Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsd2.tmp\System.dll
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jctlmcceaouafmqdzrbvaqfquexvwpuxppgdh' WindowName: 'gppxkupeaouhxuznxprjuizoz'
- ClassName: 'devufmcrevjqxpvskizzojjwjifichpsbzd' WindowName: 'nbdnxoundfsknraigpve'
- ClassName: 'bzznavflvqjlehz' WindowName: 'pgbsqwzhkxffkbhxiwmqfdsvowbfepobjnsc'
- ClassName: 'zmjldhtqfitntpb' WindowName: 'tfsptsytjvisucnlv'
- ClassName: 'ewwgjsdlgqnlhhullwrtwdr' WindowName: 'rlhkoevrmjcxqpezffxyxoghvprzunmdsvq'
- ClassName: 'hcusaseqeuvihdthmtifpskcnie' WindowName: 'yligkmpwrnzhxiebgzhyckejnqqezje'
- ClassName: 'hanrgaxchlfnabsjqgot' WindowName: 'vjkenwiqtfgdhcajlpvwyhxmumylzvpqbwovp'
- ClassName: 'pcmniikbpxojnrpahuq' WindowName: 'jcurfgjoozzijxsbcyeggklegxnnndcuqy'
- ClassName: 'dlvtnwdmaveoyykaatqftwupsj' WindowName: 'oycholumfrwsbvllz'
- ClassName: 'vjvyrowfyygrmhieeipngbwxwqyjzs' WindowName: 'gbmehmbrlvoeacl'
- ClassName: 'miljkyqlpjzbpogwwjondmoebs' WindowName: 'ypgizwmohuwzdtqepbezjvuntjexc'
- ClassName: 'xitndavxytbvhjvtgrnzayaput' WindowName: 'kfnfuxbdsmqhyippjdfpmgm'
- ClassName: 'wndlupapldlfxsnacyxs' WindowName: 'mkbcseklobztleeapbxvyu'
- ClassName: 'exwwucbfyzjwezsfoixarzmcjs' WindowName: 'eksfhrjwcnjkbavutirdpuritdsdmovhknqxi'
- ClassName: 'leqmnkuavbotucoozkb' WindowName: 'tlhoxjkppxqrdrrbyqtie'
- ClassName: 'syahumryqnalhrmcvjuvyeoadlarimlciemfv' WindowName: 'jycihmblquvjhoowlhkiwkzoh'
- ClassName: 'juvqvnzuugscmogifmdfl' WindowName: 'ivlicazsffmfbzylucekvdbkucilfaxulzndg'
- ClassName: 'yhltzjhyddonyrwxvvk' WindowName: 'chugsturxgbvqcc'
- ClassName: 'wvscjcmypehlyhcqipzkarezuxtmjzqmn' WindowName: 'vjyljsbvddpthscbqldpudnmer'
- ClassName: 'xmolkbgubwzcjozm' WindowName: 'pwlywslvrbapaczypxhrgflklxo'
- ClassName: 'lzspkyhsimvkjfzrjqxy' WindowName: 'fcvyorvsglffevckovdsytvomnwbdxr'
- ClassName: 'bmijprqyciocrns' WindowName: 'amgmtukkafazrzlhsghvqerzzleoipe'
- ClassName: 'jrdnidxukmolrabzawljsptjpdeflor' WindowName: 'prnludrdhhjqyepxxod'
- ClassName: 'yddfxrtewiikdxwrcvwxebwssmjxuw' WindowName: 'ndsismwquoxqcueavpip'
- ClassName: 'csjelmehhnhnfkwysal' WindowName: 'sxrdsyheaqjfvqhefghyjqzlscvciciegrsuos'
- ClassName: 'lxgbbwrhykansgtdvvlpupybnbcreohjwipvy' WindowName: 'ocmvqgnodeknrgvoaofyvp'
- ClassName: 'gufuhfrkbuepzwiz' WindowName: 'hjegkgffjnlwgch'
- ClassName: 'iwoikjhejdhodlscitlndofvugvtlwwslsjtqa' WindowName: 'dmvfafecvyzqyaovgocgpwzutuc'
- ClassName: 'iurqnjimlbwzkmcfbhx' WindowName: 'yntguwgcwliwmjoywckligymydc'
- ClassName: 'difedlbhfgvxqvzupudzexk' WindowName: 'qiutaruxwkabrrfvkgmdfnvibsygahsynvtk'
- ClassName: 'ndwdzrxfrvioscsvblsvwixqlra' WindowName: 'ispqmjeccsiigvuassimaopv'
- ClassName: 'wqhocbbiuabmxeoikuvff' WindowName: 'nwghhormgxakufsipyvfsyskutrqwceimughg'
- ClassName: 'vktpyuamvpervxnavaxmzcgu' WindowName: 'ibsbufmdncasgvbpkwz'
- ClassName: 'cfcesurfejzkkwlbdjwjlduhudczoxl' WindowName: 'cjdsebeezccwdfk'
- ClassName: 'iuxljucznnvtgviucspiakyfznmpuz' WindowName: 'eoisnkqallwyamjzyhhn'
- ClassName: 'tnxyillqrxvyppxel' WindowName: 'anpqswxnajkpcatohphmodsjhgcbybwymxmhhq'
- ClassName: 'rmmciobgeokuuneibffaghlokgbvsibur' WindowName: 'tqsrzdkqbkdsfqivriqornt'
- ClassName: 'ztknoibzrkpwlykpdqcoyfgrtnnktrsiigik' WindowName: 'sjmmmgrafxjgwoaoso'
- ClassName: 'nhbcrmxghclwdsm' WindowName: 'evqztwsekpotsgbpbuzgoqwegxmuoql'
- ClassName: 'nijhsvzrokapiigpxhdfrzosxevcugesz' WindowName: 'frcepuaglctgnmqdirexcmnvqqcbbxyqwol'
