Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jfwucmklxitfoprmdtsdi' WindowName: 'ispmvwojvsexkwgibjsrbmxrdcdodnrcks'
- ClassName: 'wayreqfknzatfhvxbydwcj' WindowName: 'qjgwbvgonfgoxphpfx'
- ClassName: 'iuuyzbwuqyaabfqixirzhd' WindowName: 'ngpmabgifkdndqhezgqvjfilzuco'
- ClassName: 'kfzikguszprdbypbrucqzamm' WindowName: 'xrpfqbzrpexgjkssyuoysdrxppkguoogdav'
- ClassName: 'iqbsjlybtnmpjqdtvf' WindowName: 'hfxbotnzwedhtwyp'
- ClassName: 'mavukexhpwxxhcuysdnwrhmdedasvc' WindowName: 'kxgnjlgplvqjopaandclfk'
- ClassName: 'timlopnhasceljqkwr' WindowName: 'tixiocnoyxxzbso'
- ClassName: 'bwnyxzivacqqzojegoiubswaaksjsx' WindowName: 'tjqexvbusozcurzyxdwplexalix'
- ClassName: 'ricvyobhlcujubsbhiwah' WindowName: 'bdfxbdwmedqmwobhxgxiegleituoggs'
- ClassName: 'vakeffusorpditpbw' WindowName: 'awebihwyyrjbnzimthpxvzoadtzfuklk'
- ClassName: 'ypyiivtuviiwtsdzmljfwsoo' WindowName: 'ikehetgvmdmxzywnjgekyx'
- ClassName: 'iwcxygtepvxkilk' WindowName: 'vytgfjneddajseavelrtrgauvkumyyspdg'
- ClassName: 'ktmwyuthqssighqdlrfohwnhrjlqeiohvfuefe' WindowName: 'worfggzqrgfkpqauybudvetoji'
- ClassName: 'lywcozhbldenwqtuwwdynipbiyhtnhubgws' WindowName: 'csrcsroddjlxlzr'
- ClassName: 'ivoacvaselpvabozi' WindowName: 'axlbzfxkhkiwceiysdwihc'
- ClassName: 'jluhxhmvoiuvpnqzfdp' WindowName: 'pyphoanuasndxtn'
- ClassName: 'uehmgmptnidadgeyuhmjcuhrefdhdsmvfnkeycy' WindowName: 'wrwwdvlkuvpawetu'
- ClassName: 'bhtbncxmukkbmzxrsxgobfrjffrhxvnit' WindowName: 'uyzehqwirqvkoqg'
- ClassName: 'vefmjlpoakmramvbjpcmhm' WindowName: 'qumhmtatbrvgbeikzwtawzrs'
- ClassName: 'opqmihphrpgnndi' WindowName: 'cqkihpepidjkhboijvpxwtclmgbllbijj'
- ClassName: 'etaaaebwqkfylfno' WindowName: 'cvbrvcqklcjjdcprfz'
- ClassName: 'mjyafmbufruixzcposscntercpo' WindowName: 'pbvpqnvvwbnahahs'
- ClassName: 'klddepyaprlpsbqiwdqy' WindowName: 'kufthhjsifxsjpjvqybtucnxsv'
- ClassName: 'beaehclflhlymywocmnirbqboatiyfdqfl' WindowName: 'muqsyzycxwxcerehoelifnslojgxl'
- ClassName: 'dfiwxrubcdqauddapcnahc' WindowName: 'mjcsregmugwllugpqvdbwvzombdjoteogsxrxcr'
- ClassName: 'mncmwwmsilkdejvkoglshlwnlpxwszc' WindowName: 'qyjyvrxtqzshcewsmhanzomjouqtzqejbopdj'
- ClassName: 'ffpxmdgylpratdqjmvgnchfworgtmmaakixnq' WindowName: 'jnzobiujqdmvboiytmdfcijcyqgeelsljnjbnsp'
- ClassName: 'kxtssoiqjdjqyueoosmfcebvqndsvksvdssdnm' WindowName: 'sutfmzuwhykkpofnfgfdcyvjhtcvzmncmc'
- ClassName: 'wmejrgfppwjhmtyvjztzpxbfa' WindowName: 'rbsqybvxeqbustbklfcsigietsnchc'
- ClassName: 'cbsdcemtengijhgzzdto' WindowName: 'nloiiuzmyoubcfzjqie'
- ClassName: 'jgefljccqrjpyngwbsfygtxcddqnuqrmxqqqho' WindowName: 'mtcleuecxjmvubyxb'
- ClassName: 'xluixzdvtyzijczsrcsoenwbcygulw' WindowName: 'owjqglmuadbolaukft'
- ClassName: 'gztyvtbbplluxiyabkwjzhnp' WindowName: 'iqekwmtxjesktbgapsj'
- ClassName: 'hqxfiyeailyvcximnimsf' WindowName: 'uurqtohjwzjzwaaxlden'
- ClassName: 'neevpxnqfehkshfylkuikmewilkzeah' WindowName: 'kebummiwuexvbwxdz'
- ClassName: 'dztwhmfrzxkovxkkixhglhjwvivksaowy' WindowName: 'pttijagswezlnruludoclqqnwakesr'
- ClassName: 'nfoebkkmnlserwbktycqdajvvrhbqaxjamqkvs' WindowName: 'emorbynmignzawjtkkhqrgdq'
- ClassName: 'zjlodehtofulsxoqniennrnrgxpdo' WindowName: 'gglutdbfzxvtfhfefulg'
- ClassName: 'ggxpouypqstyepqiwazuupazvtlgposbivxsd' WindowName: 'eozritbccbvzclewghbncdpjdzyhdiuu'
