Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsh2.tmp\InetLoad.dll
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\InetLoad.dll
- %TEMP%\nsh2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'uxxidodhistfaiokplsaccxjzs' WindowName: 'frlxnbpwgjxfkiearabnicpcxn'
- ClassName: 'bwlhknsixfsztfnassfugzvbadcpabzreh' WindowName: 'lpbgbztxofjpypgibnlpszqrvghwchjcmydrkal'
- ClassName: 'zwhszvmgbiyetxlpdykxvgrqwhwitypwzlw' WindowName: 'xhnysvgjyfcxxptumzquyijzfvccjssn'
- ClassName: 'resmhlhmrizruvekeqlqhvzevffyxmodyrlkgcq' WindowName: 'lbtvncslgximudtockuxljx'
- ClassName: 'exawedityupbxsyjkzl' WindowName: 'lxlrfjngxjoczkfgipt'
- ClassName: 'fcoajrqnwxtuapjpb' WindowName: 'caomufubdkhikgcvbsbwkttemocjqgsqxeoku'
- ClassName: 'itrqrgsvttbuigbkntgmkubajmbecvhq' WindowName: 'ugbqgcqdrfgrhinmfbwapwgb'
- ClassName: 'onujyxwsobhizphyfjyivsw' WindowName: 'rptlkxslsyrbsaqelveoezrrrleruh'
- ClassName: 'hxveowkdgvukbcybauoglvtpuzn' WindowName: 'bzxagytkosrcqtasrpkunbimdtfco'
- ClassName: 'dghfdxpldjezdxywfskmzleitgh' WindowName: 'jagkilozchmqppogtcaanrgrw'
- ClassName: 'xaqppnanrandesroc' WindowName: 'vrdrqtwhztfnjzt'
- ClassName: 'eabovmxldxjyeaaslczxmgbazcuva' WindowName: 'nzitvuwcxtihnewcqzwcymxk'
- ClassName: 'afhwgawtlvssrenmxliwwadkhhfxcmpt' WindowName: 'zcwnzodfnbesiwwpysddawvsdntzo'
- ClassName: 'cyjbjrllrlxrxfajavk' WindowName: 'zuymebresxbaejrtjooegz'
- ClassName: 'wupiaonayincfjgubqsyksnuckiinepnawnzpcx' WindowName: 'xhpbsqbokkwjlbmowpayyhneuzzasbhwdgofqv'
- ClassName: 'gnedgqduqdidyrwybcjrwsbkzfxlms' WindowName: 'kxxwsgncjwoiluwiqmakzisbhmwd'
- ClassName: 'uctrcrjowpdpurlcftz' WindowName: 'pdhcnbbsmfjoiszohmwwlyjabyobyc'
- ClassName: 'jdlzrbnjqtvbtxbhbmmkcepqqhllg' WindowName: 'uxheuhbygbbrmyo'
- ClassName: 'cfwnfcllsmfsfuhjssqrln' WindowName: 'gnbecmrvqrfummoxnrrmyrlxdyvxaj'
- ClassName: 'ensuotpgpynfrfgrakfdz' WindowName: 'qnwnziuojwfcssezzmxlsvuievgowqslyce'
- ClassName: 'xeplgcotsazxhwaprguozoazkh' WindowName: 'vpkzyntqhyirzwlljcocirztgyztzwnexgn'
- ClassName: 'kgwrgxeaqcjvtqmhlohyaqyea' WindowName: 'umpttjshvkhbxixi'
- ClassName: 'xovajbpynigfuhrfgszglvgoeejsvk' WindowName: 'hyfrzukxbppmbjsjptpwobsbqnzxcopleou'
- ClassName: 'zvhcgalzkpfslwiolmwzfthaeblknuqdrupjhm' WindowName: 'rgncpmhmlywnvdyvraqsuxtmr'
- ClassName: 'yqchcvzymwluylgmelkhozfdcmuizrk' WindowName: 'qbxxchmvuasuitvtesmppywmljvbpsqvnou'
- ClassName: 'ntlpagwjijxydrhonplusjvotrcsnekbussdk' WindowName: 'lzovldbkcytfmesx'
- ClassName: 'gouiekngfxxzyamzshowjcyomteexjmswiju' WindowName: 'scojhpovsbxlfmytaebbrtlusttpcujvhgkqy'
- ClassName: 'fohdljsxtoarkkzaeeucfhbaooplrxgg' WindowName: 'ncjnehlqsdmjpproshtyolqiagkjflritrxn'
- ClassName: 'sylxmbtzfwvrkayeifvpo' WindowName: 'cltjumcqlyenuquezmyoyh'
- ClassName: 'zxbxzaqszvefbagzorree' WindowName: 'fizjvytshbyddxilquhnnruyamdmsxtgjxhuv'
- ClassName: 'xuimyhfkqdtnzbbxkr' WindowName: 'vldmgbqyyqbecfmriyarpmclpcafndmgjlvyu'
- ClassName: 'mpchuesljayospyenaslxbrbafzcb' WindowName: 'iwmnipmlmzdeefxfbecvtirudhriahtxetvlwbw'
- ClassName: 'fxoqormdslpwizddmvxmfsaftdjvqtqt' WindowName: 'cpkkwbbdsxejvgdijevwz'
- ClassName: 'zchaotzjhwgthxmssztlhfhhiluasfdm' WindowName: 'nqrhcuaqpfbbpoeccxk'
- ClassName: 'myctwcokskqflnqd' WindowName: 'mslabdrkhiqrynmzgug'
- ClassName: 'gqnwtubbqgtxussuvockym' WindowName: 'qfdxdnbptidqskmqbalghnwfiwpsr'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'hpkhtqqycettgfbxsn' WindowName: 'bqepkdfoihornzqznnesimvjymmjrb'
- ClassName: 'jxbilaswpwocjgbucqs' WindowName: 'fnychufwdinptsibpln'
- ClassName: 'nephptpbdflckzcampakqrosajbfh' WindowName: 'ctzhamgcbznouvafdcoytqhypu'
- ClassName: 'qjxatzmgkuvmbzjzrwudgqestvvxhcmsglsp' WindowName: 'yffxnmilwtbqqvqwgdwirnueazvi'
- ClassName: 'fxwjqcbpkgijuoyngpn' WindowName: 'imiooowwsmbnfnxgqrffv'
