Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsr2.tmp\NSISdl.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\NSISdl.dll
- %TEMP%\nsr2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xuegldqtnqortyxafuajyzlqakiepeiksn' WindowName: 'kewnotdessnnysacwuixk'
- ClassName: 'piyniyousvxfpaohwgwydhhdljdrrpswltoc' WindowName: 'bfaxzirtimhalnpnotjcyfrsfrpqfaxuuo'
- ClassName: 'iqazmhovzqbaxxukdgijwnzcpfqolmptcdwhf' WindowName: 'paxyhplhphfvowgz'
- ClassName: 'xmfpfwwwfmjzwfxeyubymrlghxxzwzzunf' WindowName: 'fskeorgvhemnkszuiggvyhsihoiacj'
- ClassName: 'zvxtawgfqsvrlujdntrkyuackkbvuwhubwhtkdf' WindowName: 'xdnpndgkzezmhnh'
- ClassName: 'ryudyryfifrqvoal' WindowName: 'qotmxjoqffzeqnzmlgsdf'
- ClassName: 'jtanfdgexjsdvytwnaztqjd' WindowName: 'ixzpcxrtvcmkrvzougqxbswwqrxpvlxdbjglw'
- ClassName: 'ttsuvorsxybulfqfrdcfblpv' WindowName: 'smqfdddakhxijyolbkvcxuhkltqle'
- ClassName: 'ipuzotlexxhvjqyzokkkgfe' WindowName: 'rmddcwomyusrakmxvywetidybfz'
- ClassName: 'ugnbhwycohmpqeiwllxcas' WindowName: 'onmpyrwixktrtitrrkfbdqkwiwexl'
- ClassName: 'meytasixkniemfeuosxldythdijbefyociewx' WindowName: 'lctwewmusfzpgzqqbdtmtxvrelwjlvsie'
- ClassName: 'mlczfmzyyydonoybraxlosvdr' WindowName: 'jrtiwfqkzwcafzwdu'
- ClassName: 'fylbkpriyizeuzagxfszgzrxagzpaccwhbuqkyn' WindowName: 'gzurqbswqszwdqwykkhrrnpga'
- ClassName: 'ituaxkfbbnzltyfcsd' WindowName: 'ohrhrybrfrohjdywqdpdujrwcytnebeabks'
- ClassName: 'wshpmlhqbokdtxvijuetsswrhandnl' WindowName: 'jwfposhofeojzikzgqzygqluuqyexeokgsm'
- ClassName: 'anbituhjsgplthglhaqvatztaw' WindowName: 'pqqckfaphlovpzxeeedpauyxxl'
- ClassName: 'tazkqmciyxfeedncgissofoabmjumkcumava' WindowName: 'nnzlkqsdxyotdksdojhwvhw'
- ClassName: 'olhtnljcfrpwwzwgvymjejhsob' WindowName: 'lfebbowhdcyrfguium'
- ClassName: 'rysqarknsdhptqyjm' WindowName: 'slghviwgzdtxzxukvtbhyjyzc'
- ClassName: 'pvforgkipnvtlidadzmxxuflikxcny' WindowName: 'jqwxxaquomohhmrqmifhdszzpzluxahiae'
- ClassName: 'ufuqnemzmoekwgfyfnbw' WindowName: 'kyyqgjlocshsuevktoynaba'
- ClassName: 'lcpbzqyifimjqtyodgqkbftsoia' WindowName: 'jqbawwmbpvxdbfnwjuulkiijbdhrfhoiqpmz'
- ClassName: 'ooyglvhgfhirkimmcpfvnxuihuaewokthl' WindowName: 'flglxhefoiadyfbyenznsfalce'
- ClassName: 'kzbofcxloitvilhqhbmgdtb' WindowName: 'vyemaqffvvcichdhzjvbwkgafxdtgym'
- ClassName: 'dwrjpxumpiyjiwfowdtlk' WindowName: 'gxqmixsyhppnmsznfxleiupkzehufhqtvr'
- ClassName: 'miqbsyhrparwhmhfho' WindowName: 'bbedospdjoohgsufixgdozmcshsrrrmwvji'
- ClassName: 'evasvggmryjxtqjqmulxabgyz' WindowName: 'ywovjyqzwyblgxlgkrfpw'
- ClassName: 'dvazltocwndqfraljf' WindowName: 'aiqdhwwukwiltkby'
- ClassName: 'btevkdylsmrowvamlc' WindowName: 'ilbesunyfaivheufmhh'
- ClassName: 'ibdmarkymrbjukcdxgjozb' WindowName: 'ztyjhmdxgmijuegvihzyljanyxxgqbab'
- ClassName: 'bfljjjsssgblwuczfuedlncmalcjsbchgveyujr' WindowName: 'eyvezyltksqlfcedchwwg'
- ClassName: 'aeoxyvjbvxjjvocjcbadwjgqi' WindowName: 'tsonofgerxplrlffekoqkhvvbtgivzqmd'
- ClassName: 'viebsxsgrtwngjpxjjljatlkpdiqfcwsm' WindowName: 'aamtpqijvfcwgfzhlaqbmocirx'
- ClassName: 'uqzkswtfigsroegwjebzjkhiytdbtknesx' WindowName: 'tzodbofndbudjnvhmqrynwsrrdqflqyhkbcydk'
- ClassName: 'hhndvtohayhivgqasmfpwaezvwlewwekuumnff' WindowName: 'bwydanehfborodyzbptibdwsqnhbor'
- ClassName: 'uzosrsyopiuvjzppzfkdm' WindowName: 'jpuemhlclgyqkidhyqmb'
- ClassName: 'vilspbdsmagwvzzazfqnlpaepyxbxovlavucxvc' WindowName: 'hepapcucndhcctwnclykygl'
- ClassName: 'kplqakvrolytnml' WindowName: 'etrhmfrjgxlgjchaiqd'
