Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\Math.dll
- %TEMP%\nsa2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xeqiyzfnpbuezxoaazpfgkbaafjcxxgmzicgu' WindowName: 'wssikfyizcqdsizqy'
- ClassName: 'zgympzueqvxqksnwbkbbeqtkwggdvbdabkqzuqb' WindowName: 'emsanlwijxzrqtlbjj'
- ClassName: 'xphhqssnpspjwiivwyzhzyirhemij' WindowName: 'ssutxltmbfkrjqscobnpjy'
- ClassName: 'zjelhtrqleqydyxtjkbymbp' WindowName: 'riavhjfivcqzbde'
- ClassName: 'vilrrgafubtupvdkqfiqxmxektskzyupf' WindowName: 'jrqaumywdjndkdtqepzc'
- ClassName: 'nsmapsixsdsuobdfkuxgpgfzjxfqzhqvahxnelh' WindowName: 'rrnedxldzwisdgmsydammcycsrqibvenkzab'
- ClassName: 'kkkdlrawafpurnhhkgb' WindowName: 'jzskroslrpohmefxmoddewi'
- ClassName: 'rcbaidzheqqdkyopruhyywbsbt' WindowName: 'iqgrsksilmkiqycyg'
- ClassName: 'arvbkstovezkskrzjbxvkskmxhqttfnjwxv' WindowName: 'dqugwnnlbwrcndzlobrjpjwvlgzv'
- ClassName: 'ckrlvowhverqwwatvhqwfsswhrc' WindowName: 'otnzsiurcyrvrzbqobdzvxverraecjdxfi'
- ClassName: 'mmhdqjftexzfpvgoiabqocrqznmkcbxcle' WindowName: 'qlsmicardcbukingraamcrpocnwfhwmoh'
- ClassName: 'gozbvfjclnnsenlanxofitbolssaarvcf' WindowName: 'xolfdpsenkfapvwnqcyjgryaqlerqgiojegms'
- ClassName: 'inofkpbnuvwryniceiptcleyuki' WindowName: 'vwubuqhdzjvslctpgpgbfogyrcukplqxm'
- ClassName: 'mttpskcaivcchurievxe' WindowName: 'bykriplkcxvqoiautgf'
- ClassName: 'oslashmetdpptqhozytzetlokdn' WindowName: 'fpwvxiwduzxwhudmzvrswijus'
- ClassName: 'gmpxoudhunmahtxefk' WindowName: 'gqtguttosxiaixtkaskdamrqd'
- ClassName: 'dgrrzfscwevutusfggznjggydjujqfofkyjxnav' WindowName: 'hgfmallgzsafligkooeoc'
- ClassName: 'xvudauuqdqlzmhphm' WindowName: 'bqxinowcpsprbhldyfb'
- ClassName: 'qpknfxkyodtrfao' WindowName: 'tvvyiiinxuvrcniasxgnaf'
- ClassName: 'sohlkurszjjqwcp' WindowName: 'pkrhkjevskzhjokcplioqgmnzewemlwwua'
- ClassName: 'vsfrjnqmpzhgrkiux' WindowName: 'aqxfuskmcphpdzodkbmju'
- ClassName: 'qenzvbaxpxcakolbkbytt' WindowName: 'pixiakqrrjjnmjkyuvnenjk'
- ClassName: 'ruxscyhgzilpdiqcwtorjldhkkzcqn' WindowName: 'uqcnjdxvnpzkwfb'
- ClassName: 'xqlfixgktfzpfhlfelpeuhlomqbzhcjudap' WindowName: 'rmgwcayacczcyzttdnxwr'
- ClassName: 'hkdlvksrzgfefxlxrlloxbyxvgm' WindowName: 'chnqnjoywhfjftsgxqykwen'
- ClassName: 'xhyupvnffteybeuzaowlbfvxirwxycakfroshqp' WindowName: 'ppprkbrqjxnhshflcdvmjseujgne'
- ClassName: 'srecxzjhyhprajgtmnrketqp' WindowName: 'tmrpillyfphfhlpt'
- ClassName: 'qteqgaccacusoeqhlaysnazuhwsdewgfyumw' WindowName: 'gvbwbjjakhsqklrsimipiwtrjvrpjonzoiigxzl'
- ClassName: 'ysijeutamnhzreeexqdgvqvur' WindowName: 'midtbtehpfbqldpgoosnmenbvqnwu'
- ClassName: 'czfdkwetrchesiynrviq' WindowName: 'waipyiisobypnkvvsctasnrpgjqzy'
- ClassName: 'ioonrkqrobempugwppivbknxej' WindowName: 'frirqktucuixobltncitwrdpfmpqneyroibqf'
- ClassName: 'iihfowcucljsagv' WindowName: 'leapqzotvwmnqngcalnbsyqacfqtvuazflnnsp'
- ClassName: 'upgzrkztgtijhekqgvxqkgz' WindowName: 'iajvdumjtkzxwovokiyqwufsmsqcfzrbjk'
- ClassName: 'pwrkloarwfqdkfnegeewgfleb' WindowName: 'msamdluxmucplplrcwhvbu'
- ClassName: 'cmjdpagjuzevqaynfnh' WindowName: 'jxtaebqddxmygwtqczbyrypnv'
- ClassName: 'rxyqmfbdqtzbdxe' WindowName: 'flhzskpqyqunquuittskkqyo'
- ClassName: 'agfoluatgbslhwtsedvrgozlmdyodlxk' WindowName: 'xbqggzcpgxtssxrtizixkyf'
- ClassName: 'tyxylyqrcesmbyqngyapyzjwogykd' WindowName: 'pdkkghhjoymchubbxwetk'
