Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\InetLoad.dll
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\InetLoad.dll
- %TEMP%\nsp2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jtyqlvovkygttivucpzarvardsfcvis' WindowName: 'gcgefbqxkgrfiszzgfxriyauxlvtwvaivacd'
- ClassName: 'anlemciqccvsuvyjxllqtrwlrejabntzjtaxnd' WindowName: 'pdimdqyvotqlunvimkwded'
- ClassName: 'cjhyhvqysnadyguwovjqbvyffgiqgpzs' WindowName: 'wuwzpukdwxizyaifbqchkzfbiduqefvdu'
- ClassName: 'gvbtilfndyzofwpzdpuehtzyjftvzrkoy' WindowName: 'txldlmmyewpbvucuioxzxjkkvd'
- ClassName: 'kgdnjshfbxqryynmjadhnmqg' WindowName: 'sohhshmyhbmftjyxlprelrtinjsgtpmnrb'
- ClassName: 'ztytvdzpsropklfzfpttiexwwvaezmboe' WindowName: 'uvmbsxwxwcrhcwum'
- ClassName: 'ywreahohitinrwtfclryyahqgjmwy' WindowName: 'olcsfxqwbaaqpxkutbmvkgxliqmqiylyebvuw'
- ClassName: 'zpmkccelwksdgqbxrmpfbkgfbkxaboyufpickej' WindowName: 'foztfqlobhrwhijepsdphsuzglyjzidlkblrxdj'
- ClassName: 'esimqxqaggjiblgcfgddzollvqmqybughwghkoi' WindowName: 'bjhxekxycgpwwsxbgomfiby'
- ClassName: 'phelikaqwgxlwipbfijkbewqn' WindowName: 'fklkevbijvuqlzpphsbioasgmyglqr'
- ClassName: 'ltqtlnrtpwilgbieurtxgkdqmwm' WindowName: 'osvmxwntxgionqcsmyttuzvmavmoxea'
- ClassName: 'uesfupxatiykthuvnctulnugkhz' WindowName: 'yzeyypvtispogdionpzdrwn'
- ClassName: 'uwcdhlvjdkluiyxrrtijirajxzhjfbqpscshxnb' WindowName: 'yxxcdglmaayjugbigphokfxi'
- ClassName: 'txhtuykuuuoaaxerwjzyfcafoowobde' WindowName: 'ffdnsbcpubqxrdvmnlbgizmv'
- ClassName: 'omzzmppcudrleikzrqwfhruobkoc' WindowName: 'vhpbpuzfesqrfogmbanosvwhrt'
- ClassName: 'ntwnxoahmvdyvevarpuviomfxwhqkvmk' WindowName: 'yjdyfuttmrqjomf'
- ClassName: 'vnyfztxohvkqdoetidenzykyzqgbfqu' WindowName: 'jviwkgrmavbddtjgvrvzochnbtvraaj'
- ClassName: 'agrjxamuymkjlahiefhd' WindowName: 'caboifqqcmlpcvxhpmzosespabtzjifp'
- ClassName: 'szyosnzhgaqucihabspskoesaiqzzqx' WindowName: 'stebrvktmfacplljtpaj'
- ClassName: 'ekbthdcwsrhjdquqobbrplgehpujizoptikbek' WindowName: 'xbzbmmwlnyisqqwqjahaqtflezwxodywceasxa'
- ClassName: 'jklhlhzjoquaeyryn' WindowName: 'bmkpkkrtbrzwaepgmrpjidaboxtxcuv'
- ClassName: 'scomuypatfmvfbno' WindowName: 'zkjoygvnxbcgefitgsfedyz'
- ClassName: 'wexafotwhondqtfzevmkrcterfexswdam' WindowName: 'xjlemyhkupqpxcgctqahrhpfnsc'
- ClassName: 'orrbvtzxwrhwstzidoqzy' WindowName: 'hcvxgimalszidlcxagpgnzpmhgxnbgxe'
- ClassName: 'vmamrkztwhprwugnlsexh' WindowName: 'hyqisdrkvnjejnvqzpaoqujgpoyzfvs'
- ClassName: 'shlghusgteosnsubjaqxz' WindowName: 'ftxfrqaupsjyjbhttqgmvpomomagunfbqazw'
- ClassName: 'ylmubqdzcuxkshpijxzszprilcljcfeid' WindowName: 'kmntgalgjphpyxfuugdqtaszucpcreb'
- ClassName: 'zjjxnvdmdicoveluqqbpwexipbnahytrjdgmbod' WindowName: 'atmtkioimlscqauadqseckimarnczeqcqpoyrjk'
- ClassName: 'cjpdtiuxfpfwvxdoxkykdw' WindowName: 'agjfexzxfouwzlocopdrzlptiqwkgbogcd'
- ClassName: 'mgnyfvvdzdeijkohyfmvwzrmjzbf' WindowName: 'zvrkowcnqsupqltogytvjxftxnzbivge'
- ClassName: 'gpvagtakjvuyaqodpwuxclxvposwrjiyua' WindowName: 'suxcuiouclivjnesiurwt'
- ClassName: 'ejboerqhnbwrjeckmnecxbxyzvxodchpnoog' WindowName: 'ukgffnatwxurriyrtbmv'
- ClassName: 'spjoqwxogastvuqobqiup' WindowName: 'qzptltaehtvuidktglubyyzudqozpyit'
- ClassName: 'sgvaidjyvgmgwmbvylsovkwwgpjrlzneuf' WindowName: 'scyumgqzrpwhbelrvdcqnhowjdwxegtwpv'
- ClassName: 'zadceizcjehjcpzckgsyfuyqmomqfni' WindowName: 'jnstgoedodnmvkirmlukldrsbsieuiejzjuu'
- ClassName: 'oxxvnfpkepubohokqetukqgb' WindowName: 'nfggvinedfpqiblatmfsslcpratnyptokundtj'
- ClassName: 'gdbcsclikfibziovaglgdf' WindowName: 'nonetecepxwasrdcoojdcrhghtqswdphs'
- ClassName: 'wxpmxevatwilsqmmzslsm' WindowName: 'cgtvwgsjrebqsubjafcj'
- ClassName: 'dxkyizvllyifvdohakzccdzcyk' WindowName: 'aiwcbzdqvavxyidut'
- ClassName: 'pwttdnbtilysbvodqepx' WindowName: 'gsaksrbiwnqwyoaxaza'
- ClassName: 'sbtqbrodkvuvhwlzahbkfbzhjcwdqacm' WindowName: 'fnnodnjewhmbuallcfrapjqpawbzm'
- ClassName: 'qvjglbxytquylqeuhdiqejma' WindowName: 'xzrwaeveesqouqyqtecowbbgvwtq'
- ClassName: 'jvvrmankeprxeuoopy' WindowName: 'xahnlieyozsjvep'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
