Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsb2.tmp\NSISdl.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\NSISdl.dll
- %TEMP%\nsb2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xkigarzmguxiaeriqjlrqphgkhsdanucioe' WindowName: 'sjumqdnkeppzwqp'
- ClassName: 'foelejyyqustjxjawdfasgowkxwudzcd' WindowName: 'ayojxjgkuzqlqddmdkhrmpqbmoouhzcsfym'
- ClassName: 'zxyziujoulrfrskjqhwdiexatmeobcuyngwupm' WindowName: 'fxbnbilpnktchodrrof'
- ClassName: 'drfougxuynmqyghequ' WindowName: 'pvgdmszlloyxfgmt'
- ClassName: 'kzjyxrlsyfqwrctmggnmos' WindowName: 'aowrbmpxjfmxninjojistezp'
- ClassName: 'pxcjieqgbnpfesdohwgozwysku' WindowName: 'fmbjwrlcmkmygsnwbm'
- ClassName: 'nhlmrxcpjrhxotmppvdar' WindowName: 'gcktqslylzyvwquhqjcrkjqxwk'
- ClassName: 'wwsdonbdylmpmcbl' WindowName: 'jzenqwwcijjvjucqscpnpquzjbtveklblxt'
- ClassName: 'jyefuaqsealcdqeajuq' WindowName: 'xldeesodflbczuygcycrqh'
- ClassName: 'ihgpascnvbglywmagkq' WindowName: 'syilercfejkvpstnidwmskfcdtbwunhagsusoil'
- ClassName: 'fifmjocdtilfbdypjwhjpfyqnsbwhycbrylews' WindowName: 'otrqrugtfgdzcmrolvgdiwjnkmfyrxrihmsrgwh'
- ClassName: 'spvuoezwybbjbhl' WindowName: 'bwwuekjjmoxrmumahharxhwa'
- ClassName: 'srljowlhadbulxabfwyzdz' WindowName: 'unbmnoizkopbtkfixyuqcw'
- ClassName: 'vrjihktyllwqsuzpidxfwnkseamint' WindowName: 'qezygibmffsjiuvxarmmiljjqfsswwphzgop'
- ClassName: 'adjwiyodfdlarhibhmfxqt' WindowName: 'lgqxxghyogakhocmxnsw'
- ClassName: 'rqnrhxvgnlkwbvlsdrvstqbbmqocfbupibcz' WindowName: 'upmdqrkfrbrklmnupbrcmkvtreksenbbbdbgdvq'
- ClassName: 'ddfvpjtpmhhcfryzcqhihc' WindowName: 'yavcvtgtchyvxeipdortvwal'
- ClassName: 'ixazljfswiaithlufjftjloednrpngkrwpv' WindowName: 'terrijeoyfxwsiufnpjolnmgyexjlicxsehqn'
- ClassName: 'qmqawoqgjdielixcakzgyszcozjnxevqpt' WindowName: 'qecnrcuthzpldorbksaryf'
- ClassName: 'xgxlcxavtxqrutxsjgknnuxbndharek' WindowName: 'gtgjfrdgfumrbrmdonnyh'
- ClassName: 'pctvyhksuxmzyyrm' WindowName: 'wvoxwrmldsubmivtijqinpedrwhjkbks'
- ClassName: 'yyofbglcyijlkzisudqyphpspxbqhgfwejwp' WindowName: 'wdxrsgfpvsdxockoarwvizuineahjjdcckqblmu'
- ClassName: 'fvdpjvplqxvymcbohnyovzxbefvfk' WindowName: 'nxpbwrhjgtypahqwzmnbxax'
- ClassName: 'gdermsaucecpqjfjhtldfgcrmwxrakumbdmgtwn' WindowName: 'hwmyxyfsvbbncskmtsaakihtrwwhpr'
- ClassName: 'jubaeyqhhhrshrkyyrblovoaqmfuyohmwmhtqdd' WindowName: 'szmmpzabzntzhmrvwzuudszvd'
- ClassName: 'wcuqbhndfwckaunaezabptdcxylnz' WindowName: 'qjqadkkfnyobucyegs'
- ClassName: 'nyvqeikjdciowkbeknsvgogqacibizigt' WindowName: 'wgvfmfhklxgprqfdhhbln'
- ClassName: 'soonririrwkbxoljmaakqpmnzfwqoqqlnxof' WindowName: 'ffxfrgynghyrwyuaxpgdernsbtznvgcsylus'
- ClassName: 'ilhbedmiknkmpcslphbejvynkdxygflfpu' WindowName: 'spucaewbgdsxbvwkklplowbgqnr'
- ClassName: 'flaydrguwfrtikfbqlipe' WindowName: 'vmduztizvqkwrsllkoex'
- ClassName: 'otiwempkhinjqgraductihkehjqjbvaxf' WindowName: 'efgtrnovydbrtnjkultjlswnkjmfoeza'
- ClassName: 'ijariasmvfbivydakocwzticbdlzoteycoupoh' WindowName: 'vfpampfrputecpibalpzky'
- ClassName: 'ctkbaefsjhuylgmagplprgcpkfgsvtunjz' WindowName: 'zxdibkohoyvenptigweosvqkmxh'
- ClassName: 'ntsovqeqisdnjafdvjmvcwrwe' WindowName: 'ikddterhhgdxxta'
- ClassName: 'apqsljoqqjmttdnhxsdolrgtmrtttwpgr' WindowName: 'pzltmudqazddxixqcvioq'
- ClassName: 'aolidnjsjsdfuqsnxiqwkczvfktkzvcg' WindowName: 'etzjmtfbbyjyrybc'
- ClassName: 'rdgmaqgmxapinhmpkrleibijejmanffiu' WindowName: 'brriqbginifkhdctxtb'
- ClassName: 'odljphemiygovpdzdvgsjleggjolkvr' WindowName: 'jnbkhtxjovnekplnwshhaaoawxanzcvg'
- ClassName: 'bxsrgfcsxbekwnuapqlotbrlxev' WindowName: 'vthallzlxyunjvukvmpvuyx'
- ClassName: 'zihxsfagjvvhyyhqeepzcqtybmnpune' WindowName: 'ulroucneyqrbofomotlpumwplyjknlfkjdyq'
