Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsb2.tmp\NSISdl.dll
- %TEMP%\nsb2.tmp\Math.dll
- %TEMP%\nsb2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\NSISdl.dll
- %TEMP%\nsb2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ktyopyrsarpjupfstoolcqdgvrutfyhriwp' WindowName: 'tdnhawbhjnqeswqscpikuea'
- ClassName: 'wurttixxmeqdtighpiippyjprgximidhdlysxe' WindowName: 'gwzmnztjuyckkmhnnvwk'
- ClassName: 'ensjwtpoxzsjcigh' WindowName: 'wtrtpicopzrmcczjbdzukyb'
- ClassName: 'nzaxqewisjwcdurxssxpfmtxq' WindowName: 'mgcymaklcefzmefswlhgkrihcyw'
- ClassName: 'tlqgvvqdlekfxaeznrxmjhuvscnzr' WindowName: 'bheucedhsmkkujujxgnvgsnfwqsdhwd'
- ClassName: 'zoyzobplhewdawqslfcfbumbekg' WindowName: 'klpgkjbgysdusoyen'
- ClassName: 'dqqvwrvcxdgvmkdzuxxoszcsstqwhfts' WindowName: 'fcqxzmobgvelzzlhvbxfmoebwproetyqbb'
- ClassName: 'tqvqxrecvhkbjpopzjlzxrbjlddtxhp' WindowName: 'jkwqgwggkbkawyuvsoibz'
- ClassName: 'zsjuurfenyczlnkavcgtgajg' WindowName: 'gdopwibfwderkhciweoawkpv'
- ClassName: 'csxfiirhsdspzqtgjrvposttbbgardmhal' WindowName: 'jzgrlunbfcaewcataotvx'
- ClassName: 'xqafhnxhmiiqvzdyhmcazaymkrzudgxmzahgiyj' WindowName: 'zburwbiukzdxbupztoiejpjzwmvc'
- ClassName: 'uzyxhvvjzuehdlsbw' WindowName: 'gqyfqzsefpmcmkiiowwtemalqu'
- ClassName: 'jhnsnajnazjkpqylm' WindowName: 'zjvlmobgxasglmzhxawm'
- ClassName: 'mjytotrdhqevxyvtfntzcktpiyoeiaumhpf' WindowName: 'lvnxtsfxvzxhfbpvnsgrf'
- ClassName: 'kjanpevjpqimebyoozu' WindowName: 'swjotsbtmrijiejrhkqpqcahespactfeyrt'
- ClassName: 'ieaqitulubuoftqdjaqryowggrtbpbrr' WindowName: 'wyzyjitlcjjsgrisxadqvcajtcorbsgzn'
- ClassName: 'ozqxsxtdbfselbzjkkcigmhmvbvwc' WindowName: 'aqrqrpgjytbvkfcsuj'
- ClassName: 'uuhqmycjypqntxekaxkjctomdobkcs' WindowName: 'gopzrhcfcbwxnjsfy'
- ClassName: 'nvoxptdfzrqghxjhqwlvnynrzkpxtejvishqphe' WindowName: 'dvmrujedfkrfevzqubpqefijiktrsiimhn'
- ClassName: 'cjxvffepsrhmwfiyrce' WindowName: 'fldhotctudcjokmqjasxshwmiir'
- ClassName: 'zvvhicfovzddakrhkyygqbmtecxldx' WindowName: 'wehxkkogktnarpbjwbbgnoyxs'
- ClassName: 'ludxwfjusbazhqkgqzwogh' WindowName: 'ualueasrblajuuddttlcm'
- ClassName: 'cupdunztymagufcoh' WindowName: 'ghfktbsepweqzhxdq'
- ClassName: 'zwdklgqcpakrkgbjbw' WindowName: 'fprqotusqaazrlmklgjbtn'
- ClassName: 'hfirekmtatdbqjjhatwdpnggezivxdzaz' WindowName: 'gzkmizcmrvstqeegdozujqmghjttxoezey'
- ClassName: 'awupgxrlszuiodbwggi' WindowName: 'oafwbzyhyjdhxadsthkwnoqmaoefvgok'
- ClassName: 'kxbinburbeyxatsiyzzriymr' WindowName: 'yudhoeahmzzpysfcnvydjyaiiluhpfxulalfr'
- ClassName: 'mxjdwrhzoytnbuhphzjcnmaqhsyxfam' WindowName: 'lxiplinyedhrgwtawfudlrbirwl'
- ClassName: 'ailhkxoqjznevhpsojlklwjjlubymblzobcwv' WindowName: 'haavbbmzvanpaarawrkaesuugyoiglfu'
- ClassName: 'fzglzivwdefoydatqhe' WindowName: 'gbydaltqambvrtauzxjcrb'
- ClassName: 'adabijpilzjszuhp' WindowName: 'vzgyelubojkjevqaarwgbnpqi'
- ClassName: 'wulqmehenpldzmccreaydgbsdl' WindowName: 'nxqakpbpcjnvubnjgjuk'
- ClassName: 'csfibzupwpssysvvhal' WindowName: 'bsqrjwcawlulnzuexesq'
- ClassName: 'pogwizqtmtjbtlnbhsnfielug' WindowName: 'cticiwxsnnyyadqjrfgkqzqdx'
- ClassName: 'kfimyqcvfxjioqyjleedvxkmkhqtzywat' WindowName: 'vpzljcxqopioydkkriutincgabvcarwtrdfcs'
- ClassName: 'goxwbqnqwkneexqpciqqulpxqjdvnfqurt' WindowName: 'iryrjxbbfbxaseaphxibirfnhrzzskqrodbpt'
- ClassName: 'hiqutptoxbkphbntxwycjlunaahlwmf' WindowName: 'cewkqouiezemgeowmrcuhanrjisxx'
- ClassName: 'uichiaaerqzuukxvbxpdyjlvlrvtlrwtr' WindowName: 'irekrszlxhutoipyfjqj'
- ClassName: 'ztwqhwgdudszzbq' WindowName: 'rjqqqqnijiwwribaaokgfvtntwvytgz'
- ClassName: 'fkcedbjtfyycgclqgmnvqqdbiywjopykdekset' WindowName: 'agulaljeebzaemfahsjcqveedypusmkly'
- ClassName: 'glshqcrncjbaopncngihiiqcodbvol' WindowName: 'nvdsomygmpyujoydxbqrlfqg'
- ClassName: 'rkvzckjgpqwzbslyufyypdasymakqwaaioij' WindowName: 'oyzdjpoocsvgddownnoqafmtnaxjbyq'
- ClassName: 'uzzeiqzdakxtcmufirptptnbzecgyeifgwm' WindowName: 'spbwptezlpecukjlwl'
- ClassName: 'qdmdkwsgoljmorcliseyrgfpmb' WindowName: 'iclhrporuhmazkm'
- ClassName: 'hctgbwlpxqjuqnlycfcbbfkqruied' WindowName: 'fmpmkchtvxvwdgxoawsjlqdimhnkwxe'
- ClassName: 'qmsatsyffzbomipmgvouoehbfdxurt' WindowName: 'cyofjhgemdvrqqivhnxetcaaicsntdnplxf'
- ClassName: 'ppglfjfeusixkrr' WindowName: 'biyjgqhcmqptatn'
