Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'miluabkcmuosijmjaixwrtdhugp' WindowName: 'hogbjqxireufxmua'
- ClassName: 'bnfstgppjwaqxlsuoklndltsd' WindowName: 'oetlwxnvvlcvcroabjesaovexe'
- ClassName: 'menxrxzifpygvfufisjtevpzjwcvszopufzwf' WindowName: 'jzoguagwtinmqxfgiyhnhwmnygpgvmreahgvai'
- ClassName: 'oicdqctetkijezgbqwhvpbljbg' WindowName: 'dojzndukttqjbjmvh'
- ClassName: 'zhtyqcpegcaevpkzhhf' WindowName: 'fbmllwzfianziqbpreqfmmgtvrvoljowry'
- ClassName: 'auhmjukglsnzkmrhuzaapiqldfxvbq' WindowName: 'gtmdtimfomndxjrefxw'
- ClassName: 'twjjesyzonrcmrquwjechhtidsyq' WindowName: 'tdtwsyribhitoigyuyrvvow'
- ClassName: 'bvryhbfretyejubtyemuzalbxfchqrjkynowwa' WindowName: 'ihddzoyooabvwbgxmhpwuwtdfrpzaqyfqsjfbd'
- ClassName: 'acnmrwwmuizkjnukivnghy' WindowName: 'ombedvkgtsketlglmzuuekxwfntgqrrjiy'
- ClassName: 'izhfisostyrgedygopqujshotflbjfxnmf' WindowName: 'oilcwxioemkbedtomalfpdabnrw'
- ClassName: 'rnpcbskgrjzuuoegzpubbitwjxg' WindowName: 'iryczhucuactcziurchrunukjxxotlyacn'
- ClassName: 'cvecrqfdcmirxlbovfgedeuipugdkgifbbwe' WindowName: 'rayyesydijqtmoidwicrlfalk'
- ClassName: 'fxkxudxuwelteuxlam' WindowName: 'cguhppcvqjmkdwkfvjtghicbubkcgyo'
- ClassName: 'ibvzdywnbeugcbupg' WindowName: 'zktfmnboyaadjllqjqvnghcocsrpypanjlv'
- ClassName: 'sfesxqvgzelcsabtjaejvm' WindowName: 'klunxirhogypefqvpgroidtyhahhaj'
- ClassName: 'kdkdxrobhkzdgfitbp' WindowName: 'ifsjnesmphmwyhyyhevkyytalprmxgxyjneyy'
- ClassName: 'ktaabaeztjymcbbccrololaqmrnhzz' WindowName: 'hmmwbucclyatjzqjxashzmfiokorrmchkc'
- ClassName: 'xooguvkerwlmlroyhulzvbsiyjjookdyvfel' WindowName: 'qukzkayoruulbozjvnthohrmlerxvxjdlxnelt'
- ClassName: 'fbpfvbudbtzuzklon' WindowName: 'cahtdginkeblisoasf'
- ClassName: 'fgxtepwmtmpmqljknpqdjggcwbzwywzqgkpjkwj' WindowName: 'fzkpdxpotnydmbjjqmkpqsbjvinqsldpulr'
- ClassName: 'bcuwxngtyqgymdoxtvwous' WindowName: 'lmesghjnjjrbuqwyxbis'
- ClassName: 'llyusifcwfejmcqprtdvwlrvwujoyufj' WindowName: 'xrijbgamzbaspvlycvsowrbdukuv'
- ClassName: 'ezloqxhkjbhhcfpuevwqcduwrnpeadymmhfl' WindowName: 'cyupptgugmmjjkshckrlasdydyurhnwrdcgi'
- ClassName: 'ytrxxohatdbcbczymerdrzfeuuvnhdkzutislm' WindowName: 'qpluuckgqfsepiwvrnlnaalgladjukeme'
- ClassName: 'irlykoxjuqmrqbkldati' WindowName: 'idygoopndomqdzdjursylv'
- ClassName: 'clpknxshyzhmlihmofe' WindowName: 'xonlxycroxdhabrvmrncfhp'
- ClassName: 'qmfctacisgprsnaxelljbsadeixxm' WindowName: 'xbslgpzvpydugbnwdmfikgpqrfgiw'
- ClassName: 'cwzubeprpghivnyfshdyykrwcikw' WindowName: 'pbvhswkcvwdqxtazdnmmrxpgiqtqjior'
- ClassName: 'mnzptwebijmyrblqehsps' WindowName: 'dnejushuwxzhdsui'
- ClassName: 'lvtwewvmbbrabhnzbbihcifhvulqkx' WindowName: 'zinnahjtouuzkhxbrfcvwwslicjggksmubkh'
- ClassName: 'jcljmjmgromczhakiasdusnfhfprtxtxcfdme' WindowName: 'hdsfpyvgfjizpqtf'
- ClassName: 'nrjnjqorebbgakvcuvuwuwxc' WindowName: 'ejglimfchscidvejvcumtgxakiktcremta'
- ClassName: 'wbsqmnblckyfyefystcdfwy' WindowName: 'qcnqiuyrajdaogeftycasiwsvdtn'
- ClassName: 'pvrdcerzteltinz' WindowName: 'zfcussmuzllpsnrtssatqqqpqolwzjbtcatmis'
- ClassName: 'dunwkibefpwwiwlqynvlbd' WindowName: 'vovsqzcwazseotiqss'
- ClassName: 'ojfqhwtqgdqefuqkrqgyuqawqxhlknsste' WindowName: 'stvlumeaaptjlogkiffbupwgztl'
- ClassName: 'ytwtvojxycsdxtjkvpxbafuzdwyqbjvixonkt' WindowName: 'iqoenbxmqutoemgytfgctsjhsdddgcjx'
- ClassName: 'iexxawszzqljbbrqbuigczccfxdesflcxq' WindowName: 'ogjbjmvlvibdhyynydhjyelrp'
- ClassName: 'cqwlexxddawjomwjkkhxjbwz' WindowName: 'whemidegdtpyimrek'
- ClassName: 'fdzmypojfymqkkslsjlookwxexz' WindowName: 'ychgoeouoniycxkvvdmj'
