Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'nyggalpcovzpupnierqszcnyuztavpqtaa' WindowName: 'rpnoonniyjcfqgscyologmsamsjhogcrmdqrw'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsi2.tmp\InetLoad.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'sxtlrlmslppeusylcfgpovpududpekimreeh' WindowName: 'bmhyragolvrudyla'
- ClassName: 'iktluyvpbfnrzdjyhmqrnkkkzlgpih' WindowName: 'dtqxqsmpxmsqwrkzoui'
- ClassName: 'iosaqxcsrlkkojfeinyemvzoppfjgpfjlqtv' WindowName: 'rucupmvspkfamdimlfnjae'
- ClassName: 'ufkoyjddkzmtorhwaync' WindowName: 'zxgszijlzpuywelnxoqrcppjawuujdmwu'
- ClassName: 'nxiwmpcsvseeaxtwimhxkaxirizebn' WindowName: 'ptxumrvzfdoykleydvtn'
- ClassName: 'ygnmzqtwhejywrltfibkjayb' WindowName: 'tkaugdmnwogsdemptozhccnq'
- ClassName: 'twubokejwnxronulsnbqfdodiygwcgcesqolw' WindowName: 'hbefvkbxgqrzlvfkoluykpf'
- ClassName: 'jwwwtgxikwcntsghigro' WindowName: 'poktsvfmyhrgmdlinr'
- ClassName: 'kjxduvfjhckohakjgktgfnvwjbw' WindowName: 'norfvimhokuojjyrxpii'
- ClassName: 'ymrizhimvvbdsylwswxwrvgdzmaekxc' WindowName: 'xyofybsayxgqzqdaocordaexbilium'
- ClassName: 'bczzwvghzfzddhqdfdfzcrmaklfqlco' WindowName: 'xdgjpqnbmafkcugrrtkeuzfpe'
- ClassName: 'mveqmexvoilbelkwbmvgguggzwy' WindowName: 'lqhdsareogvnauimixxtopcrjuobltadt'
- ClassName: 'ietbytzcazvgndoczhiiobwowzxv' WindowName: 'rabfskulgnpkddizaeigry'
- ClassName: 'vjxlcwuuqhlzhrnznugahhzcfarkume' WindowName: 'bsabsaqlrldmxwlyfaxvoxwgd'
- ClassName: 'zpbqrzugkoluionsajiwq' WindowName: 'olxyvziwqppialwsxdyuthkgeo'
- ClassName: 'racrgtytvfrswqrtlufmdnhzrxqg' WindowName: 'ubagvukqhizppldunveesqbcfjqewcvbpt'
- ClassName: 'srkncobfscbbhkuerhevxiiblpxydc' WindowName: 'kbfkfyitpygomajlucydowimonemcstckkkzcxe'
- ClassName: 'rfgwxabxlumarpjhqldyjluxjvjtesq' WindowName: 'hwuekkjxjszpdszb'
- ClassName: 'mcsecjzpmxftnwagrfmv' WindowName: 'qghudwnlzubcbogdhdmighvmavfuttrflpmqjql'
- ClassName: 'lmtfuhekitscjnpnztbdlcdldhhioxgwe' WindowName: 'fmwyumjjmbsmimavwt'
- ClassName: 'loxadnpbjjoxrmvir' WindowName: 'lrsospwiftfigkrhkskp'
- ClassName: 'rcduzqvtmsdgycciierrqapnjkslvdhml' WindowName: 'kbhuyxhljzmylwvbwhhefusuflmci'
- ClassName: 'mvqhraeexcyiihrn' WindowName: 'siuwcxjinyvyqnzppcqtzxiddnefbu'
- ClassName: 'wheodexyczwyzqtqzokysrarprwmiinnltjjh' WindowName: 'xzncyeqxwqxerubiahzlwbccixddcsphz'
- ClassName: 'xuzizxnaiuaqpdpngzhdphpmdi' WindowName: 'hklgsgrhvjfdhoqueegvwcmesgxramzbb'
- ClassName: 'txirlfjmadrjkyfrnwsgqfvjeezgrsawadg' WindowName: 'mabxomafudyhjmevuvccasbxjihneuvajbyg'
- ClassName: 'htbislfoxlxexldhijxfuscongbruzowdcmif' WindowName: 'eosmooknvhyejpdexbmpnt'
- ClassName: 'kujztpsbdjznwtfaont' WindowName: 'cjyqypiegudlwzuqujcdzhqrc'
- ClassName: 'xekxhxsbmajvmgicbjqzcxrli' WindowName: 'jigjxpoairngcmzoxdevyyjyouwsghgauutamgt'
- ClassName: 'wfzsmotlmdarzqbbnkbqmgssxvmgjkfrpkh' WindowName: 'cabqbhrnetpclbwxlbmljbkalno'
- ClassName: 'ouxgibvjjkaaskxjp' WindowName: 'mrijrkfqewlvnrrmfldzspqdezsqmzxmsxh'
- ClassName: 'lavwfqxjiqbnnnpdpwsoijctl' WindowName: 'wustrilekuvtfhumlifgppjfbdvbrc'
- ClassName: 'oxaxviqwhxirtvz' WindowName: 'uzhdgwoloufrorvxqvjcegvhgloq'
- ClassName: 'lfwvfmotpwnshfdrxmaumwzs' WindowName: 'npocoirtqtvcjastfsqzhosxgimbbuxpnqzju'
- ClassName: 'swpypoplrdiluumjo' WindowName: 'qgygrbmxbzbvagopopoehnwbnte'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ahdbckfbnjzsumqrw' WindowName: 'qneptlaisdydyrmhlmotjcnbne'
- ClassName: 'hdcsmmryleiaoea' WindowName: 'lahokefihzquimnt'
- ClassName: 'vplaxtnushwleqlgirifkqtanuhuwlduh' WindowName: 'hjfylphhmovzqiouupoqdcxqryfpa'
- ClassName: 'frvfjovegcrgvglphlipsxxuc' WindowName: 'yyfqnteinluvifgbstnfheeqvlpebemjoswjb'
- ClassName: 'jkjfcpahxbzdmbgixkcdhdtaa' WindowName: 'wphbjntmtqcubwwujtnfcienuvufwnuez'
- ClassName: 'bcsxfhayegwlyelrudkcutlcyroe' WindowName: 'ahkahcaayddfegphnhvrfzqwumrpdllbcucy'
- ClassName: 'mpeujtacdnsyqcryptqfcglzgghvbuarln' WindowName: 'colwndmcfxnvpwrdrkwkwsdvi'
- ClassName: 'xcdmmouznmhynnqqdjxwxa' WindowName: 'sspflrxmeaxucdkuau'
- ClassName: 'cmtguflcvhahhubbmvifedsugjqhpa' WindowName: 'immswvbbpckvvgkaqanmlfioiolhh'
- ClassName: 'hifohzbjrtzvfxqmtbuijnkbxhxvxhheggzbwp' WindowName: 'oklmswjfgifyjkdzaduvriujgjssrvuiig'
