Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'acruaebfavpurqmwflgxibbc' WindowName: 'jbkawtbgkyuynhrrcioog'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsy2.tmp\InetLoad.dll
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\InetLoad.dll
- %TEMP%\nsy2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'nhqncveervzecxgarxvbclrtorcbj' WindowName: 'ixkgxnitfpffbkywdlunn'
- ClassName: 'toeeqbaezdmsqhvm' WindowName: 'aiwqagvnmmaaxekfhkemusjxtboaccvnnpkgkvd'
- ClassName: 'qynyfwbaaczvoyvfjblciqkx' WindowName: 'gdyereusuphewnwzvedyu'
- ClassName: 'aswboyvrgbvutlw' WindowName: 'gpmllmxooijvuutxhjresql'
- ClassName: 'rhcatpdbrchsdbsnpfqdqjyvcqxcwodnyyvugim' WindowName: 'chqvcwkcmcmiqnd'
- ClassName: 'xvrtrbjmddurjfqjdsntgrsngysxiljkqmcgp' WindowName: 'oqlatdigcnhfvisjxxdrncyodqp'
- ClassName: 'hlywdmxlcjaceodeqp' WindowName: 'izsyjlegtwldyimqgophuafvntysqt'
- ClassName: 'lzxjmfkixeqjomppqaa' WindowName: 'riosbgzwcodntifcyabufsxzs'
- ClassName: 'usbzzevgydlnivonveanbaelchtp' WindowName: 'zbebfmedzeouvotdrkhp'
- ClassName: 'yjnqmuxfukgujbsgrbfwdknhagedialatctkg' WindowName: 'qwolhfgnencjvkeqnzlh'
- ClassName: 'bxeovybvrdpcspidsyxmissn' WindowName: 'udhzsudslcvcqefmdolrwmfelpsbapcmnxohxf'
- ClassName: 'vmopxxdhrlknjryck' WindowName: 'qjnquhhnjrmiryyv'
- ClassName: 'jiccrluwfuksjobdeajxq' WindowName: 'barxlyxypsuvjawenyhcfzv'
- ClassName: 'sbulrzfvrebaeuauvufgjuxsfwfhnaeyoypjpy' WindowName: 'wiwtxzzpsnwafgogxzsazydvghmxun'
- ClassName: 'twcjodrvzaegxuuc' WindowName: 'hgwnlyxgsoigyziiijjkefbyd'
- ClassName: 'ayirgycwqrncfpbfkxzyipbhejxbxqaek' WindowName: 'vnqcswwipckpmfz'
- ClassName: 'mdvjgsjcgpyhgzanfbhmtxgjdopmb' WindowName: 'ojuttnvepgfrlwntrwymdkpqxcyio'
- ClassName: 'sqvjripitffzrrrjdeskkqhzxqotjibyr' WindowName: 'vbbsocydzgylekfimregckvyvfbr'
- ClassName: 'bktyjzfecyeaykjbkybspwrgar' WindowName: 'msbdxslnrwjltowovnpw'
- ClassName: 'pklkajphsirevhaxvabwkzdeey' WindowName: 'vsajiwysmycoafpwpgevoqbquxluaqkxyy'
- ClassName: 'esellfbzzkkfftipgqmg' WindowName: 'zwubwitsbrgcfzrxdobhotaxbr'
- ClassName: 'vcgjjueguazjumisfufqcxoqhl' WindowName: 'ggnqecryweovlwkn'
- ClassName: 'kbckkkmpdbsobkzjcdhdanzrbxomh' WindowName: 'mwbyvdftdkpwloqwygveawu'
- ClassName: 'jobgqefbasibjmzblyjmozntcx' WindowName: 'immgxahjdnsxiiktcadbbxikpsxvhwqyhgwwo'
- ClassName: 'xylfvhcuijhqxgqcmgvybevpserrbfwfg' WindowName: 'cvptrxorlakiarltppgrhympofbis'
- ClassName: 'fnmbfesssfziuiikrpztwosezj' WindowName: 'tniiuohvxxldizrnfyjedudgxtlssy'
- ClassName: 'aqmgyahizfpszwwhlgws' WindowName: 'jfprciggsmlfhwpqcdswtvofbf'
- ClassName: 'apjcumhjhqpkjjxzkvqah' WindowName: 'yqvngaxvyqhavlujwstgkbjjqtqhuk'
- ClassName: 'fonobtkhkqndknxjir' WindowName: 'arnrupkfbivyhaclmwpsqecwwvrhdkqamnu'
- ClassName: 'talscopfyufhbxysgclcstjbm' WindowName: 'paezkefyogkzgggua'
- ClassName: 'gzsugxkhdcgtenyozbgzoo' WindowName: 'tsjoremvlqpbvkqsf'
- ClassName: 'eimgrvdlsrupgurprzcyiea' WindowName: 'webjhtszduntedjohrgksucuqx'
- ClassName: 'aejiaitoaznxgujsjngvalrmbxyhgzxbccabnth' WindowName: 'hcdilazndknqsjvi'
- ClassName: 'mnlbtmqqwpkoeoieaqjlbvgkwwi' WindowName: 'omrdvhstebfcqwhnpgveqcmhyyjpjovmaibmljz'
- ClassName: 'cpbsdhmixqnjvbsfnjxjuofaf' WindowName: 'bapztfrspcdetgfscczocawsdnyr'
- ClassName: 'ijxklozsnjvyerebjykgbrcaqppgwzdcwwih' WindowName: 'qrolnavtleupdqvgkwfwcjtntudcvvuv'
- ClassName: 'fjzsaxvownvazuhbintsf' WindowName: 'rcpcvefrmmwmlysivazqmimqhvjeyzolxosihd'
- ClassName: 'qgxnmmotxqsoyzwf' WindowName: 'jcegmsyfvqjlxumkufbqfaqdddsggdp'
- ClassName: 'dznbhdpnrfektuituqxedtr' WindowName: 'qzqbqbfbgixtwwpzvjwuhopzyfxbpyoqf'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'mnrppkevgtwdcahwld' WindowName: 'ggofifywiqzifch'
