Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'gtjzfzcwcltbpsbpqzdoqcxakolryqeqr' WindowName: 'eeuddntahoqwgqoppkfuilbwynbjux'
- ClassName: 'jbdpfnjoypdxbjnpfvhqaqhomvvtoji' WindowName: 'oxldbrtpzhhmbctvkxcpc'
- ClassName: 'sxyjvbemyofwgpifcgfofogwhszhny' WindowName: 'jnqmebijoyeyqipgvr'
- ClassName: 'nrquljzkvflgaulaordb' WindowName: 'ugtcjssgzuswsjkqtiswgiwupeo'
- ClassName: 'aagpupmuaitmrqadndakdcuocufhsdlvagsag' WindowName: 'ifndjwyqdixxtfxvjgdrtqfj'
- ClassName: 'zrgbcdsqolrpstpssxwhlordbpsnzkyihidsbam' WindowName: 'iuifjekplwrlunontjqw'
- ClassName: 'agjmrnsmxuvbjxubske' WindowName: 'ilnahccwgxfkqbxfdvkvxqs'
- ClassName: 'yzohkshjiniakqifbuxxgmqllilhihiynbmgw' WindowName: 'eitvxqbgtlmtwedywpgsyissfxy'
- ClassName: 'qyfsqgfxebvxbzyvmjnaosbozcrurfkosvzaxb' WindowName: 'mosxznltvnowecxuhfsv'
- ClassName: 'locotaccvwbueabubvxnorvljbzlfao' WindowName: 'ktjewulhqyzrcaxumpamznpmpclzy'
- ClassName: 'ipjxyxcdhrrenerugrketfkpvglrrnaxyzf' WindowName: 'wvzccvrkmyepyivjojqv'
- ClassName: 'atfwcljghwokgzpcekfhazhfdxltu' WindowName: 'hehvbgvmlpbvhozvqmw'
- ClassName: 'fxwkxqpbghimfjirnjzemjzv' WindowName: 'brwwwkoxxbzwrvmpxiuxkxtqpg'
- ClassName: 'qmcdrsuldcqqwphhavad' WindowName: 'ceuirzisuquoxffuqbfawcy'
- ClassName: 'gbgdoiokoenuubadltbatbeebmeehweod' WindowName: 'slzaovfiiuukqacopgaumo'
- ClassName: 'opskrioartqagoecxvzqlprjrfbbexbasvpv' WindowName: 'abffcadtgznivbdbcfjcpnudxfhrmtjekbos'
- ClassName: 'icpgwvhxnlbdczrzyhysdfogfmzgvwotvv' WindowName: 'cxitocvipmmnushjiccynvssrjpr'
- ClassName: 'ghytcjyrxazuccewuqcvbjvxhsym' WindowName: 'bvzmvdkdjuvauatpuypjkjtzmepzmzmeue'
- ClassName: 'dsbmbjmwstznipvemqpgauvtnbbpuudscamp' WindowName: 'dxkowdqugflesfonnvkbbjtwztnf'
- ClassName: 'dytwalljpvicejfymxoenwtynvrpcopoxclgwvs' WindowName: 'ilbupfsrtkxufjjijlclgsestvauzepgnyjn'
- ClassName: 'fakbgypdcsuxdupmoekyhycjiuaopiff' WindowName: 'qqyampoyxdiffdwjlrndbnujkaeobvkmx'
- ClassName: 'hmazivdxnxyrdcyjyopybdjteyjmrtdmwamlt' WindowName: 'voklmnicjbrkusbizxowvfvghlntomvfagfb'
- ClassName: 'awbbtqrqxmtaquvilvxeashdwkgjnjag' WindowName: 'aakhiwkeygsaqwciotftq'
- ClassName: 'jnopreoekvsfkxkbhucnr' WindowName: 'kietqwjrgdlushwgdxsypnyphvjtabljhdvwcn'
- ClassName: 'nshveriluvoafsaidkxsvlbctkdtdojszzkxag' WindowName: 'kqopbvnqmkjgjlqhnpolngkwdocmyyb'
- ClassName: 'yryytksqyzkpaaklxgslxpcyoduiurymczpwz' WindowName: 'ifeewmofdthdvaelughssyi'
- ClassName: 'ihmmpogskunjrtmtoqymcbypvoadjopmh' WindowName: 'qgrwetjgvbcjwtfqeviubajpie'
- ClassName: 'rfmtuzvllzcitpegdqtgakckwwgagbrm' WindowName: 'licggcwylmlhrlwfv'
- ClassName: 'waixzmupmkoitep' WindowName: 'stbywawhgdwuhhmwwlhpaevzbtgeyp'
- ClassName: 'eghobzihmfrevlh' WindowName: 'tsezxwncymajdnludaggpi'
- ClassName: 'nmuowwopdxebrpmreeqixsf' WindowName: 'fxfrtxznaribdcnkwescoev'
- ClassName: 'gmonhdmvqbokfdtfhivzieuofeq' WindowName: 'dzebdoacbnuitmldjoqcefxjo'
- ClassName: 'nrhjfxqddcdislvvvzpnprewvpqaxdtpqykqu' WindowName: 'axwtzjpnbzyvpgaedcbihgycgzq'
- ClassName: 'tqymnawbcuwexjebxbnjixcx' WindowName: 'zchutapmdxvjpsgbolouxlltyfyjyx'
- ClassName: 'gwwghsiyguzxyjlwrmrtytng' WindowName: 'ilhnwflxlgvunsuihbvipdjtohymyzwwehreugl'
- ClassName: 'wpwiqkmforpwyukjdyrr' WindowName: 'fwuzcbynbsljlkxxhsujtgiycrpdpr'
- ClassName: 'wcxckwnvrxtcvvuddoosnijzkg' WindowName: 'poafaxemcpslzuoasysltujwsurv'
- ClassName: 'mycbmmalrgsyojzkezmfansjqly' WindowName: 'vbgkfigttreearsurxklacoycpiwibx'
- ClassName: 'amjjjihfthifgueukvvv' WindowName: 'gukqjdzoihaptbdiobeke'
