Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'yivmmgncxsztfjjecjpcxelzpanhgzplgavyvu' WindowName: 'gzstmmetuqwnfsaqnryhvgfflrxvblzsflex'
- ClassName: 'lqtrhkqbmfobvpspmj' WindowName: 'qfnaqyrytdeqfunpefremjwshfhnwtixjqzm'
- ClassName: 'cahvigxooldhikwipadifzfgqnmohs' WindowName: 'ixsimkbzjlupnnncnosoozrgrqv'
- ClassName: 'wofkdvbcqmmilyrvmjtolukcvjzfzcguxewkug' WindowName: 'cvelfrspjrzwsnwggfpsfmn'
- ClassName: 'zktzkuhxhfxjdnlvmtpuui' WindowName: 'prdupxbxfifloocbhemnqvmkkotbyxxsgzgwfhc'
- ClassName: 'lrhpdzyfjaypwxzqpoah' WindowName: 'mrdlmvofbpmnlyvioywjwiylblym'
- ClassName: 'bzofgiaryxyqvvgln' WindowName: 'ucugxnsjruhqfqfp'
- ClassName: 'swnzmbozdseeafpljxiyiehlfzkrjnyvks' WindowName: 'mdzdljtfrauyfnkcntcnzezolp'
- ClassName: 'lwfacjswnqsjdrp' WindowName: 'kbbsatcuhxacvguucaiquaupjjkatiagjacv'
- ClassName: 'lcqhefaxhjvavblydvkwoqsaf' WindowName: 'ycimvqimsnfpfwcsppxryxomnewgedzqbu'
- ClassName: 'wqgutbyeupvopopbfuszr' WindowName: 'mlhtrrxuiofebmlgmuespynk'
- ClassName: 'pawhvifnynppyqe' WindowName: 'jiumgekaatsftibdoamchhydcaeyp'
- ClassName: 'oqzhbnwjzivnfcptfshvzmqdkiqrvv' WindowName: 'dvmnivqgncqaghrrrbimwkzvho'
- ClassName: 'vmfxtvzduzlleevqqzpwajyp' WindowName: 'jvbpbhytqclmgikrkxdaykrmy'
- ClassName: 'rldtpraaiuenrzugkcyzmeuvey' WindowName: 'ousiajaxynlatqtofkbtjbafsmsltdcpdlmdc'
- ClassName: 'xoxsbalmrqkwtunkwkxcirvgbecdpmchqdecjgn' WindowName: 'akkxkvilqfeplpgxxalatypsqsiecksm'
- ClassName: 'xvnvuzxlrmkycoewlgjbokdxogzlrwlxqsa' WindowName: 'rccpkamudxhgbhlkpdyjdfzhjasqchlvzzp'
- ClassName: 'vbbylqrhwjvplrtunqhugmpckmrdslyqzkcfhgc' WindowName: 'wibrorfbxkiwkvljhzequpbmbco'
- ClassName: 'nfgguxxbklhscidaqrhiiniikloxa' WindowName: 'hxnledwzyextvxtzqdar'
- ClassName: 'soqvzxnzarxydcjiujysc' WindowName: 'wbzyzfzaeiuqpprhrndxoufvdtp'
- ClassName: 'bgbomexuzuhelggmq' WindowName: 'ujwoprxhuircsipsxldhnvpdqllk'
- ClassName: 'rtwjlglwsfmvlyvvqbmfithzcxmjy' WindowName: 'sgjqpmwghggkxlkkyvsbwklsolinflcq'
- ClassName: 'armfjsnncvlfoffuawumgjvopp' WindowName: 'pfeehilpnwcuucmsamveaoldceunyf'
- ClassName: 'ugwibdusveeykzplgbeos' WindowName: 'rwfxzdpznjhyhzpumvqknqnhzia'
- ClassName: 'ysrhriqbfeflzcqoedmjgtorczocggfzrd' WindowName: 'ocynkfinoesjmzcdpijqfopbotlidhzgbpk'
- ClassName: 'hwlneqbjzcmyfjnxg' WindowName: 'qtdfhnswnmafkwdidnyxrjbkytfjs'
- ClassName: 'indfhwcbpnlzmmzcalsmlqkcpgcwremnlvghfi' WindowName: 'spocuetxwshjwflimxcfksa'
- ClassName: 'dcyguqqrzgmvqugghsjkrjtyeglxnuhi' WindowName: 'kkyuyjhbeknzwqkvyrsawrmcjwjwf'
- ClassName: 'fnmqeaaoqlwbcqhypyfd' WindowName: 'xcriagrkmffunjybabockwjupn'
- ClassName: 'pmrncnsokptpniapaqfevdppyuwgnbdoiuxz' WindowName: 'fbizmwnrrvpkcruxjwmuurxrtnmhgrji'
- ClassName: 'beleqeejautccagievswzkckggmg' WindowName: 'rnsymmrmowefqlyctahtqc'
- ClassName: 'oatehzsvlcatuxaickhlrngamzvlwi' WindowName: 'uwuqqijxhhgnaxws'
- ClassName: 'txgrzxjnqxnwfyml' WindowName: 'nsfoxmwafhwrousrckmixfssuqjajnfcaldlox'
- ClassName: 'bqjzkynmiwlxwqtztrhyjebfruzyaj' WindowName: 'qdlvtvqhvkvazrcmtsuhyswacpvwdjv'
- ClassName: 'zlswlqecqpvuhikq' WindowName: 'xirhosildohhbwtzlxic'
- ClassName: 'brvwpajiaputwxhapamyimbusy' WindowName: 'zgarilerxkqwavxzsotushfntpeatapimlvyz'
- ClassName: 'ryngpadxglilzualetegwnncavwb' WindowName: 'wmampsmfneucommhaimhadurqbionjm'
- ClassName: 'brwgxkpaiczvfkw' WindowName: 'yrmrcbvzsyzmokkprhzfoevomoanejcjd'
