Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ffghwkxstpdhvuhudfqmgawppkykdwfjrcvifd' WindowName: 'bqrxaiuigtvyfikhwuvmdqahtpla'
- ClassName: 'yciifaybtwdgduwsfomreumfpqddzcewsn' WindowName: 'xfaanjlqttrvqtnji'
- ClassName: 'xlpculopxeeyyzdypkywcparfezvhndy' WindowName: 'cmrstazhzvziapcbomaomye'
- ClassName: 'oggmlctmkrxwwsygbatgmsozrqttgfkzrxjr' WindowName: 'xoczlyqwjetzbcgoyrgkbrmrehe'
- ClassName: 'wvaniwgrftflmvk' WindowName: 'ohpestfzeygqcnpdvilkwdgcxlwvvntnxqmv'
- ClassName: 'oscjtdzwpksyocquoxymvmqshmjo' WindowName: 'yixqdzjwjmczckveqizeuzjmxiqkg'
- ClassName: 'qnwisnbnnkhymvpxpraugn' WindowName: 'hsmlqxoomxfxtvyxdkkgbkhtuoivtpzdla'
- ClassName: 'sjvxkfwgnycrglbvlaxwvsv' WindowName: 'wsvldwiztjfadhuvcylbgy'
- ClassName: 'hutlbymqqzckvwoxtrltvzojwztetryfimaozt' WindowName: 'kfrkxaclazdpuoycfmsccxiffiiszfvnui'
- ClassName: 'bomhpcyqfivcjfzfrztee' WindowName: 'ylaxtcxynrjvzekvgqfuytdkyb'
- ClassName: 'vvcurflgrbklzyyffjenruapz' WindowName: 'tpbkmgsbgkwpoltvogqiplyjvockgiaguv'
- ClassName: 'ysrwcyddppfiltkhj' WindowName: 'asjvaewwqhecvfekewpa'
- ClassName: 'arhqsuqoodyjonuacqronfdzygcudaikuxxeuv' WindowName: 'afigoaxypumqhftcblgmfhaagvl'
- ClassName: 'gsalkjfphyjsvfhvyylz' WindowName: 'kfzryjhugxcapwpqslkjutcbvfplod'
- ClassName: 'knigxtmpvhtssllchdakdnizqdjkfcpul' WindowName: 'uepwdbrofkbjdfbigrmodmxplxmng'
- ClassName: 'doeqtxtygpikyzwwawkzuhltdx' WindowName: 'eazmyphtgkrwcitcnlzdyhwnnl'
- ClassName: 'mdztvoxvckjjelvfox' WindowName: 'kyzihcfcaunwswtylarwtfwqxkj'
- ClassName: 'galaviqfarzdzigodxpdeeyadinwukkxkgyz' WindowName: 'fblfwymrjiuiqinxewbhhwphbsccmez'
- ClassName: 'cibzdqlacpqypozaylktk' WindowName: 'tbaymbsyetufaayicuhmuwexijzctsfqxtjepse'
- ClassName: 'cjkjxzrojszdahjgr' WindowName: 'qtahisgspeaodamxrqcqcvil'
- ClassName: 'glxirshnkvaexxrlvzdbmb' WindowName: 'fgjhbquxfhoeqlhuvpqeeogsalparegfu'
- ClassName: 'vvbczpqbnzuwxpylewk' WindowName: 'fawqlxppdtgivktrkvxiwnttalesdmcyykhqah'
- ClassName: 'oqyzxzsrvqdauvpqukqftpwxyf' WindowName: 'haxootdefcvkpsdwd'
- ClassName: 'zdihcqtbpmlwgpxpifwoackkrtopjzbhqtmwzsr' WindowName: 'wzoxwzkxqmqxgqfrvoeswmuujxxzkisu'
- ClassName: 'ctijsgsskpqczeqtwgekjpj' WindowName: 'nznlcsycqlssvbitagxnrqrknnlptsjaylgutjq'
- ClassName: 'dqlseuyhajgbygzgmsqlkcrkybvpcfg' WindowName: 'lzfycxzsakjpyefikcqrsamvbxxao'
- ClassName: 'nimueicjnkbkwtseg' WindowName: 'yvfdbsrcacxblybzthhkppkvsu'
- ClassName: 'xchadcpmmqsoyzzabgivqgyszcmtskc' WindowName: 'wiykwvkhblwchvyzxannnmpnygnrf'
- ClassName: 'stdbgukxbnyumildfvexqtuhacklo' WindowName: 'ycrjpkcwnbbycyts'
- ClassName: 'gainethztpzmitkpopdbtvinvynkuoxleijkcc' WindowName: 'lfqqdifpljbwepqjbwmj'
- ClassName: 'loygicxxwzuwktyzhnd' WindowName: 'dbgocloomdbcuolfygtrfigxkonmwqaesh'
- ClassName: 'rqlgfajsrbcuruleyubqncwzlwfxccdnmhngn' WindowName: 'qhulastvkyypxhcwwnleqhdbwvireiplnif'
- ClassName: 'swpvrehcgqvsjxvoe' WindowName: 'wawdndxddfagcmakowvbbisrlntkyqhkmcs'
- ClassName: 'qmryweowkcbgmlygz' WindowName: 'lyordiotzshdsueeeivqn'
