Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kxpxzrpowdvnambcomhjwlobimoz' WindowName: 'wpmeorjrjvuuwqooiwwkocrwp'
- ClassName: 'qbmmoxypzpuzixielkysejamnsie' WindowName: 'hsjaxuumxzekcgurrguldwdgcaadhoolnqsykrl'
- ClassName: 'nbborkjgjelrqeniieldtwiqhmgdzhsng' WindowName: 'mwnptinvsaziyhmcvavy'
- ClassName: 'rpsfcfamkotgrfnpgooyeexvdpfocogy' WindowName: 'nmgvxolsaitallmcqbdgandcqacpbldxoui'
- ClassName: 'sjfnyczqfbonvvviudyfwcoqesnqzmswooa' WindowName: 'ebdzqwpcuwjunmxtxgjpbfanpxux'
- ClassName: 'awziyiqhmlskmqrvffdgnfzsmxaourzimykynp' WindowName: 'bklcufzyjwvwkrwfttrvzkcaxyxbwjvzubo'
- ClassName: 'psahdusodsxozdicuomznm' WindowName: 'gnzhyzyrtplebctazcwtnb'
- ClassName: 'usbskrgxotpnmrbt' WindowName: 'mpijculmttwwtsefbceyjghhxsvvgxkxi'
- ClassName: 'dkkscqddmqnfdheydf' WindowName: 'jweihrrqofffeffgss'
- ClassName: 'cwxomrzzhddnsqauvu' WindowName: 'mtizdjedbgzoazueswfr'
- ClassName: 'tvvxkijdipdpnptygqpnasdfrrulsjx' WindowName: 'rdflmjxgyxcgjwlqwpfqejpkzsyirqiskwgbfhy'
- ClassName: 'yywggbimkbdxxtvnhcveoyfnkrffm' WindowName: 'cldmdeukzjkoqzveoikcm'
- ClassName: 'rbvayqvdenjcxiyvfbm' WindowName: 'qifhvnlgqkziyztfe'
- ClassName: 'rtqxgdmbominxlqyqh' WindowName: 'kikohlgdoknuhruvv'
- ClassName: 'qfrhjjfbkzkbaryylsglbonohvrskoowvkxiwvl' WindowName: 'ezbvmpnfuvvosktpohxz'
- ClassName: 'rawmherunrwammoyzxhgyyigqidrcmrtutp' WindowName: 'ibxezbrneeqhiwrilt'
- ClassName: 'jmddomydwzhodxexf' WindowName: 'ezyrcdoxfhudxekrkdvzyuomcvcpa'
- ClassName: 'uyeepkaegouafophtvliiuszrfv' WindowName: 'iyuzlvggzxbtuzxltfojnwbndmriytoeb'
- ClassName: 'qnrbgwjauqqhvjhgxgnzrkimiofj' WindowName: 'vaeidrehjzcjuhmjhzjlnhqrnsxbmojwko'
- ClassName: 'ddpizseamwfjvgzmpb' WindowName: 'laqguffuesbybcmihvpztbsygikoitltd'
- ClassName: 'rxnasjjltsavberipbtwodyjcsk' WindowName: 'zjxgowtdzxvhjowuoryjyicjdp'
- ClassName: 'swuqjieixqdvezjcobdlccnavcdkq' WindowName: 'forcqylyxonkwootfwvusaa'
- ClassName: 'jbfqzqtcnrtdiffgyxvxiqrxfurjetbygeojdj' WindowName: 'wduhzifdyvsezfa'
- ClassName: 'cohndtusgyhhwsaxqfnorphlsiwk' WindowName: 'vcwyikydcbnadgs'
- ClassName: 'xewdjqevuunnynohzkksfjaxipoxymrhuubctm' WindowName: 'wtpstipaejdqaxiwerwzdihgmkwrc'
- ClassName: 'jxrrcibtaoejptvqg' WindowName: 'qigfsdxbfcuneqqyszoyofujy'
- ClassName: 'mvkmzyucrugzgzszxxmtgeirqrdcrhxojop' WindowName: 'xcfocexfljofmligmqphvo'
- ClassName: 'sktgzsnvbuisxgpmszrihjubngcgoaszn' WindowName: 'ikazfclkltfusrezf'
- ClassName: 'ittcklkufzeryszdvarglzc' WindowName: 'imndsrbhpimqjhncjxhztrpticcemfrpxg'
- ClassName: 'covhjdvjkvwllpdjyry' WindowName: 'zczmpwjxotoyfnirpzrulmlboxgpelzxskso'
- ClassName: 'uqamovlnztrsrmyruczrdwszf' WindowName: 'olfueblxtsuvcjhawkmuuyh'
- ClassName: 'ociytebdnfhmyheglawzmuqdnoapncs' WindowName: 'tlwxzujzkhwwhcp'
- ClassName: 'waimatptofnfofmhqjypdyrg' WindowName: 'uabfgjvvleziurxnu'
- ClassName: 'blrwegflymcokoenxxokutkfxxzeojaufqarymm' WindowName: 'qjoujahskcfaxtgfgoorzns'
- ClassName: 'sznkhgyxcgkxqxvsowimxsljieshqtjuvb' WindowName: 'udgsnnyiwbjptvnrficfas'
- ClassName: 'fgioavlgcmmxjgvgaijnnpymgtpyk' WindowName: 'curaawegbqpzmdb'
- ClassName: 'xdhdeptxbpkqlndtqsvffscxldhimkcknirf' WindowName: 'cyndrybokdqmwxdxyanztlttzav'
- ClassName: 'punicyfazrjfzzsfmxbuz' WindowName: 'aonyypgllcjogbyivdjqmlckudvpipzliomohuc'
- ClassName: 'qksrplplcpevpmrlnpggywspncizijvyfs' WindowName: 'ehfjnbcktntlpssrnjd'
- ClassName: 'vvtkscquzmzsrowetqbm' WindowName: 'yqowqvzchvucrqc'
