Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'fwlavpxnrgherqnfktdsmgwzpxww' WindowName: 'procbzsxrickjjrldjyxj'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsd2.tmp\System.dll
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'edgdicxqtyvxoehuqvmnjrxesewr' WindowName: 'lfwbcyublwxomcurmzzjop'
- ClassName: 'zzngegueiemgnydvibzmzr' WindowName: 'pmycqfbxzhninssic'
- ClassName: 'dujwznvyodkmkirvbbvsybedkxmuwqiwcuseef' WindowName: 'gweloqxhpmbwhyxb'
- ClassName: 'akkhbovrtujuqdxt' WindowName: 'scvutvdqsdrxwgepujwayyevvpudqsh'
- ClassName: 'xlqvpmvzmfqwuibetm' WindowName: 'zaikspbjxhikhjschbrvullkqqns'
- ClassName: 'slisgqpghsgxzuivzkyupersfmipylzylm' WindowName: 'wcfryhoacpzcdquixeqrvfbmxwem'
- ClassName: 'xlfsiyubffxsyenkmoisdyo' WindowName: 'ofdijhxpmsulqsxryxoyxvxvmtjkafrnsage'
- ClassName: 'pyhvpfmkiwzfujvgpdlolcsefrukwizzp' WindowName: 'oqnjkormqhlmrasbx'
- ClassName: 'thbsbkxqzaeqlwgxpammscezmk' WindowName: 'qiozrrtbhlghrmpsstsxkbogiithdvgjs'
- ClassName: 'vaiyzinidytnbcizkfilxynlephn' WindowName: 'uccjynodfpqjgamzofasebynuxdqmqcxbqlo'
- ClassName: 'xgyqbbstsjnxywvhimv' WindowName: 'qvmelnlsfunxoxoqyxqdvmjgaf'
- ClassName: 'kyxxyvdvygtefsuxwrieyhsaqwd' WindowName: 'lhjerkjsbdzmjqjbmoqwguppticzeqfwoqwppe'
- ClassName: 'skkimascxlfktlhbemsgqzfnplqasswov' WindowName: 'jejlrrybnnhqqgweysimxmphgvcnk'
- ClassName: 'ydmglytzyrbeskqachzglccyzpethaolx' WindowName: 'yamqrygpchbuzaasqvjtgrrllbs'
- ClassName: 'mckivumkkikvljltwxgdglqoqhwfucpbqu' WindowName: 'qmvpshzefquyjpmrdtvmvlwykoniroymn'
- ClassName: 'lipssmeseluepcihul' WindowName: 'kxhiddsdmqebfqr'
- ClassName: 'xtvcpqgxkfbmudeusmvrnknww' WindowName: 'blefcxaarydclbdofic'
- ClassName: 'amzpizfhonmvvlqosrsdmpmomupatqffozfxkb' WindowName: 'dzilbnohxifowvxrfirxdbpl'
- ClassName: 'mcobftghzhexpzg' WindowName: 'xwhigpfgleineydbvhhxpypgqptqxyljkjvqh'
- ClassName: 'ngpdhalnicuungngudzsttogulkffsqruynf' WindowName: 'smtregzhqvzzlnyrrxrtgsamuewybjahewn'
- ClassName: 'utoziqswmezimitkvgezky' WindowName: 'szhkmnlttllpcplkwkzuvcaob'
- ClassName: 'gmwgcgvdjvnsrywixvftwxghnngcbbfrps' WindowName: 'aevnrnyhnyywzttxxjpwqoy'
- ClassName: 'kwzjgsgvqivqnos' WindowName: 'xeyclobgkfpzxuvbsmggomcbdmwtwyy'
- ClassName: 'nomwphmfvswfyihyqijgzkfirhtycwj' WindowName: 'qxxjublbgqkjzooksmhbkohpdcboqpjxzfeuc'
- ClassName: 'vpmcyrvgjhldzcqcvyhxhgkff' WindowName: 'uskcspqehsrmervcbetoxquyelyizhmvm'
- ClassName: 'fvnabxovcaddpidqujkurkxauedplyehbvwpk' WindowName: 'nvofpukxrkixiadmcpvxjrwqrmn'
- ClassName: 'bgmmmlrnsthudzxaolsvk' WindowName: 'ahjfffnqhocbtgaovzhexjdky'
- ClassName: 'nymvathdxtvllpkxdxjtr' WindowName: 'gqmdhmyacakxofxaail'
- ClassName: 'akwivetdebhatinyhxaqrxnbhobsi' WindowName: 'erhsjbgandiezic'
- ClassName: 'gihwhwwhxxeyaeztdbk' WindowName: 'uhsgvojlpupogyvxqvueeibqmcfwbrkxvahlsyc'
- ClassName: 'cjrrsxmhaodboikzkfljvedfgwddcf' WindowName: 'vuqlludocahkbgal'
- ClassName: 'xabubwpoonangodehmihasfnbieqnk' WindowName: 'yatgwsvveucliewoxesuuntpxxlyzyv'
- ClassName: 'icslwvikigrsdeh' WindowName: 'jzdhvuleiiqjycjln'
- ClassName: 'lfmfleszhxfacgpxrhhojgnsaew' WindowName: 'xqcsaqbhzzgrlpcrvcadolc'
- ClassName: 'eozyjeavyfbesplgmbtuxdsogtm' WindowName: 'qtvxnutlctgcuvnfoyirm'
- ClassName: 'wolzqeioibrxfgtq' WindowName: 'zspjmdmllicjfsommlavguoprtntznxgyacape'
