Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsd2.tmp\System.dll
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dtatbwzgntcsqxp' WindowName: 'rghwtjnzmadsrrogtlhuqglpsikokbsfuhgim'
- ClassName: 'darpjzcmfdtwksuwixharuhdyq' WindowName: 'izzkmyftwutpdfjnzoknncbxnyfwyxlq'
- ClassName: 'nvgjjxzyinhnuabwzhq' WindowName: 'jydnhsetosswnqtupyqnhaxnlrnvzxvi'
- ClassName: 'znyvcjoodnpculighxkiigvqipbqiwf' WindowName: 'uvycjbzbesixmntydkmh'
- ClassName: 'saxgfycrotgsyeqbdqgxkbbvwqnxkpciw' WindowName: 'qzpxpzvjaxiddbuvasazvnjloc'
- ClassName: 'mwaxbkandyzdtkidcwbbdawmpnjzuxiqpilkqwb' WindowName: 'mfppeuhraazywdnxchprcwpaacyheckgvyomvex'
- ClassName: 'ujzgqufbtcqtipraczxfqexikodhvdfrvzxee' WindowName: 'iwplpfnydeyjkcytuljbmudqh'
- ClassName: 'lrqpeudlsiygaqmflygfpqhskkowpxx' WindowName: 'latwcpstzbwlypjjnqzzrykuskegkllcgnyk'
- ClassName: 'kmjgkaxrrfmmnemcpfd' WindowName: 'icljwrtoscxzbaigpsenbhnsuzg'
- ClassName: 'thfmannpvnpurmixecsq' WindowName: 'tkysazkbjokvnzezrugsmjdv'
- ClassName: 'czintlspecfiyatoacenimcwfrswecylqpn' WindowName: 'oiaeoymgileoccwbupqkopotyuwadtl'
- ClassName: 'jmqdidahxrrirrzbudigcqbghphgwteavfai' WindowName: 'fesdbhhorlkypuwyeuqbxzggttwlusvdu'
- ClassName: 'dmhfvdfwylxxfnwtyqnavipedyautexjbmqnwg' WindowName: 'zmhplswczqhymghgqfqby'
- ClassName: 'naboxtscvtlvxjkvdeegjzbvbldvm' WindowName: 'ytgscbhclhxlqkrpvywiuxzs'
- ClassName: 'chrsovexjqwdiaixrcmuxvxkcbef' WindowName: 'guhvaycgujrtcpbtkfqmexzscbzffj'
- ClassName: 'jyprslxjfytkszpniftsyaecktjhvs' WindowName: 'mxelpgtyinkvwzt'
- ClassName: 'rabccefsbbspjdfgprmvlqjlwtvqixjej' WindowName: 'xqgosvzkavixjokcu'
- ClassName: 'hlgdecmqfrshxzxirwxdehrnsog' WindowName: 'yqnscynfsniewalpytcdvlnnzsaem'
- ClassName: 'wtdnwzamcbxcxhyq' WindowName: 'rhpssvkvzvmgbctpthfvgnnmvtilfmvuofd'
- ClassName: 'qoxeahzcwxcjeuaoihy' WindowName: 'zhnpasbikugojyjjwywufqyodry'
- ClassName: 'qmmmvricnjkzjtxuslzlqtsvzmogvubnsb' WindowName: 'lwscvmrdvwwtmcrmp'
- ClassName: 'rdyjaopiybcpsxjhdvqteskm' WindowName: 'dnwlcjkcyamocvqrfvrsl'
- ClassName: 'bjnmvkjlkfkrwmbvnvb' WindowName: 'wytihvqnnfaxljtgyfilti'
- ClassName: 'oenbasiwjrhjkotliizuhbft' WindowName: 'ybvzdatfrjzklmmb'
- ClassName: 'dxwreuziamaiincrwevml' WindowName: 'epalrvbtqiogous'
- ClassName: 'aumuonblqhyuinapghll' WindowName: 'ubpctotzqryqaadgrtp'
- ClassName: 'spmpvcdwanpjrqbieiiryhesepggalnvbnahsc' WindowName: 'bujslffuppuqxaetvmpihrffqzybchhpunlhrv'
- ClassName: 'qdjszxqvqitrgabpn' WindowName: 'lstfbnexzqlweywcdo'
- ClassName: 'peatkizjbnmwvrdyhribbcrrozvmmyb' WindowName: 'fkwdbfxebnjhmebugppiftkuxjwpkuehirafey'
- ClassName: 'lhdtsqjaurmseporrilccpsejqz' WindowName: 'dnnihyolikmbqqkpi'
- ClassName: 'cterniqbnlnjqaxnvsxcxggj' WindowName: 'zculnmlevqhescoeqsnhymjiuvkpkgxmdxmxwu'
- ClassName: 'kilnchfbttfypudncun' WindowName: 'kjkoecnjuopnoxahlggmmvgiizf'
- ClassName: 'gpovtuymevhnnahznhphiednbknwhvc' WindowName: 'cbuuaolyaykvfhdigzahin'
- ClassName: 'kltcjughhsgaxalcfjtveuwstk' WindowName: 'bvjxtjyjtojvnvmjrrcqcdwkjjcfnwqgjspu'
- ClassName: 'bznqozwnjddlnjyzgxpnxuj' WindowName: 'ahftvfggdgfcfzhjpppsjb'
- ClassName: 'fnjpkiaijgrhcmplgaeogxk' WindowName: 'tyijzheyhkxjnwgaviascynjqfqqqvjxfykbda'
- ClassName: 'wzxicdkmmfllzgfbscutklmzqplr' WindowName: 'tmbxxacqpdevashfnyqcwh'
- ClassName: 'vpocfnonnystiuptsaneatplmmgehe' WindowName: 'iwmlandhmefivyx'
