Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsr2.tmp\NSISdl.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\NSISdl.dll
- %TEMP%\nsr2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bkasuclmcxdhfuijfahc' WindowName: 'sdilugluzymyvpazkqfnhpmjyyals'
- ClassName: 'vooodtjcohyvhevazvgptoticnwkfur' WindowName: 'jxxpqdpoopdqgioo'
- ClassName: 'addfzqjcvkuarqwzxiudzqxyuvhlwpzzr' WindowName: 'kmygniobagkcvcxnkxdmnwhuupbqbxr'
- ClassName: 'gljihtefzhruychk' WindowName: 'sghoujidrtnjmijwmextfkivq'
- ClassName: 'kohmygxweyvnytustuoqxcivfdwi' WindowName: 'ggyvhxvsshjowgcwdzequadqd'
- ClassName: 'ihhlkmhkmeuzdpfskyigaahbazechizq' WindowName: 'hetfyrzuqtlslfqafxatsd'
- ClassName: 'dptojbpthbxawzfeyzcttpgfnhivh' WindowName: 'gotwmwocrgjbkqkmnxgyiwjt'
- ClassName: 'axdjgtsooantdgpkrgdsmvkvtthkpanrtlgaax' WindowName: 'lmrvsemlbcefvgvttjoapsbhhltebeetpif'
- ClassName: 'hbjikgvqdhpxdmsxfykuynfeo' WindowName: 'hbuukatdccybcrgzyojm'
- ClassName: 'vrakrnechrqmdqmmoowwsvkk' WindowName: 'qkudqmqqqnunpmlxmyytotnaqiyjabqws'
- ClassName: 'vwoisuuzmbiylbrassibfreecnvvsg' WindowName: 'drppterfipcwhsneuibrpdmjlwsa'
- ClassName: 'gnvczqxewjstqnydzbn' WindowName: 'zbslvwvlslmcadrmlolaks'
- ClassName: 'ttkzkqzzqooifhzcbyhkuxfqxj' WindowName: 'kxdxuimmsbfgbddcaqccdahxamtg'
- ClassName: 'jtysywvuctsujlotqpsf' WindowName: 'tctqovinbyxzkkdqzbkznexiarafkeggvnzbwow'
- ClassName: 'bphkmynydhseoafphkcomhfvrkysaodwfykwzc' WindowName: 'zhbzxbbrlnwekhaqulbpucb'
- ClassName: 'ovsbhjbpsurmvelt' WindowName: 'sphlongrvcipvfflzftgsxvljzuxalex'
- ClassName: 'udljcbefvsfqsjsajbhjxeczdacsoqxen' WindowName: 'iquozrkbqawnnbsqiparslrbvkiod'
- ClassName: 'mtnkrsvtlpotnewd' WindowName: 'irdsgndgvrkdqkidiz'
- ClassName: 'prjrkyoxcwsudbkixumyqkcvtdhhcxsgrudclrp' WindowName: 'wfnqcsrqivstzuigpazduwzipjsuvqgprcbwio'
- ClassName: 'axvzhjcwarhmqctewdl' WindowName: 'bhptyiajsnynctelasqnjdorymroco'
- ClassName: 'nglozzigiowagwepojtfllylw' WindowName: 'gydxcvovbcelvgrrkrsljqy'
- ClassName: 'ksaygbhtzlzxtcsrlimlszzzvsejo' WindowName: 'ozafdwdmtcrermxrwhu'
- ClassName: 'tysjxwmwriacuypejreimrbvomn' WindowName: 'uzfbqivttetcyfzb'
- ClassName: 'mlvwiwvvjrijeheemdmzliuj' WindowName: 'xjsutwpjwskekuhmfdbjoovoi'
- ClassName: 'gsfbvltmixuwepeebxxmvedqtgshqht' WindowName: 'jimougiprwlasmpmnsghvjoaukjx'
- ClassName: 'ntuljczlwkpirxvegrxubtluujyhsrm' WindowName: 'ozijwxhgcqhrweav'
- ClassName: 'cmmnlosayiqpgjvfebzm' WindowName: 'zcidatktpgoosqotudvhsatpf'
- ClassName: 'ivjargawdsehmuykoriwvdfwosiwrpaplvmtiyp' WindowName: 'aszhjeeixzydjdpzspodqtkaptgkei'
- ClassName: 'iedeypfakamnksfplchzdrvsgr' WindowName: 'qwemdxydbdwpfnomchdikfqlizdml'
- ClassName: 'ryqgmrlowmnnynnuc' WindowName: 'wdapqxcahttchwlwpyqz'
- ClassName: 'qbqxegedvdeygvnxzyqhnmcrbmnwrt' WindowName: 'ompghalprhgrxbnweisa'
- ClassName: 'qowatguzibowfnz' WindowName: 'hircbxjbtrliuhbwc'
- ClassName: 'tlcwhssctmmdhetfepegisplbjlphlkdisetqyy' WindowName: 'qkauegexjacipvfbnlwwwpuhezjyrds'
- ClassName: 'dpixvsmbulczlfjqddf' WindowName: 'zjtakutjlkvgqhqgtcolgnsmxomrvnb'
- ClassName: 'xbsywpepqbuqqoshdxnujilt' WindowName: 'uxfzfqfurrshpdfjlllwboedinoci'
- ClassName: 'bgdnxikxxhoecbvogyaizkrfqwlpngffrmjsngm' WindowName: 'xrulntaflowzywjqvhhcnonacc'
- ClassName: 'ebmvyzievejcoiqmcuhikygmgrmolhiztqa' WindowName: 'mhklwdbyevphqwt'
- ClassName: 'taldrkpuwemuxmzjpqhnbhqqkpcqwgywapy' WindowName: 'ozzrudboviuywlxpqiafdcvnuabpvsweltegi'
- ClassName: 'tjqvpngvemqvyazmqjwaeigfceyy' WindowName: 'jplyxzeawvhoopnsvzbubjis'
- ClassName: 'xjsytcagcfdryezyhlxikhnggduoe' WindowName: 'exkepqenvrmjyfxjlkpqdwifmcoksf'
- ClassName: 'kamwjstwbzhrtanjfjtohlgayatjsjcrsqxszn' WindowName: 'cprmydofgjzvsqallhrvfqwziyzauc'
- ClassName: 'xgrbwemjzehvwgmgrula' WindowName: 'zderymjkobwltsplba'
