Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\NSISdl.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\NSISdl.dll
- %TEMP%\nsz2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'tlpczkwbbfxlycqqwgyalrdeox' WindowName: 'tmfkkcaejkkpiwamhwynsjyakgm'
- ClassName: 'ialhkdllzitpbkieutqiucwchmjilnt' WindowName: 'lneujejwdghfutvdrvfxsx'
- ClassName: 'xkcwipykctvozeyttsvobrihw' WindowName: 'pvwwlhcznyntgquhrcexmujquhjutuokxvmpr'
- ClassName: 'iaidtfrauxxftyostfvmskrdmsdxs' WindowName: 'ksdhrggjpxovstccxsonct'
- ClassName: 'slxwhchafkjbtarucufbuye' WindowName: 'fgtgkhnwkuruaqupjojtctem'
- ClassName: 'brytqukvgxyuvxynawjaibyreal' WindowName: 'nmwhsfdimrdwdsubplkfril'
- ClassName: 'yoiclyozlwmytlewvzhaxgpx' WindowName: 'clvzrqmnnxcwfagkjtp'
- ClassName: 'ligckmioyvurqbqwhwodorpyqboncbl' WindowName: 'hxuytotryiyxrcmgjofidhnbye'
- ClassName: 'yulzpgkhjsfsgjgumbxcnlrhzcauqbmgbxaq' WindowName: 'hiukbikbuwyjvlzqscz'
- ClassName: 'gluzjhcgbzgecfovu' WindowName: 'ovxmvlhjuotkgylwgrspeoqaaouhi'
- ClassName: 'ymkluysbcflwmvrpxp' WindowName: 'zrroudetxhnmcmptvkotbyooleloerbug'
- ClassName: 'xtpzqrjvgljksnmlgpph' WindowName: 'kuaiicvmadqlqqcgrml'
- ClassName: 'yjliznkyhzfziuvlqwvh' WindowName: 'seuldcyozqtgclgn'
- ClassName: 'ofenqwkrshapecmiujbhphcnogb' WindowName: 'tojaxmxwuotirwtrpfkyveycenfvecfmgylhr'
- ClassName: 'aikggjsznqgrqmnbfhlcsekgmwim' WindowName: 'drazlxkwvnslceipfdvf'
- ClassName: 'ejnmvpehbhlmkbgpewbkarie' WindowName: 'qwvlvyjyunjthoestmyoot'
- ClassName: 'nfivzcdhaxrdeonz' WindowName: 'nwrvidgfyfxhvesp'
- ClassName: 'csoiwzyulnqjmwwpvsyiwkucamy' WindowName: 'lfopbfchzqjipzbjiyvnvsjrnpwtsfbe'
- ClassName: 'mbcpjzenrfnepmyekanijxtmeqkrjcme' WindowName: 'lcjcplrdfqngpfoykzzzsafbebxbgakusd'
- ClassName: 'nttqcwlhryffpdwo' WindowName: 'ukquhjatgxyfdomomnagoooubzioic'
- ClassName: 'abnfdguftsbatrefpdvnlvcnyff' WindowName: 'rvjlkmzlkhvrgwfistgfyykcanwfhccndcuer'
- ClassName: 'vyywuzjatkykaffuszvvorkmv' WindowName: 'tzbdhpyqhuvnijgwlnrvyiqqwziwvh'
- ClassName: 'liwkgydxftaismvguvrrnn' WindowName: 'qmtrqstuddekevq'
- ClassName: 'niocqwuphirevvpbrjkhpd' WindowName: 'puwtbrgzotulpshiohmzbgxompkayvowtckjm'
- ClassName: 'cnkhmhxezufnqqvbjmdevyreguxgrhlzcqgk' WindowName: 'hfrzytbvgvxptmfltkxeklhnavfczaijvxbln'
- ClassName: 'vhrbcvxtfbamplgroipxnuegdm' WindowName: 'qtjuyxtwuolqgsmvbbo'
- ClassName: 'itkcfzuyyvmnykzs' WindowName: 'sabjaxrbixjvcwjfsclat'
- ClassName: 'jgxtjxcyqctbyepgppwntqittpd' WindowName: 'yxwkkyvvsyxtfkneowyluo'
- ClassName: 'ztgujibinxayjbvjqgbnurrhsjjuenfy' WindowName: 'pyxtpgrelwcqpzynnbilxlw'
- ClassName: 'rmvifngxptjzpqzvqihlwfyogjwvievcn' WindowName: 'azirjiiyvnjktpguufztijxnkpdsjnw'
- ClassName: 'cbrbrlncymtcqcmgzxtuerpkzgmbbz' WindowName: 'jtccvwcwsuuzmff'
- ClassName: 'jedvqgbpuqehtcqkwwcibarpwytb' WindowName: 'kroikyaqxpobgowi'
- ClassName: 'fsqgiuplmtsywlerncmooesyqwgv' WindowName: 'dgrtfjhkfhjgrwozwoyuqmmzsydkboulcnio'
- ClassName: 'tiybzuqfaqmdnvwdmomqzbshy' WindowName: 'qnhycqcelxwrcuavbuluf'
- ClassName: 'suqbynbkkwttwpzrvylotbsvsnriskfozyybpny' WindowName: 'jjeqifksqkaisgntuiccytdffocxlx'
- ClassName: 'qefhirobvqqqcfcxhveepfgzfgltvbvdnlugw' WindowName: 'cxkujaxhxsbaqavlxnydzovyfexbypqf'
- ClassName: 'ksfgkrykqkenxcgxrefpokrxgdvadtyjlys' WindowName: 'ihliqicwwyevqbplextkusdjxlwhjyhg'
- ClassName: 'nxkikpnbqaxfuogvohhwugfnbxoivshddaasto' WindowName: 'jttehyrayzkrlachbqeoihfwgxrikkgnqyrerz'
