Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsf2.tmp\InetLoad.dll
- %TEMP%\nsf2.tmp\NSISdl.dll
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsf2.tmp\NSISdl.dll
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\InetLoad.dll
- %TEMP%\nsf2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'avkkmlfikoeccclfovpygtuwpdoqdgptgfsqo' WindowName: 'mthfthusbejydeh'
- ClassName: 'sexdieezxrymhbgnrpatcz' WindowName: 'hqpkfhersyebrxesvediuetlbltoohopqi'
- ClassName: 'bjktemkbigqcdxrhqettpzzstmqtlf' WindowName: 'ztjuybibztcclagks'
- ClassName: 'xkzcauywwybytlm' WindowName: 'xwuqyplkebbihjoxdmjaybngsxljm'
- ClassName: 'jqcjjqrrufmaqiiayv' WindowName: 'vpkldsanshzufbpxopzljl'
- ClassName: 'lslguuwfzvjzvbu' WindowName: 'ckutaafjerbqwqseqggnoezaglcqzzjxfcp'
- ClassName: 'fgiwtclmaxiyyplcxtcdlmycg' WindowName: 'rfeswtwdrbzezskk'
- ClassName: 'epwrqvlmayutzumexuebleuxqi' WindowName: 'pujntuokfbfplhqocpaveklcyayyrvynstfmamb'
- ClassName: 'tsypigqyrdmthouhfcgjtjujanqrqqvarvpnwlo' WindowName: 'krjpyijxvxsxjsehwat'
- ClassName: 'vsxptzkmwvesixzcckfhpdtsgvhrdptfbkrfklo' WindowName: 'wsbemoelmctrrwdlkysruxwjokgcogkdwstc'
- ClassName: 'rtnmmyjlusizkrzwuvfqcnknjthnt' WindowName: 'gwxdelcpdwreqjs'
- ClassName: 'nsyurwamebafcstxetufmvcq' WindowName: 'sekmacywueedpbvect'
- ClassName: 'yyynovlgiqbzdxepukrumlnubtftoztd' WindowName: 'eqmwjpqcxenhhniacqev'
- ClassName: 'jhskclwbniteuntaegveywyokarpkmixrvgbwm' WindowName: 'irvxkjqmuulaqxapqoh'
- ClassName: 'iwccfgxbpznyuvcdstndefxolfzaamu' WindowName: 'fhrhfdrdplggqarcnhncethkxx'
- ClassName: 'zklwugtblnepkmeuhwymtuoqlzukeh' WindowName: 'tpdqaufblibefpsxunbehag'
- ClassName: 'cytfzeamdcflimucpjlvzrztpqecjjdlebrwn' WindowName: 'omehlvwqnzoltwinmjrltqsytxifq'
- ClassName: 'xzpqglyfqyafynffnkhskketqrksq' WindowName: 'ohdttdjnvtnpzwlim'
- ClassName: 'heszgvjbugexkooiqjcghzek' WindowName: 'ifjqpkpmvajkhxkakazbmuswjmzxznkvjr'
- ClassName: 'baeeffvrwvfucnaivvukbspoylidt' WindowName: 'mbweuyacnldueyzp'
- ClassName: 'cfwigyvmzovqribcpq' WindowName: 'ohxuyjpbmxhiuymsocx'
- ClassName: 'vffgnknppimyhcerogtwhtxjj' WindowName: 'snjrftnvwaxevhcxgat'
- ClassName: 'gnvarrrnjatrjggzxmovpjdjislkpjxqyik' WindowName: 'fdsytdqqhevwxpsarsdnxpvitdxlxqjq'
- ClassName: 'znarhmdkillnsvoqawzjrbla' WindowName: 'soqfslguebibdohjbepbhgebxiso'
- ClassName: 'mqhfdbfzulqciwubvctrkw' WindowName: 'cmoybnblfpvqyhmjps'
- ClassName: 'ppjixlwxusitgvxzmqphfbpjjhrfyqo' WindowName: 'nwxbbmkejdwztsog'
- ClassName: 'fzexrrormlihsolciuohjsnwioiravhrbearwv' WindowName: 'lfrmwsxnezroergtbhsyilzaokrtrtmcgexke'
- ClassName: 'hiicicuvvzoafzpoozygxfhmapjhzxlme' WindowName: 'csdhpcdfbzprcyqabdbnhlimziia'
- ClassName: 'fklnyoynjrdjttnqitafcueminerzzsyk' WindowName: 'zffxnwgcxlsionllavjsft'
- ClassName: 'fvfetumgfregzvyvgdaojqxi' WindowName: 'sbnssqrzfdffvpjxhwjhhfbmo'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'pxaysydfcalhxkemtzmo' WindowName: 'bqkaijjsltvjykomtpygdhlpdv'
- ClassName: 'qccsxtkqzapvqopaotrvuhbtcajjfybkyes' WindowName: 'mgabtfogrezsbhbru'
- ClassName: 'eaatoehpbexajhkz' WindowName: 'ppcxzanhwezkacrznsbyqsipyggaxvvouwuv'
- ClassName: 'zenwjregxcdyzqrofqnjzevdqiykyikmvoxose' WindowName: 'skvszfwuqjelwykd'
- ClassName: 'swjwfawxjtszlqhfst' WindowName: 'bqwzuhebkhwlafzpyox'
- ClassName: 'yuwuyxaaqwndypctmntvlsgifylyzeq' WindowName: 'bxpapywtdiynecgykyzjui'
- ClassName: 'qvtupenxtrxqdzfdp' WindowName: 'xgvgoyzaxqslrnwvbyyxingzkhqvmfflrul'
