Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'crxdhhqzpaezdiefdscpmjboizhop' WindowName: 'avnwcijedwbyuzsvozbltaxippddmhus'
- ClassName: 'zidxfaxpvfxekaouzkluazbzcnkon' WindowName: 'lqffvxboordptcmkfziotziommrlh'
- ClassName: 'wcygfyosnfgkyayvkm' WindowName: 'zxajdsrqvybqorpsketzrnjekkqjquhhpcqv'
- ClassName: 'zzaakfcibafecwtaipfvnxjvvmkdomlfctzvaod' WindowName: 'eaulfrddunwvqloqnpigsbgyblflq'
- ClassName: 'agxhhodcadbizvri' WindowName: 'wroeglhfbtetsknxpjql'
- ClassName: 'icfxqjgpfxpqkpdleif' WindowName: 'mmbjkrvrikkwmsiksdxnckvnlkwzswbdbf'
- ClassName: 'hqzuxmiwfplafpugbbixmkjnfhuapendmtxmvlr' WindowName: 'ckpsudfcffrwywhhwn'
- ClassName: 'pwlnehalaioeznd' WindowName: 'ykqlypwnjiinkoutwgsivlhncmlxomkmcph'
- ClassName: 'hpzmdyciuxnzjcvcxsugf' WindowName: 'kpphcnuvugbbiuksasrom'
- ClassName: 'adufsajqbqnwzqdicxnpgzrvf' WindowName: 'xkvqvkdcpnvmbvggklmlkbzsvvvtpzevrm'
- ClassName: 'dldtmgynszweolekpdajwfmqx' WindowName: 'yogpbdjmkzipngldafddjkdfzkljey'
- ClassName: 'huvngncszzaaqav' WindowName: 'hwredzyqtoriodhzckymqmhazwgbkmkdarf'
- ClassName: 'cqshkzxunsvtqgzmq' WindowName: 'iqpefzwysrtnawdlfgbtxzfmvuvbn'
- ClassName: 'gbyrnmagaknpwgdigas' WindowName: 'ywffnzeykodzxnxffyyaazrhqapimqqq'
- ClassName: 'uznpegrdzqyanrfsjlbqccpv' WindowName: 'gooigjdonoprmzbkaocunro'
- ClassName: 'vnfcbebxrldphtmhthieqqyrckr' WindowName: 'nvrrsmappopfchzlojxkbzfouhgroklphohnka'
- ClassName: 'vimwhgnizksgpoo' WindowName: 'phvouyfatflphoqrjoiifpq'
- ClassName: 'sbehianxkyeeeqauifbscznbvpxcxxstdblp' WindowName: 'saeoalnzgtltccnxgmg'
- ClassName: 'bkukemlxmybcikgzxibpqisrlmrltgyotk' WindowName: 'sochnbfyfdqlhqoxennsvmznuooeckjm'
- ClassName: 'jlrwrfmsmpdvzvjsfdmwq' WindowName: 'uusmrkkrsxsovefnfywjdtk'
- ClassName: 'dyehunwrqycfgawtmhloccfxc' WindowName: 'qekyiosuxvrrbzpjqis'
- ClassName: 'xjjaxuubursoauxnvzokwcspiygkhwqs' WindowName: 'bnhacmkaxbgjhsde'
- ClassName: 'ubjtwxwxowwcokzersiou' WindowName: 'irovovdxbvmtutowwjrntkdeszdzovaxhcjhnf'
- ClassName: 'fbcingirczszkvrn' WindowName: 'hirdzhbgqxayraasrxgbepyijgzctkitejjw'
- ClassName: 'ysewpvxvztinkue' WindowName: 'oaaaqvswvkwbqpahdwhcbjelririjxvqwrn'
- ClassName: 'rmmfvtchbklzmbcqoggltltosjcoyonep' WindowName: 'kscmehqzfumrstdifumzp'
- ClassName: 'msnsxminyaqtvregvbfdjojidakydybcmhubr' WindowName: 'rbluvmgqrckpcvcdtqsskrvye'
- ClassName: 'ftbmsqulxopmptwhlddhcrsj' WindowName: 'zlsmofrppojfxrlehoyysqzx'
- ClassName: 'zvtkvzzuvztqldolyzfcsizfppltb' WindowName: 'taixzbemyjgasmwmtemdlcofxksdjyu'
- ClassName: 'pzqjohhnztzhsqmxsnfhsqglprthzvznkgqjio' WindowName: 'mxeqcybqlqwevkpvegz'
- ClassName: 'cqyuqtryamjupbq' WindowName: 'vfnbkxegujgopxywhxalbvkdsocog'
- ClassName: 'hkqfxmcnswjlcburglzhcgwpmqejevrtfep' WindowName: 'pawxsgwpeaydbfsg'
- ClassName: 'gtwbpzfzurnqssrpfirdvcpnnoyckdq' WindowName: 'yymfzcgjalbiifrutwetqdlm'
- ClassName: 'akmthmqvhaxhfqqkxobzbgghbv' WindowName: 'wnnlygqrxlqhrnmygsqkjt'
- ClassName: 'tycrqmwkzswocuryaapqueafy' WindowName: 'grmshaiznlbtvqmpueloageteskhhfchkmg'
- ClassName: 'hssngnojkcxywmpctyfzmbeegxqwoa' WindowName: 'ktvgvcpbsytdmifptmynwjhlzkzpwnfheae'
- ClassName: 'rvidrndlaynitzsdabtgbpnkalu' WindowName: 'oidhxnoruignwctdbnycxine'
- ClassName: 'euuwqudfftxkwdkksv' WindowName: 'mcoovtebwrsbhfcpwnpvmuaxcqiarc'
- ClassName: 'eolgiitmylshpsw' WindowName: 'fwgtbfccqqvnhyrf'
- ClassName: 'dpjfysgqncpnriccneyqdmmibm' WindowName: 'esfcylqlhvtjrfmljqgeixbzdcjmgbbwyplbb'
