Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\NSISdl.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\NSISdl.dll
- %TEMP%\nsv2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ljixzcrrghicjllgiehyetdeodmk' WindowName: 'mjlknxmxzpmrrocorlwktkdryfirgtz'
- ClassName: 'ygarithcxlefsljlqgmjaebpcytvnmmrbgj' WindowName: 'xsnoyttvdvvfezavnxainpamdbqv'
- ClassName: 'pxbtemzxqfgemwbgutxf' WindowName: 'giomlmpszepdfhyddkgyjabxonqdl'
- ClassName: 'pzikzvifjwbwrenioqobjzibdzmehdencp' WindowName: 'jldgyextkhqomypxukdrqsdvdhazluvkbizpyia'
- ClassName: 'qidubirnazcmbenwuptvxjqxqwsivvihbu' WindowName: 'qhizxzmihqtxrlxqqjceolhldvlybpokut'
- ClassName: 'ssqcxgixckuexknkivudajfierhonuksiwqpr' WindowName: 'xldjzwodwrxltyzvuxxoutgffeozvsi'
- ClassName: 'plpunikiwuejyindxps' WindowName: 'joyxcyzjuognhshbxt'
- ClassName: 'jowykyotwtktfhjcbkarbrkyirbgkzhyvsj' WindowName: 'nutbgwiwgjuddodpokowcmjzwaeoxwxaiojchn'
- ClassName: 'hwhixbarcvnicyremcwpzlenuvauh' WindowName: 'oukniztcpriqmgxkagltqcysktsmpg'
- ClassName: 'jujsjuuuisyqofrdihkwgssxedpcj' WindowName: 'rjhxbbwyqdahmcios'
- ClassName: 'fndcirgwrdivggshtxqsrpcmtqeoopabbx' WindowName: 'ckbkvdbrlxymybjqwzwuwwfwfdswvco'
- ClassName: 'tyotqcvoadqhpowp' WindowName: 'amkgyjnvdpskeutkzuswrnlktxajdikrskvjgr'
- ClassName: 'lpnvawrkzgoghpkkcyuysxzwjkcwns' WindowName: 'skzahrmqjwwoggfckcnilsjpxlmkfrlre'
- ClassName: 'hxrehjlbiwemcjcqrfnouvvqobefigbetrtllw' WindowName: 'bcvnokpedgachujpfdouiqywhugmfguvcegh'
- ClassName: 'rbuiazyyktzegpuj' WindowName: 'juvcxdgzzoustsqikdcxfowmfkrqkfyfwumq'
- ClassName: 'hommilwzojhavul' WindowName: 'ptvjlnmcbhkpgoqpjhorirfaizliojbxsvrdgf'
- ClassName: 'stlbnchosdfdtpblknnhoeyqkdbqawa' WindowName: 'hmqmrhktjrduppbemnwu'
- ClassName: 'udxhvqxjzbpghleoumtpcrwdvyefzwxv' WindowName: 'mcibsfkgrywasktcewwlzmwhnrj'
- ClassName: 'jsqxedhlozvfemaqbzqd' WindowName: 'haieicijgpibcfzsgrnksbzwczrwceid'
- ClassName: 'auoeyqmnudmvkkfzm' WindowName: 'cxkearuqoqfnlstbkethhagfpizefbvcftcv'
- ClassName: 'jiycmfenblozhuizmapucvbyyh' WindowName: 'jmxuvotpnhtlreemzcdjztrmmxelit'
- ClassName: 'gwlhwqwgxpozslkaucioivowztawatuersb' WindowName: 'tiwromtcmbjxcstqctdlbmtywlfdxqccmzhwm'
- ClassName: 'tdgqpdfzsbnnwsvnompqywfvokxpvpylnhyqg' WindowName: 'ixolywyfjxhuubkchebjibvgc'
- ClassName: 'vakztuhkcjhemxarsnwbdeahhlrqkovnl' WindowName: 'hzttbenlxhltebimqc'
- ClassName: 'jnxwpyskcglhvksxihniqti' WindowName: 'rgpmspoicwqgpcnisbcjzbqzaqsadxi'
- ClassName: 'byatwvryvtrgcafocdocaughyfvdtltclkslkyj' WindowName: 'akgnqrctdyeyxkitzn'
- ClassName: 'ubupcibwjqddfkuvsakfbgnknbydegavxgebzj' WindowName: 'nvznhdcysfcoeebazlllptvqgvewxptehqqa'
- ClassName: 'ilghrxubnycydisiggflsjjvxkjzc' WindowName: 'kztckxhwyjvoqwtbn'
- ClassName: 'kuqqzligthhlctagxeqvxlotoxvmlyucan' WindowName: 'rofxrupkvozhpqzcxicbgirxt'
- ClassName: 'wgugsoxdkkypmayuuc' WindowName: 'aatuxzvydnhttogukfajtqiqnstsvnuiczr'
- ClassName: 'oshyvoqyylmitauqzvybqpyhpplxigohijf' WindowName: 'tpzityqulhifvunqycolarnpggaycxbtp'
- ClassName: 'gxqylarszrqivkiaqdpbeuboblkfnv' WindowName: 'mgvnvhcbrnpgevfyucqvxhoqhwuhgajhiql'
- ClassName: 'kjedpmtgmqzqfetufdyjspjdwmznlonctrjiohe' WindowName: 'gyqfcqyixpnqhzxkppyylxjcwbbvryqvziivq'
- ClassName: 'pbtgjbrkcifooqb' WindowName: 'agpcpniwiggfzrwnhunhrcvdkwmsvibbnlezj'
- ClassName: 'xehkqehfuscqrwamiwmbn' WindowName: 'sdmsyujunivzyph'
- ClassName: 'jxjugsdnaxqaljowayttdihnmaxhbmazt' WindowName: 'jvdmpjbyqfgtcaxjxquxyfwsmwfkghcwg'
- ClassName: 'ucqaifpvstezwyv' WindowName: 'sifdqirqthljfsggxpipmwzcgulviryoov'
- ClassName: 'cotsamnkdsiwzvyylqsygudkddqnpuzvbm' WindowName: 'rmhupjdlosycirxzdq'
- ClassName: 'psqvxxkfhsxdbmuzmkwruelfyguurdo' WindowName: 'rzxbzfrvnvizaacucgixfuukdkwycwnwabhaz'
