Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'vvwiumditoueznfkpqlvfvlyvajpu' WindowName: 'xdehextfifozimezdkadywtjdblvepodgwds'
- ClassName: 'zmtmbkexplwfjfjfwlzqfmrdlwwdumihcjprufm' WindowName: 'hcfspbfcsmiekjlmacaz'
- ClassName: 'meetolnzjpfasnpjlrnmhlccbc' WindowName: 'fphgygnlozhkoexvcitjmizbuywndqltozvuv'
- ClassName: 'ofwdumyfykgxoapimjwmaudzobejyr' WindowName: 'kjirzroquflunsuhjtewdzszkxnov'
- ClassName: 'ilzoakmfrpikwuakwdxeiqkmu' WindowName: 'gszyrpcnxvxfzljqtfl'
- ClassName: 'mdktkgdorpihufzmffuxqjpwefmujlnqkev' WindowName: 'jyzyhiwasxlkamtradr'
- ClassName: 'ldztgpoecigvyctfuchmyexqgjmihmdjgt' WindowName: 'gqotqafyucxduxq'
- ClassName: 'ipdiqwimpspmodwsxpvlw' WindowName: 'omqqqpenzyipxhgi'
- ClassName: 'yfmnxzoqvnjdnnnlpqbd' WindowName: 'mxkaujetdwdfyoxotv'
- ClassName: 'nehbpapkvhxwmaabljlyon' WindowName: 'zwgpzfvbdatzougqg'
- ClassName: 'dtwsihnyswbjsvxktjxmmpnosgxknxnbcv' WindowName: 'ivuzcxbchblzhiyrkfuztin'
- ClassName: 'jkrjchgyfdniixdpgawsqmmsnqowkzaeukrw' WindowName: 'mztmxekmgjooaujxqcyz'
- ClassName: 'qfdictvopaekmczsqwnosdskghijmhhitoxxpc' WindowName: 'wwitdpbrcopkahpprgvdtdanbctihfstp'
- ClassName: 'fjzbpoyucwibnlxguisoctbr' WindowName: 'drcutvjtozviwchflwazlvzzgeuwgpq'
- ClassName: 'kfrsytdeamewgcivg' WindowName: 'lysgctngucijmnektryhpuflqynnmusvdigzcwi'
- ClassName: 'iafeujkqosnubljdnpkgjxihdvp' WindowName: 'fawwcmexgcptvmrjtsamwtcieknymqyqxvd'
- ClassName: 'fqtlbtacnvmywjjhpnhx' WindowName: 'eoxqamoijwcmawwlhezagxavzvwesuzdslstlqj'
- ClassName: 'teaqjdmvaceyzwepbnrcojjnw' WindowName: 'vebmradtuyhpuqbgxtyv'
- ClassName: 'bfzgfuprrrxoiozct' WindowName: 'nrzocpzvdljexkjtzywslxfzsn'
- ClassName: 'ausyabzjqllmuaqpriswnlrxqwvjeu' WindowName: 'pnkajberavgsubpaedxoebhijitwx'
- ClassName: 'hoymrdxupwjemjdqdzowfggqv' WindowName: 'taorznjawpgbqqgwojgmq'
- ClassName: 'dhfcheckkfayeoz' WindowName: 'bwvxrvwcluwaboexnwhltryalepvmcjijf'
- ClassName: 'vkyiuciwdnlhgkiwgpxnyiqpqbmwdzoeitnwrbw' WindowName: 'sabmpzbqccdunexgp'
- ClassName: 'epcmtxwlmjixphossjmhbcjksklsvq' WindowName: 'fuwhyasazxfmnrwlguedssjmwmlq'
- ClassName: 'yudgkpwixdxuiewrasbvaskxmjxscchhzszkgzu' WindowName: 'ejbsqqihfstylymgomovc'
- ClassName: 'gasdlmxqkgumaatds' WindowName: 'ztineyzbahyvseoaufvslaki'
- ClassName: 'ivvlbdhmvkzqwvgwmlinbjofefvgp' WindowName: 'zdsadknuplhhppqxwt'
- ClassName: 'sgxzprcdqxskvdofnudnmnlyfacsjsnfbyhfqxo' WindowName: 'gwlfhzxxgwhbbclpowp'
- ClassName: 'itrmeuufgixapdzscreiogmmonnduqmycbbdtc' WindowName: 'zhcfrqbqrcttwfthnu'
- ClassName: 'xfoosxgawcyhnbynfteifxc' WindowName: 'adrgssnqkpnopevjfyaxw'
- ClassName: 'zzmyfsnlxdewdxzzmoxhvlitubsdqyrkkrl' WindowName: 'xboaapjfiaebtphubyvv'
- ClassName: 'gxxlkzydklldfhmrdyqrzmadwociea' WindowName: 'gnleoqhqidkgawzbdpcejmnxjemlzr'
- ClassName: 'jeqhnrvjjpgxpoird' WindowName: 'llbcctzmydpbwftbhdkzxxhwvltrjussuoud'
- ClassName: 'fltfdvliplomixvjtlufmrer' WindowName: 'hjnbiuyfxwbquqnfleclbv'
- ClassName: 'rsmbcmrbpxxzpww' WindowName: 'zeigfbfrjfskmmkmmdgflwexlnkrzw'
- ClassName: 'ybabmwasyzenjzteogfipfyxxqlzombydl' WindowName: 'yngximvpkgbstpittdkokhlxqgkb'
- ClassName: 'tdidylecbfjozumnslufwkunfg' WindowName: 'dmdoigiovgdytapgmkhnqiokuvdaxfest'
- ClassName: 'ceyepefargkeecydon' WindowName: 'nwxsjpiscvezkqpnoflyjewshahgvhpkqnuqht'
