Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\Math.dll
- %TEMP%\nsa2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'zdifqylkgkjjbchlydohhbkhjduohymzq' WindowName: 'tnlfmelpkaeaxtakkwwtrwsjclfpzrkfpow'
- ClassName: 'gnokzmesytuevjmugrqzpvbduqwbmylbtp' WindowName: 'qozizxmfyuhcflsugnqmvosxbhvrputpiymla'
- ClassName: 'pmgvvcalxnzlrlawetyzpui' WindowName: 'iorobhlpyvdfhcbmnlmoncgxzanjynkn'
- ClassName: 'ggepvtvqqomoeqyxxygmegaocgrezoaungnt' WindowName: 'abackeelhzcmvghkvocek'
- ClassName: 'yzphyppxgldscorkakwsaeqbkhzmgvbmsuzzrbd' WindowName: 'yebrafhvndpsyhjljbhqex'
- ClassName: 'vsvnumwpjfifbtqlkzstqujwdgzzcqjhs' WindowName: 'uvexcpwdwxifvfppcqmrlrmwkxtjrcutwinyjrm'
- ClassName: 'wyabchiflqzujcrjkpikravnpsvlizwx' WindowName: 'stizcbpimjbozbrlkfiadbhiukgcgodkdq'
- ClassName: 'hldruigpdrenzheamglktzzggrm' WindowName: 'qtgyfiivtvvkdanrgldskzyqnphsdzvbwrp'
- ClassName: 'mhdfglajzxjswoirpzkboqq' WindowName: 'yoaamojewnysexxthxbyrmy'
- ClassName: 'ierzboerapsogdwxamouxijodpbsly' WindowName: 'xskvlulxdzvnmuyvmovdbwdqr'
- ClassName: 'tubaedfmiwrjdatpyo' WindowName: 'tqafiuufbykzkapnazsojdrhxmlcvjieibqc'
- ClassName: 'tlqwlaankmrvnluitoymvbjyqwgqfnuzc' WindowName: 'yuypybrabebxgixpxuracpdyxsypevwvycxonv'
- ClassName: 'lejfnuhaugdlvamdnbdrdzgwpdozawspoezwax' WindowName: 'ywjzvssatkcsgxpwormh'
- ClassName: 'qvgqlprzaqrxonclbymh' WindowName: 'rfbvqtolisuwcskogycwc'
- ClassName: 'xfmovnwsyhlowmeeb' WindowName: 'ixmclbbxbiqdarjslqjuoofiojvhajqlqqy'
- ClassName: 'gqnybfmslfwsfctkfbndqcsrvlxfekkpu' WindowName: 'ecxrgdcxnavluaejfwuasizzghyyk'
- ClassName: 'bzdrsktizsfwwnlilrvmvcsx' WindowName: 'eadgwnmsouulnvegkouwbpzmyacxt'
- ClassName: 'czxxasxgjznwsslptcfwarvsyojugbkh' WindowName: 'vxiazteftpczrxuiqwdltrgtibwfjzgawex'
- ClassName: 'nfjmcylxcwwfcbwmxz' WindowName: 'pfqibdrcuywmbgxwipuqabjhmenso'
- ClassName: 'kjxzorqlydbetbbjjukusefvkgcknmsrywsm' WindowName: 'kaewwjiblvrvauvbbgyqeb'
- ClassName: 'mcaegbuaofsdncwdyngjsfx' WindowName: 'bbrqlvlhobcfzgklbknssrcrsnrjguj'
- ClassName: 'aqzihtaxrfsehewxpupblxwfsrbvitghkeohev' WindowName: 'qszcjrtnjmekbsebkxblhjlox'
- ClassName: 'ctryixaxyacccdlynkzou' WindowName: 'aupxjmwadckxfuvmjw'
- ClassName: 'zwppqbgvaesitbjkedwzuwsdxwlhfij' WindowName: 'ardxsihaqqiplwgrm'
- ClassName: 'qyxrnmatpspdvcighvy' WindowName: 'qzwlbupkxgdmdqpqpntydzlk'
- ClassName: 'mwuvbiolebwpeqoyiur' WindowName: 'bmfvdaoyzcoywotkgrrtz'
- ClassName: 'wojmorvjujzxhifinghkjdc' WindowName: 'dtnwbtoicdoqboxupbvgshyzraruphtgbg'
- ClassName: 'dutodsstyhinycwbzmtaozhgdcmtwx' WindowName: 'xpvqlhnbdvywdjsvzvmsbedapjpuw'
- ClassName: 'pkugylmsgawaleobyxkmqhdsrdwr' WindowName: 'qyqwqhlqylpmnqsnsutlnofkuafzxpbcbteyqfj'
- ClassName: 'zaphnbxdcznidyiwfjlwfzi' WindowName: 'uavuzuoqtgpqgon'
- ClassName: 'jfgllzriktxmpdtzngj' WindowName: 'ftocycifrmeqxizbzacygxyyfmgusfvrwiegl'
- ClassName: 'rxbfbwquphkpsjzdytyetycgwvxqwo' WindowName: 'zujawugyclvlrzfypvgkop'
- ClassName: 'mttvjtojdllplyoitj' WindowName: 'cfflslwzhfyqrutbmwbigacpwztibqq'
- ClassName: 'siyugleclaosevdxacmlw' WindowName: 'lobqostxvjlgzkgkmfykcnvkymisrfcaxoprfhg'
- ClassName: 'abardkwdahkkkpnr' WindowName: 'qnsmaavrdbbgfpbhffrxjszrkmqgix'
- ClassName: 'sgftljxkssyxdmhgwmhlrutqagppuslnzrd' WindowName: 'dwlseadhqvloqwnzkqeijtlg'
- ClassName: 'tkxvsyeucytjfbeqi' WindowName: 'lltrobzgxcklzpkrfxjeionwceozxgw'
- ClassName: 'yglozspkmbyhesmuvghzqstcsxtzb' WindowName: 'tlswgggktbhjixfdjdxjebn'
- ClassName: 'tqctsobikyicnslmbugx' WindowName: 'wlgaqwhzsaiqssfuy'
- ClassName: 'ugdstencczxhthwv' WindowName: 'zikhgjnsixgqdkuxcxdovudalektqcttvg'
