Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'anfmunovtocbutjhbdavonzkoefruhqpscmwjg' WindowName: 'fwgzqdmqitbziomoifuiebqdyftwucshvg'
- ClassName: 'krphmymvuwolxjufoekzopupriyusz' WindowName: 'fclpurwcopjlmibkpoyjjfkfhqciyg'
- ClassName: 'ndocuddfinljorolyyfewd' WindowName: 'ngjomimzncqrujkeruaijsh'
- ClassName: 'rylqiqfopmaetupnikghs' WindowName: 'klmplimkvhghdyalqtzuwnzkzvgowo'
- ClassName: 'fmxbbvhxgnxbekksyzl' WindowName: 'uoqflrneuwpgsbplusfzcd'
- ClassName: 'hngzjtkswklwyiivatxpflfaefxsaf' WindowName: 'ylqyslnbxxbbsjdul'
- ClassName: 'lnurafmneixxptrcvlr' WindowName: 'jyytpujwcfpkejsvkteggpgxt'
- ClassName: 'jxcfwiolvjpyuxwoakddhecnyxshnhh' WindowName: 'tmcwdjuztccefcwveaofvqoblf'
- ClassName: 'yoizlnxtywicigjrq' WindowName: 'wopdqsbxzmkszzstiydavhmncnwzmutondkg'
- ClassName: 'pevvsaxaxdhsuggcintdzwuzatmwkzk' WindowName: 'dtrdauxykvqalmpw'
- ClassName: 'htxywgwthgwuvgmxnikhufopralreplaj' WindowName: 'rpxkaberhbqrvnugnepomcwhab'
- ClassName: 'ytvevscghwysvpneerhcgxbvvefh' WindowName: 'hkdyogcjgwgwygphdx'
- ClassName: 'cdnktnsnseqcilakasrwrbrtjck' WindowName: 'qcqknnizsewvoptrqtymou'
- ClassName: 'ehlehsodlsvbzdemk' WindowName: 'sfdqhvirwpcxtsoarjvircu'
- ClassName: 'nplfrzropctszfegyjayrs' WindowName: 'ftdmtgmevgrdysolyepmzct'
- ClassName: 'othadgszowztturtpobdpyhpeoxgrewxuy' WindowName: 'ubdorprsxdfxxkduzxytmyoruothskzkettvel'
- ClassName: 'syjfishyyzsdeqbmrbvkrv' WindowName: 'ityqxoyxtdmzrnvbxfedzrsv'
- ClassName: 'ljczbvkfbpmzusnqhr' WindowName: 'xledypfvcwcgiqzpgnfruwolvyetaa'
- ClassName: 'bomlgeqgwvlvfsikrfhnpanahbqfwhke' WindowName: 'ptdkmmvsvesrwtgmdcijrqiv'
- ClassName: 'zvucditsvbbhhoucjmvugbumysfrauxfjjn' WindowName: 'wborlwtahhziidwdusawqoezprc'
- ClassName: 'jedpqjublwjdjdqypwkhnehiuoswhbho' WindowName: 'ekfmxrgzzzwdagxvripbkyaayzdfuqtewzfyea'
- ClassName: 'jujafjvicirhyaqvmsafpxacwljdzzwwqtfej' WindowName: 'zrfkhzbaxlkdqwpieutfdmdumfwouqq'
- ClassName: 'vbntnkvziwuibhhlpydgxvytuvgguviprktlgo' WindowName: 'cmmjgbgbigwcxerubbspfkagwlbsjhjwqottlcc'
- ClassName: 'nkbvueebvfntwktbk' WindowName: 'pezjotlysgduqvoqxcbmkgqetayeudhqzcadz'
- ClassName: 'ieqialdlwdfnyqaplekffbxsckyvxxbmladq' WindowName: 'ocsgwmwemtquwmstxksxzdmkapycrisj'
- ClassName: 'utbngsphsznkhrfiewxjpjvkqlasuuemokr' WindowName: 'rllnlamyilmdhuhrpii'
- ClassName: 'omnhxpzezvrrjicnnlgczkttzcvsnovnn' WindowName: 'xgtsifwyofqzfysqzmlvdwpntmubteuuyvheb'
- ClassName: 'wjnqekjpywgtyiueajmnywsbobpufmxhxzko' WindowName: 'lmnfxldpwdufrupx'
- ClassName: 'vthvrtpunykrmcjtkhogkej' WindowName: 'cbxayymqvtsrwncagcrcxiwtiff'
- ClassName: 'ycliimhthwbdcagtcmu' WindowName: 'jcakbxuflzdyxbsyn'
- ClassName: 'cagwpsmsyfjswicwea' WindowName: 'srewkycvdpgninqguklnnjptcdkkdau'
- ClassName: 'vmhgwlvvzerkwnmsjwtwztghvkjrjfufavjnsn' WindowName: 'peqqfgozvhaxzliixkg'
- ClassName: 'vzkziyhftgcszmlhxfeckvlrbgioxd' WindowName: 'nppkojuumfviskyfmaztuoihrjvhsothm'
- ClassName: 'ihajxgpvmlwjxncmx' WindowName: 'lyswmbxcmbvvqcpeishawjkypgbal'
- ClassName: 'inrlwzdoreuxgdw' WindowName: 'qduuuinbuleznssiowhzrbuhnvhobstmnygsb'
- ClassName: 'hersfzdfhhjbinbbmforql' WindowName: 'zciumnutkhojpoeqefyfodmfqjziaj'
- ClassName: 'mzobofgwefcdqktdr' WindowName: 'kvnyplkpvxmxekzbptlxpszssxcansqngmuc'
- ClassName: 'lpzfzubrvogtcihke' WindowName: 'diewfptsfiunrmqs'
- ClassName: 'ztavloqsmgldakolssmcxnlptiyiubhgfw' WindowName: 'toajibhvxwdhcslvdmmmnqmeulfrzdatsyg'
