Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ecwtzyffiggelizkdqpy' WindowName: 'lidvadwwwctkgdxmezekbuoihpxx'
- ClassName: 'vzsxqcwzjmbfbghpkjhfpuafhu' WindowName: 'xswsvifzlbtdeyawpsauyfyqiliqvikjdvyvqgj'
- ClassName: 'jsycclrwnfwugztlyhwpogypdjju' WindowName: 'mxzzqnazmiwxieikjpwmrnhupngfb'
- ClassName: 'gbiktdsfmrrkcqsqohwpjynvhkwomlskz' WindowName: 'mmwwbodifyjinzgk'
- ClassName: 'ikrukqwfkcdgffedmhjlklyzeve' WindowName: 'vvulqkvwlbypvngzrwcjpfmvmluecaeuf'
- ClassName: 'vpmtxvurqvqjdksnqjeszodvzqlays' WindowName: 'mumtvfdnlkatszoioxefwbvtqjovasqkobyvgwk'
- ClassName: 'jawsgbqhinwgkzrpcuvxc' WindowName: 'ctabkmqggdwdutjfjxsebbjuvmsunvhv'
- ClassName: 'zezceyrqmtqfqdkdkvbhuybjhwgelatov' WindowName: 'bjnjvcydfzprfuolgfyte'
- ClassName: 'clahmljvenijfldikrafjdgyv' WindowName: 'kbxvstsdkwtdeeug'
- ClassName: 'ibriyrdoapuppatjumeycnsukujgsuygkltas' WindowName: 'hjdmgdhhdfrfwlwnqaidobbylel'
- ClassName: 'rrhrlusxzslongdzudlkxstgzlhapcqvsy' WindowName: 'adnxsbpuvcxqjtchplftkogbuw'
- ClassName: 'lwifiihdqqrdhujlyaouyucqclcozwmxhnpskwk' WindowName: 'jnftuupaietczrzekczofnieaskelhir'
- ClassName: 'bwvcwyrrpgzccnbbvwiqnmtjsxijdlawvcifdum' WindowName: 'jipjphvweorxdylwtholyghskbzpn'
- ClassName: 'cayvbssdohgvfdwgrgwlsaufccke' WindowName: 'mcjybcoiwwbogbrazkqbfjzwdudsguknvdx'
- ClassName: 'vyzxfhkgvbkxbwglncvcvtqo' WindowName: 'rqvvxvohowypbdkbyuyflhuhbycsolsd'
- ClassName: 'ptwntdkoaacpjnamqfbzxqwpbfqmitrmpq' WindowName: 'aumdikrhlvkijbyemicitoegfxiqhfntv'
- ClassName: 'itskcrlkrnnrmufmqpkoxlvzhmpihqz' WindowName: 'egiwmrduoexfktifghrlptveoguffsjolwq'
- ClassName: 'hvikiscgzyebhddhryp' WindowName: 'fxnxutwccdpzghlijqsrae'
- ClassName: 'sxporlgphlvlxkoexknuwhtikpeimopac' WindowName: 'nojfyisoyjzokefqfmu'
- ClassName: 'errjkcldbtyfzanmxj' WindowName: 'oazcchbehsbnvejwjjimqvp'
- ClassName: 'ymcnbnrfanaqiknrql' WindowName: 'sldmphhqswupvnveqybthttbvma'
- ClassName: 'epumrectakkuugiprphqeldvfjxbtcty' WindowName: 'jywekemvbipbjkfljubytwwxsvcrqrbzip'
- ClassName: 'lwzhvqghkvizzfsqaoycogyfswdjbpwhvikzl' WindowName: 'pdbmgnuviieznfyngonqlnglllwbfaaqfbxhwt'
- ClassName: 'aijjmnpozxkdbtwrlbnmvpynzvikvqytwaoftuc' WindowName: 'mpfvjnnhfrucchyfobcfgsgympyecdxkh'
- ClassName: 'zjcbpwqlwztnxhjaciucnkrpangorff' WindowName: 'unwoaysgbfaqdtodengtf'
- ClassName: 'qqnyllunushncrqyacsntpmul' WindowName: 'sapxzbswonqcdlwulpdqmdidplrvapjrr'
- ClassName: 'hxituypwkwiytsicroyiitysdlpcxnroosqcga' WindowName: 'snynohblrtdcsyvflfzvkpzvlpm'
- ClassName: 'ifgbldhnokqmgqzspccyyka' WindowName: 'hibgpylgzgaklmrgidxnoj'
- ClassName: 'viujoaikcnuoamcvxzegkcwenh' WindowName: 'ngkjvctdddauredenmldhnnif'
- ClassName: 'vflatcuovgeibshzrhzjemndwstexmte' WindowName: 'ltfduzrwmhnqakobg'
- ClassName: 'puetefattsifrqbecdljgwckg' WindowName: 'ixgwixsbvoorjmsiznmxpuymrhcwpjxgorirm'
- ClassName: 'lbicutbaevkogptaipsubkhsaxx' WindowName: 'bpuavotqtpbpisnauzndcvoyaow'
- ClassName: 'rboromwujqpnqkhfl' WindowName: 'zerkkxmnacansancarwphbzovagapju'
- ClassName: 'kojvaxqyxcbnbqwjrklw' WindowName: 'fpoifqjdwsbkfztmvjkwazpgnqckzgjsrnj'
- ClassName: 'vkhayjfxjajgmstc' WindowName: 'hhwarwxufbtbutpuksfztcomqaythphyqp'
- ClassName: 'lujvolexozvrrdd' WindowName: 'cuoiiobrvfqkpqedwydccrcruridfeozgrl'
- ClassName: 'ozudzecuhugjddrg' WindowName: 'nrvrtmfttgcaxkckbvtjdevylmqwfxij'
- ClassName: 'egdvqwwaqpioyglyqcyrxvjuf' WindowName: 'fevmainwjgvesdemfummluubuanqfakfznufh'
- ClassName: 'ehhtnwmdifhnqempornbwwfawltvewr' WindowName: 'givcadsjafoumyemnlotnnjefa'
- ClassName: 'qvrreaqwiwagtax' WindowName: 'tdlyszyftgfqwjlzboextixzfivcgn'
- ClassName: 'gxvbvqkdacwduatdq' WindowName: 'feytvwqeghorprdnwqzhquppjxdaynumqywtj'
- ClassName: 'lfkietvwhpwepnevlofqnrjdbcxxtrefk' WindowName: 'gkshslkulaxgjeqmsywlnlxhnizi'
- ClassName: 'tjbnuvmhwtalwzhswytik' WindowName: 'wmlkphpxacienjayzcniuylpklg'
- ClassName: 'uwrnrdkztlbfteuxvsbgkpmzdwtnrorlnh' WindowName: 'vvzpowfumedgpdsxlzimvtwchpdsatfmbnvgcj'
