Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\Math.dll
- %TEMP%\nsa2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jlxaywcauijrzpgie' WindowName: 'xbbbiakspxoxzmpmjwhepzvlroslewjl'
- ClassName: 'thkelttiozvynfwlhvygdyzanwlrximyerqvfq' WindowName: 'dqsjxxoutmuogvdrloyps'
- ClassName: 'gdnbmivaygdddifkgsrle' WindowName: 'swtmaazekmjeckgftmeky'
- ClassName: 'mmrgeuikpoyvkrjxauoequzqhjauynxrgckwi' WindowName: 'blexiglzntbhaueweuumhyurswroysmaqdrgy'
- ClassName: 'dtfonxlmyqgvkdyfctdipllxkvhodltpypipn' WindowName: 'ebuayxthrqeixuql'
- ClassName: 'mbgslnnzxrulxlryfcnpzulkxvxtibhxthlcvq' WindowName: 'bkzsppcpkpfyluwvprlnjhqzphcfcyft'
- ClassName: 'exnoobgjdvgscdtrnhvcaakt' WindowName: 'uxnidyqsvgtmfiaqiqxf'
- ClassName: 'qoimntzepnbdiwrpcwbfbiropkhzhd' WindowName: 'wmahvfknrscchqmspb'
- ClassName: 'xwxqfaombeiuitcsqrlvjotwkambvuauogfwmtq' WindowName: 'ykbzyynjerlufljzyutycykqj'
- ClassName: 'uhtkhgdcickkkqtwuofrbctamilonzh' WindowName: 'tzhwpeizszewgmwocneeocpmpkuwocsthdxl'
- ClassName: 'asjfeqcmbukogdyhghajgovszkzy' WindowName: 'cprogyktwzajgqaulxpbgnmfh'
- ClassName: 'ddnekvudqjzidyipnitjnndebwkydeddr' WindowName: 'izpmylicmyjmnomysms'
- ClassName: 'lofdpdoorjvopnmcnihrdyhs' WindowName: 'yldavfxstzdhtag'
- ClassName: 'lzftupopqsfcjqpygmc' WindowName: 'ihlfbnkbtdlmdbzlevmpljwjgcmzwax'
- ClassName: 'kdzzdzwartrrlriqixpkksbihwvecqmcnbqji' WindowName: 'gnqxwzuyxvchckmixirkosrbzsyorpuy'
- ClassName: 'vfqlbxkdfmavelerdfehadkqnuop' WindowName: 'exifubwmehqoylgeplmmeiwxir'
- ClassName: 'jpjhlluvslaomsep' WindowName: 'vlsbvjnshydazipos'
- ClassName: 'pljnjbyzvbvhvmnjggrngflrcrcgvvcqeocpysu' WindowName: 'sprgciarjqlfhxwhbjmlqnaanetvklnaoegugb'
- ClassName: 'bvxjldscumglmmwjdijbxs' WindowName: 'vsalekficsfxaxztlyzlljkdwjhijvsvvspyb'
- ClassName: 'xbnxlriqybytfmmzmqwvkpmzpkpdxpcnbsly' WindowName: 'aohinjutdcmqsthjawvagwdw'
- ClassName: 'dnskikqdmdxlvki' WindowName: 'korowttmkbhuizd'
- ClassName: 'bxwloggtpvpvjpttkgwzzqxkswgrqdtlr' WindowName: 'zkbjewgifknyipxhmmpawxwgrgvkveureefts'
- ClassName: 'nddvbsaomgxtmwkfdzkbtscyhl' WindowName: 'hzhijykbwctyvitiqutlmfgdzdxlahjdrf'
- ClassName: 'kzebrauwjgcxhlvfhixtacfvpwwdjzzbzu' WindowName: 'ttxptvramiovqtitltocmig'
- ClassName: 'qcjzqpvisawkjkqqijfngjtdpspya' WindowName: 'zgvzijkjajppbxhbmicnxhlzxkqbtxq'
- ClassName: 'zaruaggdofktggolioexvatqsdpriddiircl' WindowName: 'nefbhdvunwdcuivbjn'
- ClassName: 'yypvllksbwvziibpavwesainjs' WindowName: 'oafwxahdfccasgcslxed'
- ClassName: 'uaahsdofgnhgsetyifcoygtndrgbfiraagqslrb' WindowName: 'bweadwnzngczqcnddajtijq'
- ClassName: 'pwpulpoyaplxfztaznivn' WindowName: 'dmyzxisfgxralgdzfvojdztdhxsydzmcxdlkb'
- ClassName: 'xwytshgagllzrchlmpmklhrvrjwogpoutbiqml' WindowName: 'ekgshojgzgvyhmphivkbcdunytedzu'
- ClassName: 'baltzuqvfppwbeulmuljsatwpjqicgkernq' WindowName: 'fmjsforcbrcqhvhwzxzrcqtbltxpsgjfvklakzm'
- ClassName: 'zbiqyrtvwlbolyffkut' WindowName: 'budivckitaselewavcumcjunbocfljvg'
- ClassName: 'toybszfkfohffaslpvffsmvfhxpfqezt' WindowName: 'hmygrywijsitsylhuxyogrcgddmxsnwe'
- ClassName: 'xeuqpruqdphwvlyjcemipnwoezilgzbwlw' WindowName: 'jioyyacnurdvluzbpzmjwgtemxtfubyebauw'
- ClassName: 'ltunrvvtytqzwzmhwxnqncohxqajvjndfj' WindowName: 'gnutwrnpvuywurmimnhdhgcdibnuzhcvcw'
- ClassName: 'dkobzgkbnmgwnapiuwahbkevmefi' WindowName: 'xwbnlvjwiuktwnzozxlclspm'
- ClassName: 'vlchlwtwmnyhaympfyhkezmhnfndbobcktbai' WindowName: 'ygqmyowvdnntklbwvsiiqjwmkvidopfqpgey'
- ClassName: 'nqcxrctjfevazxvsfa' WindowName: 'awynwxqqoccgxjbo'
- ClassName: 'vmpulfxjqfoodcvatrlba' WindowName: 'xzbcokmwvcwbrdpzgdioqipo'
- ClassName: 'qukxxdhwdgxtzzsgkjdeh' WindowName: 'ystdpjzcfynihcizpxvauycrxb'
- ClassName: 'xlzhndowbcvphmzm' WindowName: 'ymeqpkjjqnlkgtoicymsclgxgkt'
- ClassName: 'gbtqaiihpwckwasmwfqucatwbyjhstvtqbvbe' WindowName: 'etndhedeabgucho'
- ClassName: 'kjutbfycgggevzzeclkzetkwgrrpv' WindowName: 'izaxkodvnnzreiydajqowapngr'
