Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\InetLoad.dll
- %TEMP%\nsm2.tmp\NSISdl.dll
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\NSISdl.dll
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\InetLoad.dll
- %TEMP%\nsm2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'rzdhiuigguhfkzcamxgtkgmmyjcue' WindowName: 'vrztegcbfavwdpployupbrhtiwytzqbunwcdtv'
- ClassName: 'yyguzbuepzaiqwrjveti' WindowName: 'yvjokfovbytmsnxekrxtw'
- ClassName: 'dojcteeemzwkydjsmqnirsuucsymtb' WindowName: 'avarjpllbdhruntcgenynflalew'
- ClassName: 'ptqylhnoobhgganfjhwivqlu' WindowName: 'aoepecpqyfltpcwakrdstvkju'
- ClassName: 'hkutyxosmyeexpigcakmohm' WindowName: 'blofdxiflezhrfzppylzdfjfloohxhpsgrpztq'
- ClassName: 'ccehqdgkihfgtzcgkuobysolmdznkcznc' WindowName: 'ixacqnvkcrqftmfkxektayhjagjpclzek'
- ClassName: 'uxdauqkitrdapzazcjotibyaryuimh' WindowName: 'yuqzymmvcrgslzuobueepmkrdnddqr'
- ClassName: 'pecfkrdeobywyvqwcu' WindowName: 'twcmhxkjklkuwgrogdwq'
- ClassName: 'kfnzdgrhrbzdnnuwkykxspd' WindowName: 'ragpzhwtlfkwcejfzmaoigsvqbjig'
- ClassName: 'jfbtqeeiqixjpewcno' WindowName: 'bfqazrihqdxraqeouuzpdqaekc'
- ClassName: 'jjywpotiftikjhcgnqxfmw' WindowName: 'csboyhxdjwdrxckywtwdhsslybb'
- ClassName: 'cfiutmrfixjczjvoucjqbukywzjntnv' WindowName: 'sxhutbqskxsrkfetjlgul'
- ClassName: 'dtheuztboqhstofjtsvqjehnmhsgoqoqttrw' WindowName: 'bzvdzmzuwqnslaoqjkkbnhpiwovubwjyfeue'
- ClassName: 'lvyksuonbiazmxtshbug' WindowName: 'rycubdgxsvlnhiafxeqcahjbro'
- ClassName: 'hrzxbagrbeohexf' WindowName: 'kbbycfnderaznmdvpaxzxsnauvmkadpet'
- ClassName: 'tpkyorovlnwrahbyrzui' WindowName: 'gpzcgkobhjgicqeppvhwxybfh'
- ClassName: 'uxgojwqvzcjcgrpzyzevr' WindowName: 'bfzbybjgbzeafbpvgwytcjtow'
- ClassName: 'qhqzasyroqhqqypxjbxdzdrcdazwqlskmfqklv' WindowName: 'gkplhpbpvudbfaauslzpdau'
- ClassName: 'oksybtamtkyzoepvsydar' WindowName: 'rqvupflzxmfgiligcrj'
- ClassName: 'nreblirghptsjvtzfuicv' WindowName: 'pgifbwrwkfohtlcvwvvmaklvkkamiixb'
- ClassName: 'cqrhyesfhaejlsd' WindowName: 'iyipdhmeysawtcrlzgjuvvyv'
- ClassName: 'rikxdiymamywasckernimvjykhskerbysuh' WindowName: 'xmojtgusjanrdsmdwqxutnmwrpyga'
- ClassName: 'hghzhpukoizijzyexfzjthrke' WindowName: 'rekgtcdyqvbhkjnkbpuzmoikgpuksny'
- ClassName: 'dnxckfwthfecalcvsjipdbxckkkmq' WindowName: 'bfdnionvddbmucgvi'
- ClassName: 'emmtljzbcxrervpcsgdcushn' WindowName: 'wvwxrjwibaodwjwbdylovemvewitylrsekwxig'
- ClassName: 'huilxkdchbqvovws' WindowName: 'wrgnxxjzwzkmzirzkvpluholq'
- ClassName: 'psadlckzfmpeuehukwzuatvvjxnwktlhtiabxzs' WindowName: 'giwtagzddrxyahda'
- ClassName: 'cwpbmsmexdsuphkmhgmwgqhju' WindowName: 'obalyxvxziniilfsotslqtppihjnlckctxvpn'
- ClassName: 'qnfdfehwiuveylkkjfzrehtnjvqm' WindowName: 'ewxvtzrwlodwreskfhhpmqrcgpd'
- ClassName: 'rsfuewkrqqiseuyughbwqljybk' WindowName: 'vtygnowfinfgsrjatssg'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ngfirurfbfvhrxst' WindowName: 'fsagrykbjcwcueiqdyqgasvaxuvyqttjqbzwe'
- ClassName: 'wwjwvydwhddbzcnbopotnbbxrdxpe' WindowName: 'wdooapkiimrozgbzwbupdql'
- ClassName: 'xodbxenyztfsizgfxu' WindowName: 'xbspncuulhixvzlczpiazicobhqbgielvlmf'
- ClassName: 'joojncbhjjufkjgxegirbwaeuywiezbvoy' WindowName: 'unepuxvgrmrsbqevaiaivkzrmk'
- ClassName: 'dcnovtohdywwmqkwncqksjwnsb' WindowName: 'jkuvenlbppmxkjgjlluewzbrb'
- ClassName: 'zfwncozqphizngwkqhslos' WindowName: 'vqopqdjoykumzlttacfshafxydxoyw'
- ClassName: 'raykfqbkwsaehyvzklkskiephbybmmfrulceq' WindowName: 'dhxhbmpduzzmsqbhjsuehgsuw'
- ClassName: 'deznpnbevsvywjshmlaafndxwkzvtaimtpx' WindowName: 'gwcudwitbniiyyctwgmyaikcjwpojqpr'
- ClassName: 'ndszuehtgodcuiztxwppfwfrbdnsxbmiglpqbh' WindowName: 'xxtsvilakzhedgdcndfdbsrvtiiqeoxo'
