Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsr2.tmp\NSISdl.dll
- %TEMP%\nsr2.tmp\Math.dll
- %TEMP%\nsr2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\NSISdl.dll
- %TEMP%\nsr2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'suedjpbksoykqbwz' WindowName: 'gbyzqpansxlwjuyzhadda'
- ClassName: 'tqowbxbbbzvqbypbqfnhewosl' WindowName: 'yteanmiwchpgrsqehcu'
- ClassName: 'ntvzxrkaxsnxilkvlbsdhdvqducnifunc' WindowName: 'itkvnmmwcelkxzqgql'
- ClassName: 'lkfuerixsjqzjuysdcdwjxhatc' WindowName: 'borycgusaxojprarr'
- ClassName: 'qywtinuexprtkru' WindowName: 'fjefmppajbafckklvkiwugculiystfo'
- ClassName: 'ypuxfahrnsndyukuwhglvlssimitbsjc' WindowName: 'oamfxeyhjrxhtsbqvnrgsofpalohrjg'
- ClassName: 'kpiceaesacxwnebdtgintkenyxrdwaxh' WindowName: 'qzxclzmwppqcojxluwoo'
- ClassName: 'sscpupqfzlmnmmuobiyawwus' WindowName: 'xfwxwqhaljiyizycbc'
- ClassName: 'nlwtpbmsghbibrczmueyabhavbmajkjzait' WindowName: 'vzgbtmdgupxqewyljnnzvswihk'
- ClassName: 'cjkewdtjfheaycjxnrggkpbnjjljmbc' WindowName: 'bdxlhnpdzuyaiccbicnevunhymunrbubm'
- ClassName: 'cvlazmseqibrkpcnvpmzpgid' WindowName: 'twvzzkwzjvioukopzylrzltapfptjy'
- ClassName: 'dubtjfrvrqgvsxhtfnnccmadhzjasnjom' WindowName: 'hragdpekgcbbusmqkwqygqjq'
- ClassName: 'cobwyijipjlfconaaeqrtbqvngbimurpfxqorjp' WindowName: 'ialhrfwghtigyabygyfmxbwzrzkjotphsk'
- ClassName: 'vhwqguimkgosoddfnwwmqskuahhzun' WindowName: 'rieutduqdxbvqctmmmyibnwqnft'
- ClassName: 'caljveeekwbjstdlmaqbvgioiyvgxicpv' WindowName: 'cnddcfflgmwuuqiofbtmtdakpiirfnqrtql'
- ClassName: 'gcclxnqabbwszts' WindowName: 'mhliaciuethgwynmbr'
- ClassName: 'xvbmrhezrhbkgjhuqqzbrrhsprilm' WindowName: 'gajngsquudwxlkeryozzqe'
- ClassName: 'rnkdqktptdemixlbmaiurepdberikhyc' WindowName: 'fnowznnqxnwmdbgycrtajbetqu'
- ClassName: 'kcfuylkuqkfkrhvjqpqzzw' WindowName: 'gtbixvsudllsdctosvsj'
- ClassName: 'remgynzbgfwfcvzuzxydpsrdolgkzepvkw' WindowName: 'jwoiixdapnjrmphgwdkhg'
- ClassName: 'slhrhvfqqtqruulcaygjuupppiz' WindowName: 'enbgdktuuapchfzjkiecplwkdaxgoga'
- ClassName: 'dydqqgcpezbpdexxamgs' WindowName: 'titnxjaaybxfjfggjsesnytipwfhcavyjk'
- ClassName: 'jccguvyjhdtjygrwwodttcpdewbsycrpdnqqbca' WindowName: 'tbfezdbgdwcobwb'
- ClassName: 'ezoczaknqywawwhw' WindowName: 'upwgqigdhefnwgday'
- ClassName: 'plfjkvrsodqxzzjx' WindowName: 'obyjmtimmnxekykounmz'
- ClassName: 'qhvqcprvnlylthabcohramgakaxjgpprf' WindowName: 'obqcvbnspliisejscwtbfa'
- ClassName: 'vuomzqvawctaqzbpzlwika' WindowName: 'zmmnizlqfzzmtozrswfpqhnjoitydgknfsfs'
- ClassName: 'eyjmonllxuysaiakocvcthqzosnvvdtyizepu' WindowName: 'hvbjkjmxlgozgbxzlfuiuscefsbzsamqsxk'
- ClassName: 'mrbbhbctabqstlmewyjylrqrlyjkxr' WindowName: 'fujjazdtmocjlitdasuvrqxg'
- ClassName: 'bxxpriubspatsywn' WindowName: 'hqmbdzgdgjpwarftvknusybumgtnd'
- ClassName: 'ixhotlkbtodckcplhsmhwiyivaudxirflnfcy' WindowName: 'vszgsljbenwqxkjjmmfvsmtobskktwt'
- ClassName: 'vyjwuzllduefokni' WindowName: 'ykatqabcyzlfodqxnbkdofoizvqrwfrrvzrqfnu'
- ClassName: 'njhrolaiflohauixolcbckeemurfxhxpvkm' WindowName: 'srewruiopxmmdtrzysjjmfvlaoxjflbqs'
- ClassName: 'xsuvmbwoowjrozkckmtiydli' WindowName: 'ctrrvbehxvrwkozkacykjvsqozrvqcucctlot'
- ClassName: 'dpukiijcjrgctokmfyrvs' WindowName: 'ldultnrysnmidjhfdxxemkekbnbiizgtzhl'
- ClassName: 'nkcrcnvmitbeingaspctriuvunceztgwmd' WindowName: 'hvncsqrhrhtdwvrhxu'
- ClassName: 'xogcsqbewpkdcrlohemmpcigbvbr' WindowName: 'ykzsoyalzjdypettlowkirxucbkeb'
