Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsi2.tmp\NSISdl.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\NSISdl.dll
- %TEMP%\nsi2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dhjcqvmnerbxdpiqfam' WindowName: 'etntngvwjxbagxmpt'
- ClassName: 'gweapxvomcmanphqergbixrzz' WindowName: 'xxzmpmriweirnrljausiubpmbg'
- ClassName: 'lfhfdkkcyakkqfxxxndccxwzslrny' WindowName: 'dawsqduhsrhewavhrj'
- ClassName: 'qcdaafgvqvfwtdnoqfvthwwvrzzvbcvgyneu' WindowName: 'qqlfcbmuiazdxkqajnifnowkmuesaumbolljpok'
- ClassName: 'uihwbtghnknpqjovfwrdwg' WindowName: 'mcknqvimjqzbylqjbfqxhzrziest'
- ClassName: 'lxsmecvdillsmcojuk' WindowName: 'ierdhgatpvdmegtrmbgxhvbfkwexnmbrcpkvh'
- ClassName: 'dpzcfoexjyscspreyejmm' WindowName: 'zpsklttoztjnqeoeathptdqtjqglzq'
- ClassName: 'eytppgpsxzagpthw' WindowName: 'jlwxnxawzkuninacvr'
- ClassName: 'bnhkbpvqgjbeopqlbzdfprgji' WindowName: 'oureyaoyuritdzjbwhkmlyryiyzazn'
- ClassName: 'sccfntxhnzsrstyxvmpkevjjked' WindowName: 'efobgpgrckwoorhxkjkkhpgmqyzd'
- ClassName: 'pewggvondjcrrdhscsgojlafrlrjzfgdtpv' WindowName: 'uzoyvoxjgiegimfuvnh'
- ClassName: 'ptzbfidbunbfplzzjmph' WindowName: 'rlaorteuaelpuckggsis'
- ClassName: 'jxfebsqpidpjisvkhxvgmpksbf' WindowName: 'nqfnwdjohbhxgjehphbubics'
- ClassName: 'vkdqvckydbxafexmbiqzjmryahrjeof' WindowName: 'xqxybdfabmiygmishhnbpfeczm'
- ClassName: 'opvgaubxprtybvnglry' WindowName: 'zytllajtqwhuwjtpgntbkyxlkzkofdn'
- ClassName: 'kxsqalqeqafvnglwepy' WindowName: 'vwoptmdbqvjxxnscqjcunebeojkbz'
- ClassName: 'nqnstmjymxjvhbunzzhrqksgmowivpmmss' WindowName: 'maftidkmehrxtodjysfnukjw'
- ClassName: 'lbprirxaqeormbsc' WindowName: 'mrhbpanvuvtirorhwubiswyiwxeaikaxttl'
- ClassName: 'omwiaitmoeqdzuirowcog' WindowName: 'dxrwsibjerizikme'
- ClassName: 'wzzhwuprdsdakgnufmluprsesjbfjg' WindowName: 'yrbkvqexqelajynatsjzxrpzaoebckxleqo'
- ClassName: 'ttfznusecclmityufx' WindowName: 'ataastxkmcyhbpefclywajaylwztrqsmvrsihdo'
- ClassName: 'foklqnpfsgolpzjipmdeaoynnp' WindowName: 'qfgjkbvluwuztimvarriiehxt'
- ClassName: 'vvdshofrclyuawans' WindowName: 'ftukmklqytzrvalfdjbzplmejrbpwc'
- ClassName: 'fyvsbgvoruwasphlehzyxhykmahppcgpiur' WindowName: 'dftsxlqvvwpewygdsgaddtjcwtyexhs'
- ClassName: 'ltwtbfnyrkjxbgteoalwrbu' WindowName: 'jiixqxybchyvjbnrpetsmsmurshoxbnmb'
- ClassName: 'wywdzxqbusojqhpeidbxximjpv' WindowName: 'umollaaebrlfhnvlgluzxftmf'
- ClassName: 'dxgnonsibqyqjxqcuu' WindowName: 'ffszpwtibmmprtxhzbhbnyspddxr'
- ClassName: 'awlbxqsypxyuyohmisvtvmjsfu' WindowName: 'ctdhqgouvlgrkfxngsqnyfeyzpjaby'
- ClassName: 'mvwrlyqrkxcoenwaicqrdzupmmgt' WindowName: 'igxcaiflticldboeouyb'
- ClassName: 'bqrtsfdsfbyjzqmfcvmvspnyfofjxg' WindowName: 'ngilfgwzaueakopblgplqyrrkfdndm'
- ClassName: 'fkuhfwexhfsoujbdgzatmwbpcsfynkp' WindowName: 'eiplgblysnyjvnjevjrxnpbhnjzgszl'
- ClassName: 'twxypufzfxfycquhmgzumfz' WindowName: 'dfqqkcsbimftmufnfxlkgsphkhjqh'
- ClassName: 'yphtjiaibbgnzbzbs' WindowName: 'clvmvnfhajvtgnxvpmweivdjjcmaaqhvr'
- ClassName: 'ldqylhpkvfidhhlasosybffflmokkxoo' WindowName: 'eobgxuzkcrlqpruehksvu'
- ClassName: 'qtcexmdrqekunlipddfqscmzteyd' WindowName: 'rpoddkliahlkigwxqisahmvs'
- ClassName: 'vlrtplmvkdyzoxhnqmqvqls' WindowName: 'swuozsbukhiyrvmiapkmajwbiwmcgzaxpzxtugt'
- ClassName: 'pkaiazyuamqpzqyksnoenevmjfskp' WindowName: 'febguhqfwocvrsoyufdpymdyuvxgtuoxcb'
- ClassName: 'hcqnrxnkfyzcudaodpwhsiqatvnypsukxkpssy' WindowName: 'gbqcgqvhzfpkpfkjyyuufhtkmznzpnlcbvtk'
- ClassName: 'hlthgvjkojbaiyevz' WindowName: 'xoevqcnlsrupjzsi'
- ClassName: 'cnfvddqgyrjveaioolayhegbdczvcw' WindowName: 'mydybqrfpnewopsmdnksrxptwokjrrcvoq'
- ClassName: 'kosdooeyixuyofzowhxzxnbjgnzqrauvzwcqfz' WindowName: 'bdwxjdevcwpqlmwroh'
- ClassName: 'teszqdmlyetjztimphtevbcxm' WindowName: 'jkrgvhppaurqtukodjzcswc'
