Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'tjilavpiqcjsmkifesgjzzhgotji' WindowName: 'mealddtkqnazcbtodhdtpgukgxifafl'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nss2.tmp\NSISdl.dll
- %TEMP%\nss2.tmp\Math.dll
- %TEMP%\nss2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nss2.tmp\System.dll
- %TEMP%\nss2.tmp\NSISdl.dll
- %TEMP%\nss2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'owhaijhcdsjnbpzgtqdcz' WindowName: 'jqiyeciqrxwivebdu'
- ClassName: 'xedvyezcvbgvwvomaehtkwc' WindowName: 'stglhidvvwtkjpesjk'
- ClassName: 'sluvdvzykzdgrohzmlpvxn' WindowName: 'cvcohfpbepcdxcxnpazvjfzllhorofksvvg'
- ClassName: 'uipahaagnbgvnrovwlabqnczxa' WindowName: 'mxtoquwszinbexokghu'
- ClassName: 'ekydmqosnyquudcuoodb' WindowName: 'fbrvwwnwvvgazmbpqodo'
- ClassName: 'dggkkuwmwxcqfayerwngtqhnj' WindowName: 'zkwlbagcqdaqohxxqknkggichenthcdihouqzq'
- ClassName: 'tcoumlorssfhprahwcmrr' WindowName: 'apsmcozrcncqiawfcghiriijah'
- ClassName: 'kjnvrrjzxceqfhbtcedkemdtwtjaie' WindowName: 'hsgpgxqmkyxzswsmpnouderrq'
- ClassName: 'uokfrevqrszqipeahvaleofoizupkmcgmqdb' WindowName: 'ohsmhwuhbqfdsjghvdnijwadcim'
- ClassName: 'rqmtpbnphuyyogihpoxgihhjl' WindowName: 'avqwnrzfpmjexpgitjvcwzqfy'
- ClassName: 'izjazuwrdcqerbispujqwxumoxucc' WindowName: 'xibqwosmpdwnmjmkjfqxhyie'
- ClassName: 'kujxklagmspsgodtqvvwimsxcgeulqkyflfi' WindowName: 'zzljnnkdyugjelklnmo'
- ClassName: 'iutawtpgjlpfeavaqunxbagyrzvlpuj' WindowName: 'nuwkfbweqhvwwmcsguxpjtopwsyrkv'
- ClassName: 'liyniuelhoadjolloivdpsq' WindowName: 'tjtaxnjsacackksefcquteuhsmvvcgitesl'
- ClassName: 'hsxusnzkgndkqwxwmq' WindowName: 'krjurltipfetjaszqizrlxuhjclw'
- ClassName: 'qokiamvroqfnqspzqpkrupv' WindowName: 'afqjydpgjgalsjqlaftiogqurloiczon'
- ClassName: 'srulrcxuqclggbjnceisgdfxahvjduqsahjxty' WindowName: 'wkmqzkknodtkuhjjwaxqqvflmtopgcrehgez'
- ClassName: 'baqljjutplzznxqtncash' WindowName: 'gmbqnjxyypfnjiszbfbdzhcaprucggqqfbj'
- ClassName: 'pdlajgxibuhjdqlrwtuvkczfteqxsmsxjpxrq' WindowName: 'iycluunypxwjdfswblqybjqwzpqdwdcrxopzhz'
- ClassName: 'jucmafmxqtkxgykht' WindowName: 'ktiacapzpqbjnifr'
- ClassName: 'tljbrmwpxuhsfsqakujvlgqbttltootvhuep' WindowName: 'uovuuparhrqrbgslqzvmcvvbnkh'
- ClassName: 'qnurknnvaxolewrufrjyfvfwqiqfmqyzy' WindowName: 'ehbyvmlrbzxopotv'
- ClassName: 'pajaxipkwbbaibatfexclhnnmzwcvuhbhqfyhwv' WindowName: 'wdldbaemxntpcaecanjgzskzkvuavbenp'
- ClassName: 'zepipqzlfigvkmyula' WindowName: 'wrupknfcqbbukbsjoum'
- ClassName: 'iyhdwcdoaburragtkxmhzinjhqej' WindowName: 'imemixfaiwciwfssyaqj'
- ClassName: 'zmbolomgkhmukmdxgntybrkekqgrffnd' WindowName: 'kztyjxavlbbwrjdeib'
- ClassName: 'mdctkfbdqclhqvbjtgrkxvjpuvzfwblcbqptnxi' WindowName: 'eowthafenxnigocmgfempufjwl'
- ClassName: 'nttkayjehzyjebfkgcu' WindowName: 'quapcqkbbxxjivvezpxfkrtzstdivvvyaz'
- ClassName: 'hqthxmoehkryaiytlzsyvqseunlh' WindowName: 'quzqhqjkrtcewfovvg'
- ClassName: 'pycysuydlruffkscpeatewnybzkaussktujhzxt' WindowName: 'aqbecojngbijtiznakcmwwribfeqgqezlngli'
- ClassName: 'uqfhwaevwkohozobbyc' WindowName: 'gadxohhwrpfzvxeffaamvhgdpbllayd'
- ClassName: 'zumlfahgkxrbyhtr' WindowName: 'cebfnlicsfwrjbhdvxwwjpeht'
- ClassName: 'ymlwgtzpznmfefth' WindowName: 'tjcorjbfypdpvqnuecesqwwmifwotjeza'
- ClassName: 'onqlwglmogghfatiedzuxtzmntxzr' WindowName: 'nzcvtuanycyypdartcz'
- ClassName: 'ubzzrravgsdszivqcvgbiznl' WindowName: 'zxhcathouhkacwstmmsxszgrhs'
- ClassName: 'ewzowqkwerneinlcihrjapit' WindowName: 'zsupnmpgkxztqxzyj'
- ClassName: 'tfuphzotqtuiqrsxaurfrhwbjqzkmxv' WindowName: 'fzppjysattjqnqws'
