Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'opexunsgicdpubb' WindowName: 'mxnalzokgykaakvuztoozcdn'
- ClassName: 'nhangzwweiapadnimdytihguaaeg' WindowName: 'unavbznfrkchpepdisrkblbzaetfivpbweznx'
- ClassName: 'ewxoxybqjztnsrdqjofiahbej' WindowName: 'subddlrhbudytckrgzjsdtubajihrxojf'
- ClassName: 'mvztztgyreqhtkackeuj' WindowName: 'wclgntfbjtddlwtg'
- ClassName: 'ojtcdntcfbczlixrfnpminjjoxguvb' WindowName: 'ixdwracnikzoaafyntfszdetsvdvberaqukhv'
- ClassName: 'sulahgzmzvubmbou' WindowName: 'zckdxfvcmselrdhjyurelcgzjlzdtiqkdzv'
- ClassName: 'rdnwyamesqvxjwgzjptt' WindowName: 'qnagoflgqhmwsenmjffequkafqq'
- ClassName: 'sojdhmycxiedytyxqpvhjxhiayd' WindowName: 'bqsboghoauubjwjpegfxlluwkmdrapbjdzputpl'
- ClassName: 'vfxyetthriipogjhphjgfxkuxjmcafqkslkxskz' WindowName: 'neahsdojkpdqrilx'
- ClassName: 'hvyfycmnjzmgqjmjoz' WindowName: 'vykilrimocuvytthyjtuiaffvkdjxemg'
- ClassName: 'penplucbfahzrtrapuwciczpvtxrisrscos' WindowName: 'pediqfzuhffhvraiatnx'
- ClassName: 'bksqanuxvqpbprasocfdn' WindowName: 'ltulmvlpovkfslfxgbfol'
- ClassName: 'swmvwaylmfpcmhcobmbrsmtyrgu' WindowName: 'nbnznxmyhwftdeirpkhiimuytodjlwww'
- ClassName: 'afhbizzichbunfwgoyovjplvbbyusnepk' WindowName: 'yruwuaaudvljzihekqcufkvmvssybtmg'
- ClassName: 'fkhsxiaecxotqqlwcixltupquftm' WindowName: 'hztmxspmbkjltgxfzbukxmsqvvhn'
- ClassName: 'xfuqxukqfgcxmgdthtdejnhj' WindowName: 'qtnfulccwnbpazvxjqlji'
- ClassName: 'tmysmgyaumtsrigspkhytvetvlvjqysra' WindowName: 'frvporjkslvegznytyy'
- ClassName: 'ewkxuonnkrhdlfacbvola' WindowName: 'swaiawrqjevtjtiolkyia'
- ClassName: 'espfsxkjsfmuhmmkfnhkfcpojmwdi' WindowName: 'kmikrlajwdvbvxfkklpcevdasxzwc'
- ClassName: 'ehlrapaijhitlcbhcwcyajdsjepf' WindowName: 'ctuvxciphawlanbpidzxtgclgcx'
- ClassName: 'usjsvlkltwydvjpz' WindowName: 'wixnktjvynpltfyfbdbpkhdmszomjwhkgtkwn'
- ClassName: 'hpobvopmbvlrwwvqnkfrgoforlmlflcscauphyb' WindowName: 'nlmhosrqyidejddftfidhxniqrndltabgcoe'
- ClassName: 'stffqjqdiciziuh' WindowName: 'lglasgriacwwvnybjebetyp'
- ClassName: 'nsvwfhhtrefnnadbdgefepaxbveeedzajgidirr' WindowName: 'yvldqzmwxivbpfzuhoslfyryaxpjzwvgfbr'
- ClassName: 'dtrfiaqrzeuukdufrhogjgw' WindowName: 'mflginjqeczivclqwlnwycvhtffbtebit'
- ClassName: 'rweyvlzikgeyeyutvqazfk' WindowName: 'dioktvmurpeasnbsbjxakrocexfeibcqbg'
- ClassName: 'hwirlsbyzoguymkwgdszrtntkgudbtp' WindowName: 'sgrvsvbdtvfvddazpthlwfj'
- ClassName: 'ejemgivxhhkimdpgtdcwjcmvptkwetnbpdajfg' WindowName: 'pepvogjuldnzrxsvo'
- ClassName: 'kztjbabedqqxlcpjoxlwql' WindowName: 'mwcgoaspheohprs'
- ClassName: 'khjjdrdcaqirvigegtcebbmylxq' WindowName: 'mabrqaewujwsjjqfqkzunaupudtpffucmjlxqg'
- ClassName: 'wclveraxbgyoxfqyz' WindowName: 'kupsnbmpymiadrcvqqlge'
- ClassName: 'yhzmftafzdshkonprlzmkkigngsenws' WindowName: 'aqoqytlneqkirltukstwuzufusefcpaw'
- ClassName: 'mtjjpxktgwzkcmouf' WindowName: 'opcrbamoxkojikqfkrerr'
- ClassName: 'sbnaqtnlrgfwktwwu' WindowName: 'gcbixwxgrbaagncndvzzcopnlvviqoqfpzqsh'
- ClassName: 'vnormndgkzplisinhs' WindowName: 'zsospazsobqqnneskiufdhkjfkgpcivggf'
- ClassName: 'mfmhcjysysporjnj' WindowName: 'sesrntismbyyzhjkjtvrpcyzslirybmgqvljmx'
- ClassName: 'czjaiawulyhpxjfmxrqtkynhardsdtgmtkdxj' WindowName: 'mmnnhsdiwcfjojqddxqkorquwwht'
- ClassName: 'rzhpnzvhexcrdiexn' WindowName: 'iqvjejwqqcwvpmzl'
- ClassName: 'dywnszslsteoyqnvjbhmjkznwszp' WindowName: 'ngawtlnlcmvqynvnmukonhh'
