Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nso2.tmp\NSISdl.dll
- %TEMP%\nso2.tmp\Math.dll
- %TEMP%\nso2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nso2.tmp\System.dll
- %TEMP%\nso2.tmp\NSISdl.dll
- %TEMP%\nso2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hjepdkynpsdtyakwbudbazunlyq' WindowName: 'vztpxgfzuqgyzbbb'
- ClassName: 'sxaairzgeugakbv' WindowName: 'ldlfucooacvmrlpgdtvsz'
- ClassName: 'isppheedbkxhkrwbjpkuzwseqlmoodbng' WindowName: 'ljhqfxifkcmthodwictdnrx'
- ClassName: 'tphsylfbcygbdwefuhmzd' WindowName: 'rfzocyfjusnbytqbgmhqvcxihyucaavqo'
- ClassName: 'lizybtbyztktobjkz' WindowName: 'vbqwgypqptbtkgluddofnvr'
- ClassName: 'rygewktjljajhdwdrghiwnlqrdpnqqhzyu' WindowName: 'paiqofkpngopxnoyvyjdzjzjmryn'
- ClassName: 'nddmkjkyfcjvlqyqrxgw' WindowName: 'csrnfferazrfhygwevkc'
- ClassName: 'tnwwjvpxffgaepnvquafyjlmcnwuiwgmpdr' WindowName: 'guxipxfwvckowqiuqxyzmdawau'
- ClassName: 'riokfvynjouckrqnsprdkevmkejypvtjxxs' WindowName: 'lrbwbjxptackbkwhhlnwrceeyryrzdm'
- ClassName: 'jtcqmscvqowzndtbv' WindowName: 'cqeliuhzigbfqteuesueby'
- ClassName: 'sdnyonlswqdzvrpumswqpfmn' WindowName: 'yqdvcawktdlxdhraeglydymotljnxjgonqzyrt'
- ClassName: 'iwlaygbjzmtbmpdolekeohbhipwwckepncuhwk' WindowName: 'fqxtakzgdppzkomriypnjz'
- ClassName: 'joeltjfwgijrreapgsdctlslvbgycwip' WindowName: 'smonkzsnuqphiitiargabtbkulgydg'
- ClassName: 'ysssskfrdjibnwphpe' WindowName: 'vqzibysymgtjfuu'
- ClassName: 'kvgkpaqneltnxohuzdxsybhevtnplpkkml' WindowName: 'uzavpngfirhlgdhjogcdqbthevqxgq'
- ClassName: 'wldptuxghxqvabag' WindowName: 'kjekqyuclccumuvofinicpfuwaqbvkiql'
- ClassName: 'uxyhjaziehdoptkgojpbnosoauuyvzoxdt' WindowName: 'oozauzmiqmuzcqmrleastangvmhpzrrlx'
- ClassName: 'izdcacxyegujvbvyh' WindowName: 'vvcrafudckfbgmwtufirvo'
- ClassName: 'nethidvfwqhrexnctnqarxluxgxg' WindowName: 'oguphvksxnpakzqzacvfhstfgbtsm'
- ClassName: 'gqnvkcectsvanoydu' WindowName: 'doxormwdaavcrisrvnluuiqbyayzvivyxjnuhcm'
- ClassName: 'ickaaymhskgenhwpoffxatclsrydxehmqe' WindowName: 'hwvhrlmcboqstcj'
- ClassName: 'xfctutimhhclhpdqsprejc' WindowName: 'miqfpztdfxdwixytbcwkgnxxlk'
- ClassName: 'dcptwaggagbjjatqxkfoneaivcwoqitniqcboib' WindowName: 'ufqrxevllabnpmlrbfhitenwynywpvlytsai'
- ClassName: 'rmobsfpadgncosbticvzorxwbcplk' WindowName: 'gzugzssigoabrzdvc'
- ClassName: 'ktxbliqvcpmqwchjfuvukglqgjeddet' WindowName: 'yoqnrngdzqkrbtnlyxbfamxnbmztfqhv'
- ClassName: 'tgcpdzhazqcacxqfoiozi' WindowName: 'gofrltckxemeiqogkvmefsqcqis'
- ClassName: 'enjabxnqktjdmslnbcnlgcrilqgobllwir' WindowName: 'qujvnzwjmkezljoafganvgnvafcvqusudd'
- ClassName: 'drblsmdnoqczoozjiz' WindowName: 'ddtwivafjptiatzbct'
- ClassName: 'eiqqqabgvdymkbpcdfdcuaicba' WindowName: 'vufnipbzfwlmtpq'
- ClassName: 'fxpuxmrtpnhtrzuwdwrfzsp' WindowName: 'mdsekhimbekvhmvqosgvnucquo'
- ClassName: 'izojkxyszlsnuwfctzllcepufnpn' WindowName: 'gqrklnlselsrgwvsrccty'
- ClassName: 'actkrosazseupowvfuw' WindowName: 'irrypdcpndqogsxchnqstffbwftqmbajoyeyy'
- ClassName: 'zdkvdmoamytlazxxtmzsuimdqjwvppa' WindowName: 'buauquwudpyqxrpwfzuesxvozdocmuxg'
- ClassName: 'zujttpbqtscbvozdawlvx' WindowName: 'whpzxsptoobvbqhhnvpqf'
- ClassName: 'tduecmkvogsdrwpwypxdxfercboztrfebksihtf' WindowName: 'utpcjlsxzkiloalpdoofgjhhvfwwyw'
- ClassName: 'ugrydcjttdtpyxtadvjzgs' WindowName: 'kvvehofoyhpexmxgmorewwwxodeakl'
- ClassName: 'frcgnzenuhjwjpdwrmnoo' WindowName: 'zpdtzmsspjzccwnoojappgqfj'
- ClassName: 'ybrwxdnybdaczzzqtfeevnecxckqtzk' WindowName: 'ccvcgyugixjilsgrh'
- ClassName: 'tefvddjukkgxxxqpxlarvkwbnhblc' WindowName: 'ztcruhugwoedtsvpwxmmowlrxeypgz'
- ClassName: 'ovnsouahdflaqtdvloyibdbnmjd' WindowName: 'ruzvqlqmzvoplhifpjxmleuwjrelsyw'
- ClassName: 'wycagmgfrdxozmjaycgjepkqtarxch' WindowName: 'dqjeibtzbvthsplpmd'
- ClassName: 'svdnceqejxfkgqco' WindowName: 'iilkpdocrorvqffdpmrzteulzpkndzdsahmlfi'
- ClassName: 'wbqngaqazafqkuldfwerezgrd' WindowName: 'ekatbeapfivzjfowbvr'
