Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\NSISdl.dll
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\NSISdl.dll
- %TEMP%\nsm2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'pcfkujvurugnoksjsbhbuivthfydwrnneypr' WindowName: 'sumrvqvbmixjfvkjrnuhpouzdsvxakbbjiin'
- ClassName: 'sxqwiwagtwvwfciyhswcs' WindowName: 'hfnjlpypqlmlaswarqdcbhiw'
- ClassName: 'viqprsbnhtgykxkmkzrbprlpgmnddopwj' WindowName: 'axinbgcucnczkfooktxxluipdxfr'
- ClassName: 'siqjfbyewmaktrrvixzunnhvpuadmnaynzr' WindowName: 'kvxnqsiwsocikfsvjrfauwudqiztppohnh'
- ClassName: 'wrwnipgjowyudrjfrjpwakrag' WindowName: 'cvelygbmpofodcrdivrgyagdnwnh'
- ClassName: 'gatcdathoxcvyzarvmkdsmd' WindowName: 'qolfpcvunodniphebmg'
- ClassName: 'ufhqoxzofumkgfsladdegkvvaumlg' WindowName: 'lsfpsakzratopnrtrolswro'
- ClassName: 'ghldtlifhminmeqeogohzflnjkinxur' WindowName: 'xldygozrtgknbqmevt'
- ClassName: 'svukteekkoogzzxdokmearnxfezw' WindowName: 'cnqvcjqqcqkwbmuhfhipitpsnm'
- ClassName: 'avdiyeeaxxgqwgkjvcgsbunrznslytkmwjai' WindowName: 'ogeieocafnmbkjyq'
- ClassName: 'makzozjyouwnwybhtxuqrdlmicgvud' WindowName: 'wplwfvtidgjguykuritiwh'
- ClassName: 'qgnlmscktqzcantfw' WindowName: 'giapxxgicgmjhlgsftrxfoawrzjzrzaymffhcvk'
- ClassName: 'dtklblebaperzrgpqefkpwrwqifzxbesb' WindowName: 'nazwehzplsenhmtkijmcpagqobntnysldcndz'
- ClassName: 'ursgnszqkcpmoqtfnuhwloravwvglofwuxvxw' WindowName: 'cpukeuhfxpqyzgmtetdywlnewcix'
- ClassName: 'mglmqjpaqtkvaidvlqztfyvfvpvobbkphrv' WindowName: 'gdntlafoqnvdjhdfji'
- ClassName: 'phraouvoougfbdhyhtwahfxrzgmy' WindowName: 'ynqvakvribnrsbjydzjmpdnedlopujflahnbbix'
- ClassName: 'lmizeydcjxefgeuqwznehkmhr' WindowName: 'ohahirgrkhftocvcodnbwgyhnzdrugpzooyxgxs'
- ClassName: 'bgqfintzbnxonhdlo' WindowName: 'mjqzrkzxmxneoiknkjcgvzazawuyescuufutyy'
- ClassName: 'trihkwlcfbqeoitktbruewojucqqellip' WindowName: 'hagneonyivlodyrnswtigipxo'
- ClassName: 'vnucqoebguzqpbgiciphkbqbicf' WindowName: 'iwahohtapptlqospwcnxjpcdgqhlqsbaju'
- ClassName: 'oyfvbjpkfromfazjqjdyb' WindowName: 'oehmrlbnnsnbpwinf'
- ClassName: 'llsubolmkilglwaspumscssktipdpybkzsr' WindowName: 'ioeeqllhgkstuispqystirlcy'
- ClassName: 'umcfqeqebrwwupqpdzskrpxxxxqnrtpxc' WindowName: 'yhtjapuhlgdgxrctmkghdot'
- ClassName: 'erbpsiwuubahafkknjwerstazvly' WindowName: 'udgtmgbtpdjjgvffylukmgm'
- ClassName: 'kgxfodlajknmjnwzboygrlpg' WindowName: 'wwleenwjvddruzycetyxmiwwprpulsydpzconwi'
- ClassName: 'skarbrzksvkrcmovwtzqar' WindowName: 'lxdtuqnszqhddwucumpnuayxxxae'
- ClassName: 'ckmtbuniqhqbffbxmtttdexptsxpayb' WindowName: 'eygaaakyefbgygsanibddaomfoblxq'
- ClassName: 'catgzhhirvjtoejrwbumwzahhq' WindowName: 'lkexaxmrgknitmhurskhfngmcbwxjdkks'
- ClassName: 'hcjyelmfuftcmjbkkyuijlyngfwbjcmrappuf' WindowName: 'rrkczqequzvdasttgf'
- ClassName: 'rshffjexmgencxnbbygeqadkvrkvzmat' WindowName: 'bejirxmfwpdqgsuvcclqvv'
- ClassName: 'jywwwzjgvwzzbamprofd' WindowName: 'cezouudtzhjewcfdowponfzcottep'
- ClassName: 'fkghigtedogbswo' WindowName: 'rqbadfppyghdxed'
- ClassName: 'vhofkscyqcwdunzdsjrljzeofxoccdoctvws' WindowName: 'mkukyfdnhsudbmroarvpofwiw'
- ClassName: 'itqiudfniomjzkmfpoagdyexviduwbn' WindowName: 'iotkijrqehbfdnjn'
- ClassName: 'cgjpwwysqlmrkqahxvbxghpvdack' WindowName: 'sudnyujzzsmdaecpupm'
- ClassName: 'vlqssnjpjqvzcwidned' WindowName: 'ggtrqpjwubglwzleyjakvmbnqtpntd'
- ClassName: 'cipejggmrcvbfhmaebypmntsqgbmhbmjupptti' WindowName: 'bwckwixavhadqyjyx'
- ClassName: 'owypngbiiqzggmeiqcpilfc' WindowName: 'bwoofddylklmzbp'
- ClassName: 'ilptbhixmshvmyexnjvprnmmtmuaxpno' WindowName: 'tgfilfdwsmebgpgisbrnnyjocuvoecfbsbhv'
