbivyzypdyjubkbtobrqlwczjm'
- ClassName: 'smieerqhcshxwztvlw' WindowName: 'jbclmvdexvodwsgcakdiiniqobhbgugme'
- ClassName: 'vkmbymevnluoqqukskevmmpcxmkzkp' WindowName: 'gthnwemhcqvcedknpuxxt'
- ClassName: 'nvbdpqeaunbbdjax' WindowName: 'bimoothediplrwurbvyhmooignue'
- ClassName: 'saxgvnpjfqssgwslwlkulptxuaedrsealvm' WindowName: 'rbaxyjbgabqmhfklwxlkysyeozc'
- ClassName: 'avkmdphxfkohnto' WindowName: 'tjmcfysfukykqbayuspf'
- ClassName: 'qjpwmoemvenlczmzppokvc' WindowName: 'itpiinolckiegyxcimgajmpwomogr'
