Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'rbidtmkatmosmhztuvniavpegnvpklxhmkn' WindowName: 'cmpycxlqlnpayuotxpi'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsc2.tmp\NSISdl.dll
- %TEMP%\nsc2.tmp\Math.dll
- %TEMP%\nsc2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsc2.tmp\NSISdl.dll
- %TEMP%\nsc2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'zrjiulotyscnfpgxjbvurrgmkptzbddlavhn' WindowName: 'wxevncywqwrxmzmhpvyljwlugus'
- ClassName: 'psvobvofzvobqcpaowgifnbtkdhanghkel' WindowName: 'qjocmocccryrjalcfk'
- ClassName: 'vdcnrwlmamodxdetlhvnveo' WindowName: 'cirfvhymeyqwbsfbuqsodfnrbpzow'
- ClassName: 'flxvzcjvxcxyycvvreqbwbvkqpvvzyzykyymdle' WindowName: 'ddyhqqtmzasegcig'
- ClassName: 'iribwpwumcvtpaaqjbtgdfmb' WindowName: 'ptxdusivzbdruraemnqdpeeutp'
- ClassName: 'pqbgsxhdxygxotxrwxbrkysvbvcwpa' WindowName: 'godrcywsflvsrxnnzzjmgq'
- ClassName: 'pxymbknpeouwllcsrhwizd' WindowName: 'rofuvalfwpesxocfogaytjdmtqwnrpodxmqh'
- ClassName: 'hahmcoyfycrkdzdqfujuutfhdtuy' WindowName: 'amihjkukzmexupktyw'
- ClassName: 'rrfikwlwlcknvgh' WindowName: 'knmszlclwfobqssivzeuug'
- ClassName: 'blqfjflltzmpzwummplymevedlxvdsfatdy' WindowName: 'loejylzhstbnqpqlpbnjnjaslmouhdbf'
- ClassName: 'dwnravwhqeiiyyhhhhlopkclucylcyf' WindowName: 'gebblzqsesrfbfzvzdbe'
- ClassName: 'cotybcylfoakjrekeoevuivdurkbdazpqlfd' WindowName: 'rloyqpcxiclmjvtutqkxqpaihxrsabifyrhoves'
- ClassName: 'yyvqdeviduaygjeohwuyuflujaeeumlgbkzzkec' WindowName: 'kgjgzgiysnjnijpb'
- ClassName: 'wsuftafgcwsnsgavilxlacjbqrpdabwtq' WindowName: 'gdksoejoratctphdn'
- ClassName: 'fzzyvjslhcvjdxrcchnezxdrqjlkjezxp' WindowName: 'jnhjiipkjvhcscbfwpxaq'
- ClassName: 'lgqciuqlesfiyzrwmvngpmdxm' WindowName: 'hiohviihqhpuvyosrlklkeigsyqoillzhzvacz'
- ClassName: 'slkxuzyinfrmxzxqqokuml' WindowName: 'xmegfscyskkcgehzvbyfpyy'
- ClassName: 'thhscwpxnpodberb' WindowName: 'uhgfdytxgporhjilnkdqs'
- ClassName: 'ovulrrqtotjcinvzqzztzrnxlhjmdqykc' WindowName: 'eqozaxbyrhcgwgzffffjpopiwxsatuupgiptdf'
- ClassName: 'lzgunklxdemxyjstjutxijdktllkorvux' WindowName: 'kgnoonxktgmcubtxchptahznpyizhlymabgl'
- ClassName: 'moprmdjmdfwxtujqdrckbeprvprdpahtsouwnk' WindowName: 'ixphctpfteywhzaowuuwxchevp'
- ClassName: 'gpylseniwblhvujtzkbdgmnozea' WindowName: 'xlpmfohmsrfpttuaky'
- ClassName: 'eftmklhmqomlauzautmbulsgynerpr' WindowName: 'ineegtsquqvdqbymsesitr'
- ClassName: 'xgwusuedkzxyvnyktt' WindowName: 'umikyzugxywhtqjdqjxxmxdujpco'
- ClassName: 'gnxzfbmjroecphyxwjehio' WindowName: 'xcimgglabdiknkyxt'
- ClassName: 'rysoywvwauympufwpvlarem' WindowName: 'zvxoypwslrconvywyaoy'
- ClassName: 'qbcjarsxmjompqiwfpg' WindowName: 'kocjldblbtaiiuyaa'
- ClassName: 'xyahqahetwrcehsyrkdxugorufxubgszencfry' WindowName: 'vusrnsqnvyeknnj'
- ClassName: 'syzlyybsxqjtucvneunpthbihxwmixhc' WindowName: 'rjakwlrtuqpqlfhxmkda'
- ClassName: 'nsrzshzhajuiszgqfdhyvhhblazglmuwe' WindowName: 'kskfszyxncxglrxkrnohybgdxaprzhjvqmnmmyy'
- ClassName: 'tzbjcggzbkmqowezbtuhhcoeppmaddx' WindowName: 'glnngrubsrhbtjudnjeglnqlyumotxft'
- ClassName: 'vadxcmluhptohktfp' WindowName: 'jxzfhhzxzpjdfrrymsvzsmjfcmileyiepurfm'
- ClassName: 'dinpllownoxipuaitbzbe' WindowName: 'krwknoatrwfvgsednckvasfxydcpunv'
- ClassName: 'ntcqujjpkixepjjsf' WindowName: 'ftydsyymfmylybnawdtca'
- ClassName: 'jdsfztdwzmobstgjsvjjdtcwhjpusmu' WindowName: 'gpnzsmsjginfwaxkfzmkoylglrbsdsie'
- ClassName: 'lvbwxghnvthokfczcsggak' WindowName: 'tuomrjlfefuyzazn'
- ClassName: 'inglkkflolihpxtnrh' WindowName: 'pumczjjviskvdqpetaprbsho'
- ClassName: 'kwirliffddztowrqgqeayklrsy' WindowName: 'snslwiynlokxxrxluccscrkexnew'
- ClassName: 'euzmfrlxdpitfqrg' WindowName: 'vdrueomjbnniaxmydo'
- ClassName: 'sugqrzvabxjogiqeubcsxsmron' WindowName: 'jrgdlkhcxafdaeszmkrwmhqolwywlfoyssxzlk'
