Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsq2.tmp\NSISdl.dll
- %TEMP%\nsq2.tmp\Math.dll
- %TEMP%\nsq2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\nsq2.tmp\NSISdl.dll
- %TEMP%\nsq2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'slaoijbwonebxvprdwgswjtcwuelnmgsnexd' WindowName: 'znhlzfloiboydbihrhjvtlqspyttpyg'
- ClassName: 'ikfwntcrhisqykekaknptlx' WindowName: 'vwhdcjvruvveyogmtlsxwogtkqfzwliotwfto'
- ClassName: 'gobcqdsfmsxqlpyf' WindowName: 'ovbvntmxfbqmjlxtvi'
- ClassName: 'bxhjztimetzgmyuhtudjfxkgzqqbslekwdsgsi' WindowName: 'beilzmydotecxdilwmccpdbgbodfqvxl'
- ClassName: 'kkrpadcgyviwymbfnyolzmorxuwxbjlwr' WindowName: 'lreaglkztjxcenjy'
- ClassName: 'gxuzqqhltvbwynbhqiym' WindowName: 'nxjwvmmwolpwhyqkxywzb'
- ClassName: 'nclufbshhorulyabxjaddfemqjhcnrvkiaec' WindowName: 'cmwibnzomagagzkbj'
- ClassName: 'ojlzqzahzbrpjiaeqkivzv' WindowName: 'rtetrashnqdmosxnpgppyxoswxwpfehvgdfxu'
- ClassName: 'bxancqdhycpvjnpqzpfdhhgnvgfbmwa' WindowName: 'rowmeuqktakmjebvmtfdbsrsoym'
- ClassName: 'tvdbpzmhgztbrrlomsxfixzjfculq' WindowName: 'sxjfcmuxwgttgadsck'
- ClassName: 'buktpthpmwfthljbkgsr' WindowName: 'guzanmuobykqdgenvdyzbdwekmbyhdwlo'
- ClassName: 'ymizdznzysvkmrqqlpaoktmtafleovq' WindowName: 'bsisgywwfsnteepozxpefsmtdcpdjh'
- ClassName: 'rxxohxkmonksznsjuvidbxcgnzxwxcwcjf' WindowName: 'zcrathtzwtfipshiegqbzspjxwhfmesur'
- ClassName: 'kzygitquqmwkmnixpwuaprtzmanijds' WindowName: 'bsewcfcuhhhaylvllyqgmdflrydevsdigrzohu'
- ClassName: 'xsehyiydupajkoyddwfsnxwwubppf' WindowName: 'mriyzlkksacniac'
- ClassName: 'poczadjdlynecosoxndoijvn' WindowName: 'dtgswptsavdociyhjwpgcwh'
- ClassName: 'xurgpokgwhkmcplygwzfbnsesojgxxczvvrjur' WindowName: 'jdpjeffhiwgnglch'
- ClassName: 'ybhjzzuerrsmxptk' WindowName: 'klcuymznmleiokzxlyvzricjdocpihjfpnmv'
- ClassName: 'frnkmcfribaztottufskuwbitnmminh' WindowName: 'sbdpgowaujamueyqiqatgh'
- ClassName: 'zovnkotcrhvtaqjmgmknv' WindowName: 'iahbbmziqhpzrmgtlchjolhitbrbo'
- ClassName: 'lxyhxhmxglvrzdpfffgw' WindowName: 'bbcwcktrlwxdibd'
- ClassName: 'qubbgbqbgthsbflmkoplgoljbywquefvjc' WindowName: 'qapjqyozrhnudiujfy'
- ClassName: 'pcxsoecdxcsemfjbc' WindowName: 'rkdbzlusiiaalxaxwstugvcf'
- ClassName: 'rhrtdazssnbhxvqjmdugstoknz' WindowName: 'xeswdcyaicdqyjvntrfakdaxtipi'
- ClassName: 'uvfafbjikaanjzlhder' WindowName: 'rtjslhbijprhriifmegaoswrnd'
- ClassName: 'zzhgfdbteadqzqcdyoraywakchsydcox' WindowName: 'saddosgpezyqfagnottbojfryiz'
- ClassName: 'ccnzogdgofwbcemuccbkjkabljdqqwaoh' WindowName: 'gdddojpsfaxuckhikhm'
- ClassName: 'inphkmizeanbscqufhxkxjntajjurofbpu' WindowName: 'uuvdkjnjrtejonsuiuqakpqq'
- ClassName: 'fcronidagoxruewhzen' WindowName: 'nxkbwmgkjmqwztpkffztaehthmgbek'
- ClassName: 'tnzliqhkocgobhwftgxkqbyqfdjtrsxupnurg' WindowName: 'nsjonfxfjljsrpfddsucyraselzyenzcwjpuj'
- ClassName: 'bffdwpzlpiynmhmggqakml' WindowName: 'tbeabaneisfyukphigisrhmsnyyvrzqziebbew'
- ClassName: 'jahmpfvexalldabenuewkwokdfxxquqtcex' WindowName: 'yyxklaxdszxdwghjkzp'
- ClassName: 'qxbrvfehecqxffchqnwffumtlryayjpxdrgyy' WindowName: 'aogfbbfxletnicxwohtlis'
- ClassName: 'hkasmznoobeqgumuygvul' WindowName: 'ydtxzxamashrykhixvfzvabnwlxzljxeof'
- ClassName: 'dwbekqvjtiknkbt' WindowName: 'xvqrhlleqyiaaebwcwfrfo'
- ClassName: 'ntnfuemydawoaaryfznytayifhrnayelmwaz' WindowName: 'vruwfvltheagkuyvhpguomhympfub'
- ClassName: 'oecwolboltnonpyubunqommwox' WindowName: 'zmlscmvqfmdbinfcrpaiigdkqrjsl'
- ClassName: 'nroelgshuathesawqvrzfiikheefwotrc' WindowName: 'ediwxdbzrqeqwrlnevtybsv'
- ClassName: 'wukmgggldqqaqtltv' WindowName: 'wmvihsutiogtbqwqjjiuxpsfbdtyjsttduf'
- ClassName: 'cypeanqcgjccvvljyufmvozwlyixwlahkgz' WindowName: 'tbkjfiioasgcuzw'
- ClassName: 'bjgfkzvuefvzygldvhzvsvcbf' WindowName: 'qzwymonbiesygcrykkfolctflrttzw'
- ClassName: 'hudxxonwjopfnvuoeltvkk' WindowName: 'twojkjyoalopcqsgjiezcveqxarhofexbo'
- ClassName: 'zbenxzjeetxsdwanbwkgxsvjhthgmvtqzougwad' WindowName: 'ycnkhhzhhvsythjkxij'
- ClassName: 'yrqkphpuajllizompcn' WindowName: 'ubjjngdzkueouqlknxoufkrhkcu'
