Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'zdgethaxmpgeptmbgoymbyxsmknstyjfzkzavp' WindowName: 'iqiuahcwvybxcjninrxddtdlmmyphikmstrb'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsd2.tmp\System.dll
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'nsqwsriilidpefjvgljydubapv' WindowName: 'jshawvnncrjsrcoyuwcqtidxxwmkqnsebsogkv'
- ClassName: 'ehajwmgaujtvzxxonwzkjpaeyqweeovyv' WindowName: 'cnqpofczrjauojudwlznvtrnnyaummxmwsnlbp'
- ClassName: 'ykubioamqooalnyrbzqaztxiuyklhwetcp' WindowName: 'eodoafyjgnzpmqoubqrygunrlk'
- ClassName: 'vkoqciclhfzlapdjnbfrwen' WindowName: 'xkqxpewhuzcmjtclc'
- ClassName: 'dxpyvjwwiiatjqzfilngyjljlfauxsnhcip' WindowName: 'nmrfjohckezteraisj'
- ClassName: 'xrvikbhiccuirih' WindowName: 'rdndtllfpzuzaqkuprphdftqadnylvxfljpzixk'
- ClassName: 'izdghqafazsaxowdttloizlvq' WindowName: 'ddnbvqiuskdhodwxtlupfsn'
- ClassName: 'qevtsggvtitzalxkcfrigrkdgbbu' WindowName: 'wwxpgmpljcggcxwoeekhkyqjkdamitt'
- ClassName: 'vjjgiybjzmsmzlznkgkxyaqjebqqitnnmt' WindowName: 'mdufcdgmudouvgzylgciovhcioonyrgzyv'
- ClassName: 'cxaeqyvhteluqtkptfgxqpno' WindowName: 'lxtizlzelkycmgbmdwlbgltumwrcwirvpwt'
- ClassName: 'rgvccyufaeafsmvsnrkvvwbsvp' WindowName: 'pknlnhrzkrnvtmfyzuhotnts'
- ClassName: 'pyuuuyqgytmfqognjfuqqehidsaulbttrtmdacm' WindowName: 'wkzrtvgjsleqzewsbxxuzldmfjcd'
- ClassName: 'qgfwiynxlppyhxw' WindowName: 'pvqvkwwdezcfosllpwwvssgipxwfrp'
- ClassName: 'ocyljrijjkkvtjo' WindowName: 'mzkkwzhabrqnlrhoxcjypghkysfk'
- ClassName: 'aqcmkadcdcilivksmbpcmpus' WindowName: 'jlqhtstwdwrafuvvqchevxmetpdnolmsjtxu'
- ClassName: 'fqbkikvolqrvikfrgypsjpmnfemqr' WindowName: 'kfmdijdldrgxbohkfadqlwisycwqzonyrwjopa'
- ClassName: 'frmfpornkooejpzfgoazekhmcy' WindowName: 'nbhtqnbkvvlyuxayapm'
- ClassName: 'rnjlsgefhjttbbpumwuobwvybmyjgbkhqefhs' WindowName: 'idbdmnhqkshbiesfqyysmjcil'
- ClassName: 'mqghacksggertwylgbkhbbee' WindowName: 'wqfkgdeoanktztk'
- ClassName: 'lwfujvwukyapttgpawn' WindowName: 'aqjamigumffeggikkwwgsfmxks'
- ClassName: 'gmkcwftmqjymioflvbgaufnutkibzllfzreefi' WindowName: 'qnadxbqwfcchclrhqhvsb'
- ClassName: 'pbdgppcarjqgflemwf' WindowName: 'eobkivgkpnozmtvrsupgruyehxizecpi'
- ClassName: 'bucjpaguegzqaigutgiycsqcpbpygepenoznqyr' WindowName: 'qgifcayztslcfqcxhvaobylqkeleoriplrjma'
- ClassName: 'xlozauqufdkoinutotsybqvac' WindowName: 'pwwnxpavaqnkcmr'
- ClassName: 'ccmjhcmezicrheuzrantkz' WindowName: 'cyizcaztxuksllyrlqwh'
- ClassName: 'wcxsyvjiuyrtirbnpmfyeilfhpfven' WindowName: 'fqlliuyptvqtecppcojoavpbpf'
- ClassName: 'ojfynoravscmbkzomvl' WindowName: 'xlymaffblsrnfycfvggocfhkzlmepdvaeg'
- ClassName: 'czbpgdxareqgkrvktecezdyhbsvqzcqqsctvvrp' WindowName: 'qczheefslswwojihavmwgw'
- ClassName: 'mmhkxwbefreyslghezkewege' WindowName: 'bhjsurxjampeldnsmm'
- ClassName: 'muezcblppscymglrwrxldlfmqpgxry' WindowName: 'koflrpnaochrypycyryossfxxscswdcjdjf'
- ClassName: 'jgohpzwwgkwnfzdmhqfjpgzbfbkolni' WindowName: 'usmfhymbinrhnsstndze'
- ClassName: 'kuqdwjwmkqsoeassctlugo' WindowName: 'uptrqomywjrwzcacubcmu'
- ClassName: 'wksfiuabkghnkrofx' WindowName: 'ovmcpyizksvczzbgounahknczzi'
- ClassName: 'jugvkvtdvqhqojhaneipdjmq' WindowName: 'lxtfpdkuryquydegotoijydnnzobxrzaspjpd'
- ClassName: 'fiyhrfumsrlzvepjofzlayxaxgrcrc' WindowName: 'pysxfoegpzxlsuecbkrebix'
- ClassName: 'jyzbvirwfrquvqqfktyu' WindowName: 'rpbdpbedltclnuwyn'
- ClassName: 'cckvymyaaphdcvnvqwboesemksv' WindowName: 'gbgxpbyjbyhfvjbrkn'
- ClassName: 'ehcomcfrrrthlljhcqjclaarqfv' WindowName: 'kmjmjdirzfvpszavsog'
- ClassName: 'kzyykaixfyphlgfdfaitioviuofbmektempg' WindowName: 'gcpublxslghusbvggdbbofhsutmkqm'
- ClassName: 'mqfdtpqpgvakpskdsspnmgupxjqstesjsuuoq' WindowName: 'bqqjusnzdosqdlqzatcelzrgjxbeh'
- ClassName: 'eqwilzmgarjsjxflncpthfqymdrkwpvrfwx' WindowName: 'xonmvlwhmemakhudjxkqqvanggfardmijvexc'
- ClassName: 'yqkkxloynbsnvmhtzfgwo' WindowName: 'xagowccxrrzkvxcyzutqw'
- ClassName: 'fyiaggzoyvnrxygdmvblgqsxcfboazabjmhdppq' WindowName: 'wgaeoavgriyjgbtmuyvevqfzgbs'
- ClassName: 'zclnothqugehauzhwxpidqjdjxephxltuzzaykx' WindowName: 'kcysmtgpzmbexvglil'
- ClassName: 'aohmbmqezykmyygzezki' WindowName: 'pmwislvalqximothlbxjexskyxaeujcszhfmjdt'
