Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'vcnhjynjkutdgmjqxizou' WindowName: 'deohfvxtdibijktfeuunstk'
- ClassName: 'etrlustjrmxsfusbdwrtluvtluev' WindowName: 'ypiqfiqnpxiocgeixrgqgftivbs'
- ClassName: 'ptmmyoxcfnjtvwwvxyopaoh' WindowName: 'cxghmipzymskcdcqbzrmouutfhb'
- ClassName: 'nvwyuixfcivqcjcubpbvskdoc' WindowName: 'rbfvhxumohefqhygtdcjydtcpwreujbrtdqlla'
- ClassName: 'lhwviolwyrodlpfzkiujarhcgphpsvqcxft' WindowName: 'findfemxwgvufraebtlndhjxiuy'
- ClassName: 'jrrbqajuwvjculqmiczpccgea' WindowName: 'mevbavchkjnjszmvzjacwbpdivcwvmnksgtpro'
- ClassName: 'xofyzdewrdtsmhimdwfiibawpkkbxxausl' WindowName: 'evkdqaxemsccokpbjvluaregthiauhkjwqmyybw'
- ClassName: 'wtrodqiwaqaxzpjpbg' WindowName: 'ivysiihvwoucdijhkshacnigumyihqmo'
- ClassName: 'lazrhvxklddnsrqmnizgqgdmdvfbuknrwp' WindowName: 'btjriaoiizyjntjytermxp'
- ClassName: 'eqamzmdttrohokradamjefnpnvubjyabmogyimf' WindowName: 'kdsitwirjwnpfchjcxqxkrymkekmbpbn'
- ClassName: 'ctqyfcagegirdgykdylprnvqqwuwzsqtcrjo' WindowName: 'ffzhjcmgyyaqeurkabmqbuudhaqmgldwncr'
- ClassName: 'stwwtvjnmjjjcnnwzqnjxsenukygvzaaxcs' WindowName: 'wgclpqkoqakwyjmcyxpnapgpkfuadghwyi'
- ClassName: 'lhfybhfoxdoytzalqe' WindowName: 'mfjkhahihucdpnsflnddfmcegxqfmy'
- ClassName: 'rtrerbouwbiqtzrhzeycenhazkch' WindowName: 'ztmkehgcgzddjizuixmervqleczntztzhd'
- ClassName: 'xbwjiiumjfavakanfhubgalgdvch' WindowName: 'xgcayusxdygmhzfveinkmwbc'
- ClassName: 'swsqwcurszjhlfzteqcbyznkzfetpx' WindowName: 'jnaiglchjzgmeizww'
- ClassName: 'oudlhbofpkyjiesgigmmsnmhszzthx' WindowName: 'sjruvmakexbayhdb'
- ClassName: 'haqdfxnnlzwkfpoolgrafjeexbpy' WindowName: 'vyxcsuwudluovabjapvol'
- ClassName: 'mfidcwyvgxmkrrkhlbwqciielogobs' WindowName: 'roqkkksdzdplidgumopigwhbvx'
- ClassName: 'gjphaiichokzqpxcpklvamormsdkfo' WindowName: 'dmuauhpygxeplrujus'
- ClassName: 'iuivwvbuhvgluebilwbyfuyn' WindowName: 'hsbhnggkwsjwqsjazujouvrihbsfbonhencs'
- ClassName: 'kyxvrwfdgyftxlrdjkjglpqprlpjjflty' WindowName: 'fxhkwdzkolrnngqvpgdzahhkbazsqdofeg'
- ClassName: 'evtubzcpisqmrldymmkbppb' WindowName: 'abrmcllcxjnhfolatkizayotqf'
- ClassName: 'jmpvdbcretklkeugbnpuwgxq' WindowName: 'ldbeazppnxnopdegyhuwcgnn'
- ClassName: 'jcaiqfmkycfaldl' WindowName: 'grtmitnhehbmemvltiqlqdi'
- ClassName: 'tvgmvdomefnwtrzy' WindowName: 'wmmaoptzphjfbbxalqtbxokgnuoggznehgk'
- ClassName: 'wvawplwqqnmfqsfig' WindowName: 'entkizrfdsammhtbsukgfxyvsps'
- ClassName: 'mrevaujvzosfypz' WindowName: 'uesuunnmifsbptmjrzs'
- ClassName: 'ytymyekuoiamtxrkmlwhcdcchckxgykpatrk' WindowName: 'syvpegkhlqpfysnwpufacajdbmqpxc'
- ClassName: 'gzbudhgdtpgvosamnkxuilgbltxcotiwudhbkwj' WindowName: 'cfjlgiztufgxzirkckbnlrvavfqjrqbwmjqyrqm'
- ClassName: 'dayhfdbgpzckkdzlvkcvbnafmlpx' WindowName: 'vydmmvyeatsanjbwpvotrbhfhjkwgpzkrtcnxz'
- ClassName: 'gxcwvfxdvbdecjrcevfs' WindowName: 'ncuglaczswssrovibchgiubwuliotcboh'
- ClassName: 'zadggsojkpkyiwgun' WindowName: 'zhoyfoyruktqwfcvqjbvtdchhbtgeww'
- ClassName: 'slqwjvwvitmejctnrdveryveknhcpuder' WindowName: 'sfuazyrkavsrrpkqyxvqdcrshkoldyqsptfn'
- ClassName: 'csdjzrcfuuvuachzqczsauj' WindowName: 'vwnufcwydnaxmvkgltbwtpvdwhnlyewuvy'
- ClassName: 'eldfqrbhelpbrvjjqoplzqgdpdwraidaazu' WindowName: 'yqjhgapiwssynebhxjlpeoeaykmlofjbjuzevk'
- ClassName: 'mxvcqzmvwnwfakxkhs' WindowName: 'juubdpcfluzlhnivczr'
- ClassName: 'eirydzlasuzqzztkaars' WindowName: 'fxoqsvcsshsgztoovyxisrflbtnqdfcrgvhmat'
- ClassName: 'ixnfygswcmxvvucxdjbqzrow' WindowName: 'fxrvfjsfilwctltyzq'
- ClassName: 'vjgdywftxylysumuksitsdjbylmaxhnlh' WindowName: 'gghcabhexunonvg'
- ClassName: 'vbuyhivwgsbkemlxatke' WindowName: 'xktyihtowptlugchrhcudnisalerblujhrphn'
