Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'wwgjnqozasewzpenmkjdnpdyumyzxgkokzvz' WindowName: 'xhvqaknvicsmprqgagltqzssydoe'
- ClassName: 'hccydbfnndtogpfb' WindowName: 'rovgdkmtiyehewe'
- ClassName: 'ljvmvnkbsrdhhglclencfhfmeslkm' WindowName: 'zipwkndsvmynjorvqdsmusg'
- ClassName: 'dvaqznxaeseojqjdx' WindowName: 'srpihlczcduaxpuw'
- ClassName: 'utnjskzjrnisvxwcgpicqejvlriupdivwbyqj' WindowName: 'rvkagfzhkcorvtamwgmhzgebpwzhitzrdeh'
- ClassName: 'jdexgivziqqqtrtuczxzleczmxztxmmr' WindowName: 'jtewxcotuvcmfigytdpujkzqhjgwfl'
- ClassName: 'tzbycvdcqfbtsghggpz' WindowName: 'laabvykniuwjnhwscnfoocfhl'
- ClassName: 'byofhmesvjeeqgafvglzxbuozeacpxktjbsnrqq' WindowName: 'jwovdyhbkikamdddhlycfwigxrjlqlh'
- ClassName: 'tivfnfhvrcskvrmjatz' WindowName: 'cneymkwafouloivgrsidjaxcg'
- ClassName: 'qukvuypofmxcgmwkamopca' WindowName: 'wuruihtddspbpexvbfjk'
- ClassName: 'ebzadphsroxuzzogzmyrdwcoapngfiueurfhs' WindowName: 'yfmjqbihsrrvpmknltawtptbwffti'
- ClassName: 'sskoqztomnmlacypgninmbsobo' WindowName: 'rpgnqwwxcbuadrpaxdxdbgr'
- ClassName: 'unjfecbnzznplhejfsesgqq' WindowName: 'ikxkpuhxyjfpvuiwesvrmeiwn'
- ClassName: 'cjttpcekbjhlfrgypsqwbwsoy' WindowName: 'lxemxffitapyqwtwresrlfpnesoddll'
- ClassName: 'ltanfbmciivwcbcgebmeasmwtttgmdogsvuddkx' WindowName: 'eohiyxzuwlqxeabuilwbzrhsqj'
- ClassName: 'gscyjgmklkovmcmleanzh' WindowName: 'tyzdpbyvolknlnacgmaqjazxjrzfwtzrbyvwwx'
- ClassName: 'rdghqacwlgmrdeuivq' WindowName: 'gufnvbvxxpihzmavavbnsjqhrpir'
- ClassName: 'dwcbeyokfzoxuqxgssakrrrcbwifcizglbykfbp' WindowName: 'rbhqazdhdgchpwptnlteohrufcxjyhkicrwmbeo'
- ClassName: 'mmdgoxiybmguvcbpyiyhqgcfudrgn' WindowName: 'ukbkgeutdrrqeewserflhlwfkdfnrfsswjpogem'
- ClassName: 'idlrcevllgogexraxeqgha' WindowName: 'mcfblcrwhbrbswzetsgtgcuxqskhfv'
- ClassName: 'yzgevrnserjzhjtkouqp' WindowName: 'zuuwcanudrjgvuotirbdbuxlvu'
- ClassName: 'ioqmmikrjejvmbyhtkzgxvz' WindowName: 'xbivpsnzvjynxfmaddxvfjkiwljwfrlugcftwlw'
- ClassName: 'lvgwmysrgljacynzhjlduvyusgmvqkyfeapb' WindowName: 'pmperuefhhgdvfowbqesfcdyyeowtuy'
- ClassName: 'gazakrgsrfvbfugvyqibeauyhd' WindowName: 'urmaszuhcrlahuhbqrrrglzoyuwajdbu'
- ClassName: 'lihiuvphrwygaohx' WindowName: 'whjnnvvlnnseazjmvfbnyxgkl'
- ClassName: 'cwcivjyxrfindechwlzsvcwlxdlfzvsfzepd' WindowName: 'wsnplmypecunqlucuilzgllrihokjxlrxwqxt'
- ClassName: 'nwyazbwknsipztmkinfeeykxpnsgeqwxlrub' WindowName: 'sxvbvjucmjatgso'
- ClassName: 'bmkxltgijfqthipmvymnlchalxihmg' WindowName: 'oojsqomvthpsdilxigekmchxhuztjk'
- ClassName: 'waquilrpnzbijdwprynvtqbbetvalsuwttx' WindowName: 'zhvyrsbmqhpfacipxdmcwgcb'
- ClassName: 'ocrhqwdowshnyundbotyjaqwx' WindowName: 'oojmujzrudgptjnsogndqxebzs'
- ClassName: 'xmoatqdpulxldyohflubblmanbcccarmqjp' WindowName: 'dxoabkitsfketjwevsotyhpmenjonlgpha'
- ClassName: 'ocfaglzjaizareaqhwepjj' WindowName: 'gyhkolqemsdkqguymtuvnswocikfuv'
- ClassName: 'ypsfdriujdvqnwxkosgsezhlorhr' WindowName: 'otoojlfygkwbfuymxzymfgsamyiqjbqkkvkmeah'
- ClassName: 'epenehswiodbloppis' WindowName: 'pokqorwuviivbsyh'
- ClassName: 'vteauokunfjrrinove' WindowName: 'pmevhnftquekaxtjtllvqwhklucusdlsafi'
- ClassName: 'xbuijgmtnltagdytlgevdfnqpmrma' WindowName: 'mgdaotrzfjnbnqbcjmjqnnrk'
- ClassName: 'oewfiuakftvalbacehyhiihqj' WindowName: 'xfyppkwxofkxuuynzqxftfu'
- ClassName: 'ntkoaknwcnyyvysoajwvsppnyxlzkcwr' WindowName: 'ntjcjnhhyikzkingmdcbjjdwzzxxhrul'
- ClassName: 'xuhvrqbxthllkwynvatk' WindowName: 'jyzokbonlpsqudavcjags'
- ClassName: 'fkbneqblxjutqazrktfudongtisylcbcrp' WindowName: 'tlpjaxdyygeoaogdndvlcgrqvmlhqdgdthv'
