Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'vcmtyeadzlwobmjlheygooavpc' WindowName: 'eoejnxybmweirxgbkqaijcn'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\Math.dll
- %TEMP%\nsa2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'phlztxhdwgxjspsrjlujzjfc' WindowName: 'hxbletmdwyzhaiac'
- ClassName: 'pgdiufzihnqkrfwtfkkpyxt' WindowName: 'vssdiavqmofyvqtyjqmrhrpxrnrclmuf'
- ClassName: 'dxcfexqmdjpgoennysbtx' WindowName: 'odblenveajrdnfejerewwdlhsbkjyheq'
- ClassName: 'niqytcbitqidlfekchrrwrqaeazbhuyetfow' WindowName: 'cduyysmfesfgfzlsppuvxd'
- ClassName: 'ftlebizrqmbgibrhwmejivchftljxjndr' WindowName: 'bqilhqgwigoufzjdlnrrybfpcomqrefjiksnqx'
- ClassName: 'jekenzxyidvjxhyquitjypyrkspcs' WindowName: 'oiiftxpvlkjlsniimiwzyqjpmvuv'
- ClassName: 'kyeeafytnlbcmxxubq' WindowName: 'ixkajajshgrdwfidubpcjmmiexrkxtz'
- ClassName: 'uqdyszxomzmikrogczcewffcjxwbaubi' WindowName: 'zvxmynzytevrvkuxzoz'
- ClassName: 'zvufhohegiacoynkprdnpokvfbm' WindowName: 'prgsnhczrhhfvpdcfcebwjjjqj'
- ClassName: 'vhirpkdoybvulzjojfihkwfjfxwnbkw' WindowName: 'cxkwqldswrdnxyapfdjxibrqikdicksoc'
- ClassName: 'soicjwgwjfcrbmuehnxutmxpfkupbr' WindowName: 'ooyfekatferclpyukiigiyg'
- ClassName: 'zqlajkjxgccnuik' WindowName: 'yjpyhculcvhlpnbkcikq'
- ClassName: 'dvogbkzspuersdwexhaurnbzqmi' WindowName: 'ggwfipssbzcbtvfohf'
- ClassName: 'hpwfyowdntsekrmrnuqtvqpsvekdvsazuneiomt' WindowName: 'qnlttyebgyufeaadphhezmlkqjhazecsomwikjl'
- ClassName: 'iushohanfcswuekkdphlmbcqziejmhjsoumz' WindowName: 'tiwuxnazbtungedftavqmlzdivezngmuydrsh'
- ClassName: 'owawosqwebkefgeeuqzq' WindowName: 'efhyowyzvgkbkjjcssu'
- ClassName: 'lyaofqouxamdgknshhrepzrlrmvpdpgz' WindowName: 'dsmvdyoubyorsuyzhajkqcnyw'
- ClassName: 'jwlosbjgnfvecyvikmmioiwijs' WindowName: 'svbetbzvqrezssdfxmg'
- ClassName: 'vtoyrmbhgbexmpjvcxqgxjdmpkgswwqtxhb' WindowName: 'onmgzykqvhnycjgmxjbtkalsjioety'
- ClassName: 'hcjrkdvbgkedatqttwtanxieykdyfspmazwg' WindowName: 'efiguefurefrjlgkuqcpxfjvcpbzoymwcla'
- ClassName: 'pplsrdpumfqqhswhhhh' WindowName: 'xaytitpyzjzclgzwcqfaalppj'
- ClassName: 'qohlgxfdzzkoyoqyr' WindowName: 'mqquvbjfmhjhvrjwfpjzqrnuemipa'
- ClassName: 'clqffrvijynfrhjdugtgtpsmjghtnquo' WindowName: 'idztnkwznoensrgczvbwdepekrbwjybyrvz'
- ClassName: 'vgqwttrcktczoltzgxzpvcqhnuhvkrqazrvr' WindowName: 'wmyuqervnjqcceaqzlhhsufw'
- ClassName: 'sffwcssxagvthcffehkwsdhzgj' WindowName: 'cgjcmzwabvchyjtebuddjgnauskjjfwehbli'
- ClassName: 'xibbwjictoskesipqjfjzktqbm' WindowName: 'gafjebfwljkkgudogtwgs'
- ClassName: 'phluycqcqmfomrukfnnpaswxxlaawmdtyzim' WindowName: 'dgnpawrbbpqizrpbuennckmpwdtokkahovpqlvr'
- ClassName: 'whocitikivqrsuqmsw' WindowName: 'ajqtllpddibroizdpqsvsdwwlnvxsiiwdhe'
- ClassName: 'rdxemhzjrjwbtaldd' WindowName: 'mwrmqyuxybtggtevrkpzrqunctgwlucvor'
- ClassName: 'vnfnhalyyadwzafb' WindowName: 'wnzdltenxzjxucvszrcuaewjbn'
- ClassName: 'yrlqhteveqerglofzpko' WindowName: 'pljupxodtepkvsfkyjdxnwigupdl'
- ClassName: 'ekuidwrmvktwxodxijuoioamxdmhkish' WindowName: 'bmhiahtwzjxbzjp'
- ClassName: 'torbrprlmwljmihvrvabrbtngjhtggie' WindowName: 'doicdilyayhmjgbrillcmjjoraqua'
- ClassName: 'locpvtzaiykzkceigjvkuwtpbdjgtbdyelcpm' WindowName: 'nytbietqwcjphpiwccvgxisgoiildafeciwkg'
- ClassName: 'lubuhpbiebtkhakhtkstu' WindowName: 'vkdeovsqahkdjoclrxselcrveuimfrlvjry'
- ClassName: 'jksjtkgwhbjxbjohgtbglqwksdlzlaqoxu' WindowName: 'vvylmvxmathynfqudrbepsobnquney'
- ClassName: 'zqjqzosazogzhmjvotq' WindowName: 'loarycalurarypcoc'
- ClassName: 'dmiiywhmbgstetwjpcofcaoxsxfjzjyr' WindowName: 'wtmlvarzskjmrvuhbb'
