Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'oagoloesaacychlhjidsb' WindowName: 'ueugmmlxntnkdedmrrzefakrqzugy'
- ClassName: 'blgfmxpjrrudtgnfvtqlwqxrvvnoo' WindowName: 'qcglvgjmpoerqfuhnlrhbatnykymlgz'
- ClassName: 'snasepxkjxiyrvixh' WindowName: 'zutfwqazllxyekzlzzhppiywvlkezgxd'
- ClassName: 'lmcwdcdyepifiyiuvtpgchalyklvzsm' WindowName: 'hemkzbwlcmulwqwhtw'
- ClassName: 'hlqablejufueuhkfwareeddlim' WindowName: 'uhnyvdsogkvvbyoywhjnjvwqstoxwampjeqjrsb'
- ClassName: 'yfsyzmypqkpzysmxwqddukwpcbpoaabn' WindowName: 'bspfbjxcnomkfkjga'
- ClassName: 'wvoagjofsxzymqfboukwgcliwqoktrqrdg' WindowName: 'atrwdhflxkdlcwpetozinouvmtdzfl'
- ClassName: 'nzoyrorfnvsqqmcgqiu' WindowName: 'lkswwbgxhbjtcgvmwfisygzxubkrdguqx'
- ClassName: 'inqoojhypjfqnndsgklz' WindowName: 'ywrmrtohxmyccihdiexzniehuycfahh'
- ClassName: 'goqvxqgwsrybebbxdcynhjdtqq' WindowName: 'cokplwkggbwydnsw'
- ClassName: 'nliecvhivvcxtdgtfjbnfithehhphbb' WindowName: 'iifmikfpoovpztrqadeouqhnxxmkna'
- ClassName: 'jcpgzjawixgrynwkozpxpdnmwmgrhmra' WindowName: 'etdzweyzhcqfhqiaoxhuf'
- ClassName: 'ogbuajdlthhlunjbi' WindowName: 'kqzsuvgobuquejynahlvvzfqrvxhhssq'
- ClassName: 'iaaueacvkdtvgbxsdnucoj' WindowName: 'qsxdqcpijtoqtcdnts'
- ClassName: 'jnbrnpcvockmvmy' WindowName: 'bfhtmgtvgxkxooafllwgz'
- ClassName: 'nunltxuuyhametjvnpmexbzdcbctmrmxfuoo' WindowName: 'wugqvqibazuutqjjrfqkvylvy'
- ClassName: 'clwoxtzqnqwrljgbgvcbaqwqowawfmprdmcmcj' WindowName: 'mdmxtewdxvtjdbqagvdvxrlfjqcrsdebyddijv'
- ClassName: 'vcziltukqodkqvzrqmvjk' WindowName: 'nuitcrtkxmctabycx'
- ClassName: 'xgnwtplwhrpztegwhbmodetyxokawrtz' WindowName: 'kfodebonoavctuwzvcik'
- ClassName: 'ztvpocbovcovvkxozjbttm' WindowName: 'ndtjxpuqrpeekxfsqpzbd'
- ClassName: 'vierafxxwkaryuypiawnvexjtvxf' WindowName: 'zvgyrbytauyemqimnefdf'
- ClassName: 'mmgzicicxrjznwvrsinfywydufewzqwxwnww' WindowName: 'dpwvvsjgkcpougshvfmtvgqfmzjqiruaeom'
- ClassName: 'vdhvtlwlbrdzznfqtuafi' WindowName: 'uixouommjmjspvdlyar'
- ClassName: 'oghsnudtsibzdzsellarocm' WindowName: 'otuklmrszdlbxbjlurpoulxtblrfabidj'
- ClassName: 'oshhvruutiazpsowwr' WindowName: 'tsdstvrhgyoycugskaepzdecvbvickqfctecbqy'
- ClassName: 'ykxvmhibnlfjpafavdxtavuxyqzsqfyzgofdq' WindowName: 'ibalmebkgzjsxrlvmmehppunqsotllyoqx'
- ClassName: 'daomsbgexhsflhvxvzzeifkdtufyu' WindowName: 'xwkpzsqujtnfmgwvxpyjtezci'
- ClassName: 'kcqrnotdpvxxzrvhkptsfvhmbfcvq' WindowName: 'jbawxcjoqvhegzxwvqjogmxsxgvg'
- ClassName: 'ttocdwfvjiwhxekfwmk' WindowName: 'qhpokmpwjbwqjqgcdlylpijoqz'
- ClassName: 'obbywfxrncgmuglgxbhvuabt' WindowName: 'yvemxzgmnqhonmlmawpxroujtfaaxzxey'
- ClassName: 'xgmlcahoaxqrfjqyggmgfamzzckefxee' WindowName: 'kmfguqljehgtacfrrippuvovihl'
- ClassName: 'atjqpwaupgwdsnohdyvymfpjewhbhbzpeggtil' WindowName: 'udtblnauvvalfkw'
- ClassName: 'ynjrwutjakfhvtp' WindowName: 'hrpawobqxdqualjpjsgb'
- ClassName: 'srrbcuvfqlwlenctxjopzoirpavvwz' WindowName: 'rmbuhykyirvpldsjjkml'
- ClassName: 'jzgweuzdtioyfatpxavls' WindowName: 'lmikuebrgovuwxoidefnq'
- ClassName: 'iqctbvbthqiwxwzbuzosoyjnbkjritbkjnb' WindowName: 'vabxkyyqrygiopiawychejcwlynmzjyc'
