Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\NSISdl.dll
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\NSISdl.dll
- %TEMP%\nsm2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'rsohmfrasigmpqonsvymcvmemvnz' WindowName: 'frpkubifnhzpcaarqzelb'
- ClassName: 'uurfjmxqjpiylao' WindowName: 'kvbkknwuvtbtzyzddcqjvvtisvszyojhdzsnh'
- ClassName: 'llpfriidvpjtjmkqeqveiei' WindowName: 'miivjepdytcisuhlzwdxcbrm'
- ClassName: 'gtooqgyermhdtxfvkbvllflqdgakuisf' WindowName: 'tyunasurtalkleuygngrcflljro'
- ClassName: 'ptpeyrkenfqixwe' WindowName: 'pqcysvvrjoqaokryq'
- ClassName: 'ismewaiuuhiqafnkvkjrntelahjqwadjhllcmwc' WindowName: 'rtgeglzlneywyrdeoonuzmvztvujyyxaaowf'
- ClassName: 'wwacoowforgvcpvchtmekruiylyqste' WindowName: 'jqttjtavvdjxzrhkmubgeetgjedsetbnrsux'
- ClassName: 'lkkunujenquwtkejerwktuoyzl' WindowName: 'igvhsdqjphknmwtxmqobhlc'
- ClassName: 'vakdvpuxisbigaeljgfkhjbdprvssuqrcyxkf' WindowName: 'atbrbohpvwenzkgrcszdrrspeoqtnvgh'
- ClassName: 'romtzssxziezsztbfdekuyqjy' WindowName: 'fteadqfxlpactrcndfirc'
- ClassName: 'ullgkgscduudewqjpuuqkrfaouerrolzgdiuxt' WindowName: 'iqhbirpbvssfffcjcqulpzkhqbeghjawtg'
- ClassName: 'gnyhszgievprhpnucgomwtmvseayhqzprigl' WindowName: 'vhxyedhihcijcmr'
- ClassName: 'zshnogirwwikngvcjvaggrqxlwcqqkk' WindowName: 'vvqverriwkevjzpmcpd'
- ClassName: 'adxiazvuvaykxpp' WindowName: 'vgbnnamngloskgxonwhznvwfgkqc'
- ClassName: 'xhydeocmctidtgyaymzyngsomkzw' WindowName: 'wtalusnehkgdfdlowxsppiapqioorzrpeydsw'
- ClassName: 'zzgkhhoveahbbnwnuetevtopcig' WindowName: 'tfeskepvoqaewyvakf'
- ClassName: 'kzctxuxqnzpyprcxvdctgmrgwepluucoikjnh' WindowName: 'mksikopfvzhqohcsunjhnozlepsfqlnx'
- ClassName: 'rdgdknbkljduqsehbudxmvsorswgr' WindowName: 'ceygyhonvuveviefb'
- ClassName: 'auqrswzohklgyfxcrcxafsttllfnxir' WindowName: 'mbnrfeccrqwrjjdmknsvwnofcj'
- ClassName: 'kuqhmphqiogiuxiduijsada' WindowName: 'lwvlkiombmrauyehvtur'
- ClassName: 'uxqubtqhngmxuatmgry' WindowName: 'gyaqacnykhxexctszbmosql'
- ClassName: 'azfvnbiokekpieldjhpgrakkoo' WindowName: 'kxsxmkbchwjiairybg'
- ClassName: 'ndxgmhbfkicwmiwriqankcbyzextqbqbbevkvs' WindowName: 'xsenzsdxtcpkwgmsc'
- ClassName: 'euddolxiukgijtoasxtkcsxkd' WindowName: 'fgvvzjlfpqxsqzbxpaq'
- ClassName: 'llfecepfsikkzvqzgwfrt' WindowName: 'zsxriwyttvyzfsndl'
- ClassName: 'ygmctmthauuvtihnkjuowkfmie' WindowName: 'dvivazamzdtruipoubkxayifna'
- ClassName: 'polzewalcgkeigqvezjrsaptap' WindowName: 'yxxqqshturhcavmebefvlq'
- ClassName: 'wwmschijhgrphrdloddwglasszwnfyuf' WindowName: 'uwzjuoynscelrqapxbyrwpr'
- ClassName: 'qgdbeiprchmwrheaotsqzjbwhwqdmmxvezzxsoj' WindowName: 'piqfphlbsjbyikgvb'
- ClassName: 'kmqqdealijyndvymdhwsykrkabrhwsmxu' WindowName: 'mxmqtpeebqwzlanbrbcjjvmfbwttsn'
- ClassName: 'lhoufwsyobdwecfeoqmfero' WindowName: 'rqmcbiytuycahjtfqaouxcnztkkqomlffhjccj'
- ClassName: 'neibbhfxmyykkmngdvuswnc' WindowName: 'spgbbfrugkryiktvjbompylgydqusgllgotk'
- ClassName: 'jylohpldoojfwmimjqpjgvmuxdryldckah' WindowName: 'eqogrtmabciravxvnipmjtwt'
- ClassName: 'zllzhasyimlxnepkadn' WindowName: 'accgzwtmeewcajapalpmhqcqaslno'
- ClassName: 'tctfsmjvubwvjzky' WindowName: 'irgdouttrrbppvioippg'
- ClassName: 'pxxrhtyqpmqbitzuetldfx' WindowName: 'gtshwmidkqcmvsafptgq'
- ClassName: 'jygzcuzegqlxmqrglakezaortohkubqznd' WindowName: 'vvyrcqlabadpljsatxnjdwodzjjmnx'
- ClassName: 'bircyegenvrnibyku' WindowName: 'efrbmiqshhjszuwrgn'
- ClassName: 'mkeoasyxtykyfiljiigmmudmblwndy' WindowName: 'cjfsttjobfmpvaggmhlddpppeaetbatcnsqlb'
- ClassName: 'vkdihitfsogaxnojyepqzmekgdjlgasgru' WindowName: 'cvdhrbsqfdhcxatzksnowcakizwavpcmqpr'
- ClassName: 'gtktufkdvmxogvgcyjgcbhxahzeebsgy' WindowName: 'qsmehslafwbpfxlif'
- ClassName: 'lhiggsihdiiuryxsqtjjupirogycpzhmiejp' WindowName: 'qduxgvsgauufibmvogyra'
- ClassName: 'lpdzstzxwozuljz' WindowName: 'pnrfnzohkwjcqggmj'
- ClassName: 'pojjcgcxiicbafmsabtmiexbirfyqyntxrk' WindowName: 'zknpxpeargtaxaryoj'
