Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'pnglrwqpakorkehryjsabfavpec' WindowName: 'rqnsjdhjlcdtauj'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsc2.tmp\NSISdl.dll
- %TEMP%\nsc2.tmp\Math.dll
- %TEMP%\nsc2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsc2.tmp\NSISdl.dll
- %TEMP%\nsc2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'rvrlfokownyratdddpsqlsjcly' WindowName: 'lohbqqiimiskukofaotvpduykaoy'
- ClassName: 'scovfvqkwczutrhomdsvyjjoyh' WindowName: 'uuiotuwjzyswjoivtunmipxatoujowzjhlggpto'
- ClassName: 'zythdvpqtxgjcpkb' WindowName: 'oceqpulhptztmsskjzddhaup'
- ClassName: 'wqihuzxcphyqclyj' WindowName: 'ranzomhjenbsjlcwmjkwfbhgiuhgkctdetaooy'
- ClassName: 'rcusugqezfjashdbnirrumepxafutqcbf' WindowName: 'szichxekukddmqqiuachenyuseldebpofo'
- ClassName: 'hknbbuphocxesnwbogxeahhvgafykhcryk' WindowName: 'mkalvibdkboyemwntpb'
- ClassName: 'bgydfofjjupwzvoajhltiqfitvqnqtw' WindowName: 'strmwbonjapepwyhycwjksktzzgymtcwumix'
- ClassName: 'pgolsshsphxfltqs' WindowName: 'czetvjhrbftxlbycy'
- ClassName: 'supspiuwsqmlxoejwwxsq' WindowName: 'egdhrbtinszpnqefhsxpeqrufczurqjsrsfy'
- ClassName: 'ruceawcsqashyzzqxnn' WindowName: 'xrseagzpngrkgbmwdojyn'
- ClassName: 'zkmglbjcnczqmzyz' WindowName: 'hnvyuaubnijsbrdrwp'
- ClassName: 'iylepjaqspfuanuqlbprr' WindowName: 'hvwxolevfxejcjejpp'
- ClassName: 'ablvkqeorxsmnhmlhwfnixe' WindowName: 'gnzyehnfttjnvhuuhsbhzdkcodpuixdsjidrsb'
- ClassName: 'kqcdbbnoesfbysa' WindowName: 'hyaetiaizayptbjiuaemhvijx'
- ClassName: 'oamytdandhdynnmzstswmuwqvvkszwngl' WindowName: 'vfkphrodsfoszjyldwwcvmlhcd'
- ClassName: 'zeghxumhugnsyvdalmgxhqeh' WindowName: 'bwpebxfriyrxvye'
- ClassName: 'uxquqkcsnbsiedymqpjyndpf' WindowName: 'rhtbbtatjtokrpamvzdngx'
- ClassName: 'evjazkssulvqivrmq' WindowName: 'wnykrppmvovrrdnfjyorurmnu'
- ClassName: 'lzhxphrwmzrpjjqdhhskrwhtfs' WindowName: 'khdntrhfscselimcckkwwhttwlwpbkld'
- ClassName: 'dqahdgdnkrstwbzwmfaha' WindowName: 'bhucvcwrlmiqnyx'
- ClassName: 'mzruhasalyujuxbp' WindowName: 'nxcapjoawgmyqpqyup'
- ClassName: 'sndmqimmkirzxsnquunl' WindowName: 'nhrvkrhjseayvstmefdzyyp'
- ClassName: 'wkzxjfjhmchajxncoeka' WindowName: 'mdfkplszokwkpwlkgttufoskdmmxdqukbtms'
- ClassName: 'lbvtqmurhmusfumhqzaxcqdcruzimpswdtvmg' WindowName: 'edtdthsfwrxlqeolgnkurztwiywkain'
- ClassName: 'thynxiyoiroeycaajjiy' WindowName: 'xqfykxhakqmczfwlhoh'
- ClassName: 'sxucphljcqhxrkdzrykkfbyxhhiuyhsykutx' WindowName: 'cdbqrqttrpxqomwhdafziomnlbqbgbq'
- ClassName: 'nulpuocizgcalptxegdxafxectatko' WindowName: 'cnauhpcnasigjerlrogoqnhw'
- ClassName: 'bjzfpflpytaderyqnffhiidrdjmr' WindowName: 'ngtepcewrzmuixsnuln'
- ClassName: 'manysytofuqyudpmylnpavjkaspsnstmffsof' WindowName: 'ztsdwafnnqnhtsjctenprcvpvebtcw'
- ClassName: 'aqhqatbuocrddnlx' WindowName: 'nvgymmntpetonpmrkkyeskblfwndepjlhzok'
- ClassName: 'pqfmzduevjsgrffciyaqkxzzqb' WindowName: 'kzknsstmsmwudcgupwezljgkczidbxvdykh'
- ClassName: 'fxlpwqphoobkawxfcifeopisfkhyeaom' WindowName: 'ubdxvcezzyvvefuhvtvzddqvz'
- ClassName: 'ufxbpqfzoizjdbmfnrvzibdegyrtaoawwi' WindowName: 'rlvjwrhsjgbrvdpjxfnjxgazjshhgemow'
- ClassName: 'oumsmsudzxlbcfxqyqs' WindowName: 'sbcjbfavuurnhacnmlodrj'
- ClassName: 'fgmqruidugozxrb' WindowName: 'uxjoeaburscpbrjtipix'
- ClassName: 'osdalhpuzviutkx' WindowName: 'yavfvxtfpqbzxwylv'
- ClassName: 'zgnyqkwjypldqidhxwlmwbcpcc' WindowName: 'nnjeppfzwggotiky'
