Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'qsgquxitmpgseqefztcvpwhkipptytvtt' WindowName: 'stfhjwfmcfghxgtkjnaxiwj'
- ClassName: 'jqmxzidhkoviakwtetot' WindowName: 'atatgbrtglkypkrwijhlwrbtejtguarfgsgapaj'
- ClassName: 'cadoakwsgtearxbynyluabgugfkdonmx' WindowName: 'klhopbfplmwxojkhklsykczcoahseuey'
- ClassName: 'fhukxdyuijbxtvdkrcxibpedjjpwcbkgtbsyuom' WindowName: 'kzchktcabjwrtspseizcfod'
- ClassName: 'syxjzuabtxkaslmtvcrinzhquzujotywe' WindowName: 'ssewikgtgztzknhrxyihxrwkesf'
- ClassName: 'etjpavmnlsltjbxsolnzpd' WindowName: 'bpspubhrqcohnefkkffhzscwpwcxcxxakem'
- ClassName: 'tpubwpmdrmrpjyrlmtqmicebwvlqn' WindowName: 'jsukvuluzmiasehxvk'
- ClassName: 'lyfpzgyfypyrrxicxdsqkptkkrfzfohwj' WindowName: 'gahbwjldlqhpzknakwjqeqgrdxwqkmcr'
- ClassName: 'kfdmzndllraaiwnfqrtdiwnuzoprzrbtvh' WindowName: 'qhyaixdvlwdkdavwqbbjcqnw'
- ClassName: 'yvobhawjiepultxri' WindowName: 'rdcxuohbkqdosckpgklrwatizxqiaqymznjc'
- ClassName: 'hcrakvystffpvycecveekehbqmfbihkmdz' WindowName: 'bazawpmuzihgscpqlcyteukojizujsvljzbgu'
- ClassName: 'drzepvxxwibijurdh' WindowName: 'krklmiqppbietuwujdcaslqubplqujnmjscjij'
- ClassName: 'lloelefwflfqcwocwkaocohjhuh' WindowName: 'wrdfvetgjgxyrhbtsutwcdc'
- ClassName: 'sidwxwuyqlvgazdmkq' WindowName: 'nwhovafrozjwsenrcyoriokilccntuscz'
- ClassName: 'ekcrbggvnlcgjakrqffwbel' WindowName: 'zebfhwxhnrtvczvuyuymsekzvyrlrkwpyho'
- ClassName: 'jhkdqprrlvuwxzlhmjvqoiphvhunfisauumuw' WindowName: 'ejjjvsxoqppxzvuxlgcemzcxveudysocaleo'
- ClassName: 'bohvygpzhrhbpuejcznhlfeoc' WindowName: 'otyftjlqizuyshndakdew'
- ClassName: 'tuqgjjwwmlncqoexojeltgkgjr' WindowName: 'hzzyenwjldbywsyzhitwcztww'
- ClassName: 'nyqohrhapiyfedtfy' WindowName: 'cztyqlecxxwgqcjop'
- ClassName: 'dmlrulqjivevrnjznc' WindowName: 'ucdoefcwyalkmxvecx'
- ClassName: 'obfbnlqkklejmwcu' WindowName: 'wyhhkqqugptsoeljtbwaxuzlozyxdm'
- ClassName: 'fxftwecbwhuudxgowwmvqewnninzunaqvm' WindowName: 'qrzbdlhpaufqtnimb'
- ClassName: 'hlusqlwpylbssdoawjksbo' WindowName: 'awneyfmadbwjdmzyul'
- ClassName: 'odojbhzqlmfapwvgvhgmenprnnkghjvcza' WindowName: 'uocgxebmfngeezstrprtneapnblme'
- ClassName: 'wzqyaqiipfgqtidjtb' WindowName: 'grockknsebfebhmsjkwtxrpyzgqnulorbivy'
- ClassName: 'cedjdepepfucbosvykotfychcutwhaxytyxvwdp' WindowName: 'hgprljswvywirevloidkicposfvxsdv'
- ClassName: 'rgstmwotjwcqfnxpcjadognrroy' WindowName: 'ibyjyoqdfzsgyvadlhcrfxrdffszxdttdmlmkco'
- ClassName: 'gfjdbdygghftowijyhnwepnvrmrbw' WindowName: 'urpgwjznmmneuwxjmppwzbrh'
- ClassName: 'hhrqpcazsjabakjzbmxrvmadjjj' WindowName: 'oauebfmlrxluxlzjbeyflciwpkhuitg'
- ClassName: 'mydozuynklsjskivpz' WindowName: 'htmitaudoquzkaftguekfvntjghvjolf'
- ClassName: 'wgrgpbgdfgcremkcqatdlqaqbolde' WindowName: 'catiugnglsngdooyr'
- ClassName: 'jdctunrbcbdxhjbmzchqovlyovccktyvmogwyx' WindowName: 'docgknlrnjztgglcqx'
- ClassName: 'ahvwwerswnhcklmoabkuelmifz' WindowName: 'tmtxutedfsybpljtarllvzalfpgpdtgt'
- ClassName: 'ghjbhalxnoayixvs' WindowName: 'fjrztkncqcfmiyhrwb'
- ClassName: 'yrbrurcbbzheplmygpyor' WindowName: 'cahwwicpskgksbgrsgytwijbbepyu'
- ClassName: 'qrfaiwyhtuxabnqfhumockttjwtzuwuytpzjm' WindowName: 'xbytkffljjzrmrazlmagtomtofwfvnpgxzcj'
- ClassName: 'angtoecughpplvslexqm' WindowName: 'zsycpajjndmvvxfdnloxnfgtuyvkumkrmbwhm'
- ClassName: 'wklnbshbzftvyuhltrwgjttblyfioeis' WindowName: 'rgiuipfvyqmedhjabvax'
- ClassName: 'pobgiaflxdgsmbqilpbzbcmptitsp' WindowName: 'awiwxxyfknppavogqhfwsmkaupwtcqzdmhagmq'
