Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsc2.tmp\NSISdl.dll
- %TEMP%\nsc2.tmp\Math.dll
- %TEMP%\nsc2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsc2.tmp\NSISdl.dll
- %TEMP%\nsc2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hgoujufdtycedaxnyafhddytjilztpdfgmmjj' WindowName: 'hnuedwglhuycinnbggehuc'
- ClassName: 'sjytrufwzckdvxjofvxiizfslwarzljqsvvfoab' WindowName: 'klakryzezfkpvgdhblpyxfucqzkwyxrkwlwb'
- ClassName: 'dtuxcivmtatqqoh' WindowName: 'tojusuiboweoxjctxqntipfnvfcaimubtjmdsl'
- ClassName: 'ccaeqcklxbtwtnuztfrqubjgdwcwbnunxq' WindowName: 'rxvhbobswrmfocw'
- ClassName: 'rnzhzjogrvtgijtettvft' WindowName: 'pcvhaajnkexknlihx'
- ClassName: 'tdpkruaurjrkfbuqmcuxozvrowk' WindowName: 'wwuthnihnbcyiztqdt'
- ClassName: 'iwzksqmwayoutfygduxewhliifwtsipj' WindowName: 'jylwdebeszvpycjgepkjrasumzlcn'
- ClassName: 'aegxtjqcmqkeutyugyxxrqhkueeuhgnphpvz' WindowName: 'nnnvmgtpgigeyhfapohdvoyvrdbfvmvlsomqflb'
- ClassName: 'nnwppewwmmoeutwzhoup' WindowName: 'gfiuutlcnskwvybvs'
- ClassName: 'khabccvzwavmvlxzrrpgyxnfcyzwnbrl' WindowName: 'afrnnwfpnqimenwsnb'
- ClassName: 'vfinimlvkqzgmjxdny' WindowName: 'hxfbeyhkishwwpjslzdspwitkzglga'
- ClassName: 'bnkmbdmsckcnmxhhxqxh' WindowName: 'pkkuvufenncjiidirwszbifbubacsqhegmi'
- ClassName: 'eycplexkqktngxaqlymquacwhw' WindowName: 'ndtvavaelsyoztdgdnhhooavwe'
- ClassName: 'kyrspysntgxddpthhuqgasvuvq' WindowName: 'qvcokuvrxjuewfwcaucrahpqylyiikn'
- ClassName: 'edzfetrftcfixqpjqtrfql' WindowName: 'gpddaiechewdesdptuiinhnuegotwgwjxwye'
- ClassName: 'nhkiecyljfxnfutgznhzbxjqvgygyoiqfwb' WindowName: 'zzmkpzzhycoovtxzn'
- ClassName: 'zdkkprkpixrwrgwwkqftvvbqswk' WindowName: 'vgkmxgkjnwciydfiyp'
- ClassName: 'leekbhgxdqyvjhksnyxkpdbomxpueclul' WindowName: 'hylbarjxdrthyynqmdyykudvsgeclibqv'
- ClassName: 'sqezejnjlsejyqxzcfwvrl' WindowName: 'qcxrslgrzwakpkigdamesh'
- ClassName: 'omucifuxavdtprwsgeo' WindowName: 'holhqqtxyxtwagdhwreobj'
- ClassName: 'nhvemhlybujwzpkabanzaljvbodem' WindowName: 'fdphcjeurekqiawvdozevxujyx'
- ClassName: 'ohcbtidkrdkjpejbqpyuaqnijqlysy' WindowName: 'bsfprdjutvrlggwvhjpqahbvzsww'
- ClassName: 'ahgwgvapnkfrbpbpxczvxh' WindowName: 'giejxoopqdrdeujrpns'
- ClassName: 'txxiyuoxnpffqdzemkqumwrupjgewyvbko' WindowName: 'wafrgyprkjutgaokailjvyh'
- ClassName: 'yjoyxhhfeqwzofjhpi' WindowName: 'penyalpiphhagemqfb'
- ClassName: 'pbdjfqyusncqavjspp' WindowName: 'xokfigkwxgihmsolnizdubfhg'
- ClassName: 'eralsdukwxkcibdkelhioixxcjq' WindowName: 'nibkkuhbcsrywvmvdyb'
- ClassName: 'otcebbzlopplaadkaslxycaptisdmd' WindowName: 'ozjntleeelsxmvh'
- ClassName: 'pecdrraxeldgatwkxogilzvfqir' WindowName: 'fmoghvahoxreuzjurxhuuddesiehgwrtjwbw'
- ClassName: 'spqxsxwkvlprlcetpmssnywlrsgdmrq' WindowName: 'wenuvfbtwlhihndrzxwquhr'
- ClassName: 'vclrdkqguwlgrxvyqcqkznyryxcjvoq' WindowName: 'aqcjuxukikzwqqcpre'
- ClassName: 'poyakpafpjkirlqkllu' WindowName: 'rowquvwkfwfjtfzwlcsrckanxskvzzlldgujsnr'
- ClassName: 'pdrmcdiaegxhnjocgiklkropijgbdsb' WindowName: 'dwhkvxrpwlgiqaqsfrx'
- ClassName: 'ijmhofukmpfkllnjwrwckzohxrechhklgphbsml' WindowName: 'zsupmkbxwbhrvzzzbzgsnnzicybzudcycyja'
- ClassName: 'khcyjejyxphcbkqkiztjinjeiepcvrvhf' WindowName: 'voiodonkqezhjscvrfddxjledjgqbeosknnldd'
- ClassName: 'soklttsrajcnxhvnafh' WindowName: 'lvubujbzfslbmxoocte'
