Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'stxalqpstoiozjzxofnqsicnkmavpnrt' WindowName: 'pgiovteqvjrexwt'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'cqrsbjgnaorkflbaaxoj' WindowName: 'welhqyanebyslrzmhrv'
- ClassName: 'fobmfudkclvozpltruzcrlteg' WindowName: 'rkckwqonmwvtrqimrxxntafwaj'
- ClassName: 'xlkcngxhobpfajfzguxvvi' WindowName: 'qdkejzyyciezhxqcjbgcxewxoywbbluxo'
- ClassName: 'lomsrutpngemyfbwilexlanlztyl' WindowName: 'lzqcyrxymntyieguckothqdf'
- ClassName: 'cgbljpmwnnhqzyivddvkktvoyw' WindowName: 'mciepmktnbhhrtfpz'
- ClassName: 'ijdklyjxcsmwwimacpupzd' WindowName: 'lbvvoqujyylqlbxxgvcggacd'
- ClassName: 'mycssmjgxpkcpvfjkyftvuxymgmletlu' WindowName: 'sashsjsrphwhedioxong'
- ClassName: 'tggeniexemitennophphmnsartl' WindowName: 'xoknaiilizvswawpdtybbw'
- ClassName: 'edgmloqfvtrfhviox' WindowName: 'ikjdlvsoczrrtkwugs'
- ClassName: 'htgvbhuqmgfwqkgffdqjulwitdvnfq' WindowName: 'lkuaavpocygufehnwgfmofkyzexzznnur'
- ClassName: 'oohisvvwuipaexkocetpcbawwr' WindowName: 'knyjejslyqdkzpfg'
- ClassName: 'ouhrtnhmjfduboxkujqht' WindowName: 'ioudzilxkoyhsboumgleruywjasszqk'
- ClassName: 'mlbrcfaujrommeqjlgzhbolstfuzkcwqd' WindowName: 'hjiyjpmookhcfvwvuibtbtxvhpfzvwzxbpsc'
- ClassName: 'xcxkrklndvrlgsqemideqbxdrhcsolqjmf' WindowName: 'fqgykojdyueyofaiyflzyadxgn'
- ClassName: 'stuyliiaxxgdrnoflnlhxerejfjgutvlxe' WindowName: 'pxojzntkkcfncvcwxwnbqnuhenxptqrbcd'
- ClassName: 'ifapztrisdhvfekuptfhdfuhwgsgrfprxdncbw' WindowName: 'utadmhcwecncyqjeyjzzmldjspwtvnuylew'
- ClassName: 'ebgxosyrmqnivbpnccjxbmzwbmphsthmpy' WindowName: 'oarmnsvlscarlwmymobctljvyepfqvhapfsna'
- ClassName: 'mlryjfpgkybssvnwlxx' WindowName: 'clmjfrmqrxovcunqezeekkhinjh'
- ClassName: 'jngipoqfmrzfwnbqtiuxsnsdsvpijfv' WindowName: 'erecszxvhgehvhvxaaxexlckjymxeaw'
- ClassName: 'sixxascsthdanxqlvuawvcu' WindowName: 'mzmdxxjfxzkbakgufddzrnijlprpiiisskfiles'
- ClassName: 'deamubqsqujgyzngxosbrdgseytqode' WindowName: 'vbcbdzpewyfnqrynmafgiudfxlljdojiv'
- ClassName: 'cpsxpsvivxamtgerjzrcnpxb' WindowName: 'nvlnwylfkunkizr'
- ClassName: 'ydfpzjcytqglfxclitrvt' WindowName: 'mroabpewusxskqwxsgqmpjjkzxivg'
- ClassName: 'iwjdpkgkuddlcwbgiqfroxotaufcjtzlbyvu' WindowName: 'ialvxoahspeoqvuoeuksly'
- ClassName: 'bixhyavtezeijiejbnmnlplruxbmv' WindowName: 'sqpauwrgieippfpwjmqw'
- ClassName: 'grycuhnxzpblhjlenfuwybhmldxugqnb' WindowName: 'qszelrlmrjhcxfewqu'
- ClassName: 'sqcfjusifhaibupvkha' WindowName: 'eubcklyzteezchpulnefujediaxtrvh'
- ClassName: 'kycvmexwpvtlcvbjmrlpygkuukkibpomgp' WindowName: 'uvbmleqfyxfrvvmhdgabg'
- ClassName: 'wxesipbfhgwfvylisdzvyxgw' WindowName: 'xkuzadukcopazymxscoumz'
- ClassName: 'ypjhihjfhvauxguhhldzjjevtysf' WindowName: 'pztofrhpmvwnixxyichwhmscefrqdazt'
- ClassName: 'dijfznkjxkfidhmvjygjbfuigfon' WindowName: 'qyabdyuhrukgudhszyfoiifqonkiwoq'
- ClassName: 'ucsjibfbndlulzzsebhsrtnzvc' WindowName: 'jsemodhvcwiylvrqyipfqqrv'
- ClassName: 'zoalilecmlrmzreqmrz' WindowName: 'mcrspvxgduryvnjzogp'
- ClassName: 'gpiyuayfthufdykotpxuhfbyeyvnocjkxdq' WindowName: 'ccskmnpjfauuevuw'
- ClassName: 'vqgwtyrazbemoejnxkkcoow' WindowName: 'dsbnljgcwjrhwodgltvajpzhitlhinphrd'
- ClassName: 'dsonqvhtqsueeqeftblgbcxphzci' WindowName: 'yaubvrrstzuspypntvcxu'
- ClassName: 'kuufkeylmimnzbpzlltrdwrjygvwibabdpeltv' WindowName: 'meyissjrlauaijkilhtzobiwjadfpbgymvi'
- ClassName: 'gopkmlwtwrpapej' WindowName: 'nnvifqkgakladaghgzjsqzivluysztnnvviekub'
- ClassName: 'gkuyckwpnnxtqrnbyqxeksdqo' WindowName: 'tndyesvartybocjcmkoloeapxxjk'
- ClassName: 'byvhtafribnpbycpylnit' WindowName: 'bpyglhmlthiuoyeushbuzzeolzqi'
- ClassName: 'rovgvmxnfujihpiwenrmslypwjtsuernyhzbk' WindowName: 'emzysjrouuenrkwsremcsnbce'
