Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'goufboqkkmavpbbv' WindowName: 'wqmbxmnzqhoczfg'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsf2.tmp\NSISdl.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\NSISdl.dll
- %TEMP%\nsf2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kaxfmxkjlnhxvziqeggfdqrebzsse' WindowName: 'yiwoapyybwfckmetohzziugmgaslp'
- ClassName: 'mrvbobpbnaldmetdeagslwl' WindowName: 'lybumlblnglbvfv'
- ClassName: 'rgtmfkyaownxszdggyzgavxtohhwgb' WindowName: 'aoomrloxconjozacrzjniyudbg'
- ClassName: 'awgrwrabgwccsqgfwqhqyfbvemu' WindowName: 'ytfbkkddeowapejchblkzkzucwsil'
- ClassName: 'asyxdbgectaptynsgabqvixdskehug' WindowName: 'hoiwfkqxlbjcsfx'
- ClassName: 'ihyryjjlfnfgjwhfw' WindowName: 'mnbvgqhelqqrseypkhsqfqxym'
- ClassName: 'zeuezjnyterwieoye' WindowName: 'wbgstqjnkzsmlbmobcinioduzmwljtvyhav'
- ClassName: 'lnkurfwkfygwamtlg' WindowName: 'wkchwhwsbwwzlhgext'
- ClassName: 'vbzdqdjpvyljjxplswihgystjzyxghj' WindowName: 'vblhyqzxmwdjykcsixwsmmzs'
- ClassName: 'sknzmyzghfjhyidmjkqqymjly' WindowName: 'wkbcrgftwdxzcmj'
- ClassName: 'hathrakxgmwynvflitextxotuxlhfwkosrb' WindowName: 'cxuroftulrcycbamu'
- ClassName: 'jzbmlbweyuvmdgiugnfvtifwfrlbjoqofuts' WindowName: 'iivprdrupoepzsuzdplashjpnpsxugavgk'
- ClassName: 'nwliybiwyazkelcolshz' WindowName: 'ydzxcucxzitebaj'
- ClassName: 'eieoerbcciouvjj' WindowName: 'bchuuryrhqzhzrfsmo'
- ClassName: 'gbqwnedrvlklrcqtyuphrnrjrdxvnnlmrze' WindowName: 'qepaostnysognve'
- ClassName: 'sdwgjqghgqkyhlqjbqhqiplqw' WindowName: 'ejpchyscoidzmxlqxcvclxrskwqcmbwerthft'
- ClassName: 'ejmhyvhllaoafrjrlmhinuwcnjmfimt' WindowName: 'ptrtdidcwifpqnncucvvvdgqybv'
- ClassName: 'zutopllflhfpxeh' WindowName: 'xvsxyfudxzhclxfmnqmcfihgidpakte'
- ClassName: 'wglpavebcbmujxchfiqahw' WindowName: 'dlxqjkjguqilcvrrzykoefhoejxmrkhn'
- ClassName: 'tnofperxuqeyzdcdjvoauoucuro' WindowName: 'bfxlovnjvncgqaox'
- ClassName: 'iwqxpljtkqkydocfhnddashpexkbuipo' WindowName: 'cvkwxczssyxsawajphgrxatxqpu'
- ClassName: 'sipxctyiqhcwjohciuuefhthllsixtran' WindowName: 'gcmfwycermhcbfhqypftnlgvvtyeeq'
- ClassName: 'fycqgjyguufyxjjlyxkbarkog' WindowName: 'lcfluwtdsnxdecgshlpnaveyc<Служебное имя>ftithcg'
- ClassName: 'gjhurxvdyxpqkijgrvlkapxwkysasmzh' WindowName: 'umoedsskscricvnwerkhztsmfvndnafqrxrifz'
- ClassName: 'grikoeeyoojrxadihxxfsys' WindowName: 'gptyssgvclyhudcynpguatydtaaomikbxlwpk'
- ClassName: 'difiezvwyyigpriuebew' WindowName: 'jvpomymypzbbljqjp'
- ClassName: 'upkbkqxgxiflvjyfwijrsko' WindowName: 'qzozrtxdlvhllhi'
- ClassName: 'tcuarhyxlmqbqdxqudtfdbvmjimjxtj' WindowName: 'njfuehlizyicpjvovvhaqgcns'
- ClassName: 'qkolinnmmnhjwds' WindowName: 'wknidujcriqvqrelfkjw'
- ClassName: 'dqpusmbrntollptobznjijlwrhe' WindowName: 'mtnrpwqnrdtxoeiqdfzwtdreify'
- ClassName: 'mdezpebyvvhsjptpkh' WindowName: 'mhudcupbcdblghciqikhiuhhdzam'
- ClassName: 'icvfwwdxhwfhlgrwyxieuhgjmsfcczlc' WindowName: 'niecgvqhpaanvjaxddwllhghesvujojtfquac'
- ClassName: 'qbjszjtrlpuahdyydbtoceybwaamikqxaar' WindowName: 'zkukicmzdmejumwqgckbibxkxiamlf'
- ClassName: 'lktmatxvhukdvkgysgsnfhtwlmfdqmwqxjqx' WindowName: 'rjhhduncjejxbymehxzhetbpftdqt'
- ClassName: 'yqmxwdpnlkfbpdrvfsrtlcegxbwclnancmsepf' WindowName: 'hnejcvajwvpfslkotwqk'
- ClassName: 'xhaslzvvoffcgvziaqxxgmiakdgmgilays' WindowName: 'rbvlwtsarwalbnbljeexlwdonrkr'
- ClassName: 'chmzgrwktsbegdcxfefrtpmdwg' WindowName: 'tvkwukqhmudifuwy'
- ClassName: 'sdxseepsdsqhfdhdfmkpjktcztlssfithcg' WindowName: 'najxfbacmmbllljkajyevwzihbvzxklxwihjn'
