Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\InetLoad.dll
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\InetLoad.dll
- %TEMP%\nsp2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dfckwaezxyblhbpccbfpzriccswtny' WindowName: 'pzvagbnmfnupbrj'
- ClassName: 'qhpcwbaufliokmkcbro' WindowName: 'hmnvvrcaanllvkzjnlttaoxntxmnhaov'
- ClassName: 'ajhgqvplheegukqeqppnwtjakfy' WindowName: 'zwygkosbbywxqunwpybenqkrjogd'
- ClassName: 'husewsbnsxqoukrfisquckhugsdytnpl' WindowName: 'zjudscunodjsdnmxlabqsxczqewnxgiw'
- ClassName: 'pzwxutpjwbfajiiyldclqzxcityvvworoglyrrx' WindowName: 'qnrzruyhbrmnhgpece'
- ClassName: 'zfhtpdrijcritdsn' WindowName: 'qcidklsamjbqtsxwqcnuogpdnryaeszsq'
- ClassName: 'xairlhfhvgutovrqcpiguazqoslbuzmstnixbje' WindowName: 'qwqvnmahbfepnvzihhmadsw'
- ClassName: 'hjbigvaeoxomkgdkcn' WindowName: 'epaemsqkcyikmaikaz'
- ClassName: 'ovwrgmqgxcvshqarhibgrjfxtoh' WindowName: 'kvsniwyiwpyljnibzmxlnewjspznpdjmv'
- ClassName: 'ibfxtkuvwldeyatdqhvmccye' WindowName: 'emcjgpivwpsbcfyyizdbtlgtxptxfwrzs'
- ClassName: 'yhuefomragimsoangtnadhvv' WindowName: 'ouvaywtpvowhcpkaejbvvauwofmvssqxxvahw'
- ClassName: 'xraakrotzxhgojvcdyukvbrd' WindowName: 'soqpyxofbvxigzqt'
- ClassName: 'lvrauhuxsautluxhzfrzcetwlklrpypjh' WindowName: 'vxqkfifofnvvhlwzdcctjhmscgvtjdlbhmplwk'
- ClassName: 'vjfanzhizhypurypbhchrxfqywuzouksz' WindowName: 'fddfwlwfmguklsmczbtlmafzrdzxbsm'
- ClassName: 'afugebqpzvzjskfqspmickmnciufpnipqllaj' WindowName: 'qmvrgprnpfuhyjxpsvisx'
- ClassName: 'fckhpgjurhnoknvywbpvnjridh' WindowName: 'piaivoiwoqxjzedimfcyobtukgapkytre'
- ClassName: 'otwgbdxpbpsgussbejidfxodwptpxdnpqhrx' WindowName: 'vxzaingahvqrfbqxamuqxb'
- ClassName: 'hpdocdtchslbqcdxreffns' WindowName: 'pdqshoqbetyegthkpulnpdapzdidqki'
- ClassName: 'vkokwnkcynkelhxcwtfeyuaactiknuw' WindowName: 'zilklixgdlpofejrtomfjmhupc'
- ClassName: 'lwovnnlzxxbphyinnxxxvg' WindowName: 'uharxvumrgonubehfuilafyjc'
- ClassName: 'ypxugmznxrduhakmkzg' WindowName: 'mxexvmhcxtggxvuy'
- ClassName: 'qjfgyrlomihxzqcrhatmvrliugtlb' WindowName: 'myydlrqoaekqqmzn'
- ClassName: 'iacfxtimaabrksympgksojjbutndhwy' WindowName: 'gvdikfmjpvninqcopimpehxstvh'
- ClassName: 'oqxqnoqjrbvwyaxyzkzarparn' WindowName: 'bvekdjkovjmucsrdgjxrtp'
- ClassName: 'ydpflsesimoziqdjjzyqbsfakeswc' WindowName: 'satuegvccthrblo'
- ClassName: 'gfdpwgmscwvdzwsewdd' WindowName: 'mjpawmcxytkrjlqlqlyn'
- ClassName: 'oyqruqfexzyyhagofexctfyrwyetrqspeuu' WindowName: 'qudpdgnmrsltrlwuyktirmj'
- ClassName: 'ciqzbbnqardevaeghwodvb' WindowName: 'icirhucyfqfowymifpocolhdexwbnu'
- ClassName: 'rckwijlgadwkzqyshsvnxbyww' WindowName: 'sdiyzkpzoabghvmipn'
- ClassName: 'pxrulxlozyobljdubbryyjqndyjlavkc' WindowName: 'vomfgmfplamwlxgtfxiqp'
- ClassName: 'ynpwvvjbxthcmpobhyllsxrbgmvlcdmdcxwqqk' WindowName: 'fbyivqvnmognczitxhwzlhmdap'
- ClassName: 'mvjpnyaiswcjsuldhmhdgsgvhidwhkfrjori' WindowName: 'lndlwxxgjxqtprpmlvxztru'
- ClassName: 'yhtylfwyrivtsbctegmoydr' WindowName: 'vthivjxzepqbzuscyrinxeaafergcqnqcq'
- ClassName: 'dfkkipmmlwscyleojzuqo' WindowName: 'gxrxcgaglyoaldvlivox'
- ClassName: 'vizvshnqdorgrbdaeofsmfrrfauwyosrtga' WindowName: 'qszmcoaahckasffnhjpjvdqfdcboy'
- ClassName: 'ovplvrnbrmmmvmztlpnfagpxaggcggxjtvf' WindowName: 'xtrjymzsllxbrxctyws'
- ClassName: 'dkhpakrcccimqzhavrrqhkenzwcjedtzlsiquln' WindowName: 'gjkjeudecmknnilax'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'zunqvcdupgsbouayxtrjh' WindowName: 'cwebhxthbqhelttjdtlwcgmfqfuofroaxvbw'
- ClassName: 'xkkdfeqpusykhgnyutmvuue' WindowName: 'piynyxowbokjhitxfhhmvwfqbizbc'
