Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'psaqxlaugyzyqhkdsqrkqjvnwdy' WindowName: 'xrrhvxcouzlipynfrbesq'
- ClassName: 'hqjjgvgqknpzdqqycxrdxlsbyoamtnzjlnzd' WindowName: 'afeicqlqohfdzgcqwapetyeynsrousdhak'
- ClassName: 'vmalplqsbwwoxllkoic' WindowName: 'rcbpykcukhflhsctjjnrq'
- ClassName: 'irtygvwmewmqrpcnlyrjogxwsvkeidhzfntevd' WindowName: 'btudxynlbimbsjgdbwljbywkdivcdaxlzcd'
- ClassName: 'ykvofyqkfhgjtbvusminnnx' WindowName: 'tkepwsrcovftmwdvwep'
- ClassName: 'dptcfqaixazrkovlaasycaaoewubzrwxdl' WindowName: 'yxqnriaccfiigkbqhyulp'
- ClassName: 'mhyfvqrzbxmfdnoyzuxbo' WindowName: 'quyzqnesgziykdgmseoprzqyvozyxi'
- ClassName: 'bwlgssmicykjokw' WindowName: 'xfkezoccnjgstrf'
- ClassName: 'lbtcgvleojslzphbnmarxtucotmtzcc' WindowName: 'vrfflapxyysupmbgecgxziqx'
- ClassName: 'vtdcumznxqlyhduwxjjcixsqiccscdff' WindowName: 'zwmmvhkkmdqtndslniibqjulglm'
- ClassName: 'ilwrkcczfooqcotlcrtoytphs' WindowName: 'nzuqixsfjbvhwwftpjvmcmznbgfsjoa'
- ClassName: 'gqaenrorwczsrzugwrwcrqqfuevkvazjwdydwm' WindowName: 'swlfdbydxrzmhcy'
- ClassName: 'jfhvchtyicfqjsccbwdfvceketgnph' WindowName: 'xkkgradzxjqbnqx'
- ClassName: 'gqwkzzvvsrwfchi' WindowName: 'qiuynnvbdhdbwvakjzf'
- ClassName: 'djbnhquohcnlkpzbqyhkz' WindowName: 'cvjqqwghyhciuoyarqmkukrakkbckkrsehnsjy'
- ClassName: 'ebnenpmmhxzphechsglhoiftifdetxrvqjvdn' WindowName: 'gdgmktrfcxqqssekvtamxpdgvgcfstcgngzex'
- ClassName: 'fzzmvdglutsffchnfanzjqr' WindowName: 'qatsmjhlmtoykuvfiuygxdxnpcyealsbgzhvugi'
- ClassName: 'hyphmpdtdtgrzjnppetkdizvgxcy' WindowName: 'yxqwvqheuplclmpvkigjyilhjebqkvcuuwtjms'
- ClassName: 'kowafwvgqvqsxyydl' WindowName: 'gklogccijlpperbqtgvbcyokumin'
- ClassName: 'tjcpgiprofgsrszfidbsbe' WindowName: 'qldwrckmihpdatbcymnzobr'
- ClassName: 'gxfuncfmigmgozuamehmevjue' WindowName: 'ispqtzacinejkpgnydzsegjbkbqqpkcpa'
- ClassName: 'gzdsrdcmalzgznzukdulpfwlqdplfozbpg' WindowName: 'ruyortalkpgvnvpchfwwmqos'
- ClassName: 'qjiatgymujkclkxurrmiyguophtvhdpadine' WindowName: 'zxasbfnunvzeegrsyrhuzrjbltjpysrnshgdw'
- ClassName: 'ifrcnfrwxbrwopbvwpodtkwemmutedlvqbby' WindowName: 'axgbpysiyythsyxwapyfxvabgsgob'
- ClassName: 'guqglrcgttwqrjybhsnvtn' WindowName: 'wuhpuojfydfgfcxozwx'
- ClassName: 'twewgdxxqelwwsrusb' WindowName: 'fdumypnsjwmpdejgksvthcwmpekbwcdfzwmnuoj'
- ClassName: 'jeljyiznhxmtqycxefmejyu' WindowName: 'uegviizedczrwcowpxqgrwaaxeeyswtiyw'
- ClassName: 'craxeqjkyiofjbyuwplsfkl' WindowName: 'aydwnijuyagwlunshkvzkhacydqmfcmfcw'
- ClassName: 'kbetnvbdbuibkzwpfqksemodbvswqw' WindowName: 'dwwepuzlqtltniuwepjog'
- ClassName: 'egcvjackqrznnlqkqnn' WindowName: 'ubrkqzivuplhlkeexkbzoyxdrneqsiy'
- ClassName: 'gbmtyjwhgivbbwegs' WindowName: 'ivdtlwhzlqlhxqtvqdpb'
- ClassName: 'nnsngpxejtijjgosgfxvylsrltqxqemrg' WindowName: 'psgraibicegddxgvuespcuitzudakpzowugxp'
- ClassName: 'ultptwnbpmevavidxagtwvskltyrdes' WindowName: 'acomxyoljocapbcxijabf'
- ClassName: 'smilaqcczitufagnyeff' WindowName: 'gutdalrfgvkqffmskhwhilqjkl'
- ClassName: 'vispoehzlbmxzmhzxw' WindowName: 'pvbvnfwjskglarhuzlsgcj'
- ClassName: 'buhuhuvvlhbboxmsktpzazeyrgpjedyy' WindowName: 'piuvzlcruvefmxmiipceobcyfpmigltffk'
- ClassName: 'aafwhidsftakegprebn' WindowName: 'wbbefxihizlctyuozrbfyfecfzewtwifhq'
- ClassName: 'quatkdkomklyvyswtqziop' WindowName: 'wdwxzbvejbksqdfdwvcvdgdhl'
- ClassName: 'uwuzxssradsffntgoapjhpsrevdqtujrstx' WindowName: 'czfyacsweyaqahgnouqtjejbuzexbfx'
- ClassName: 'cyxccdqvjpvqlgcvzzxsdvswbs' WindowName: 'hgkxgctwcivzffmvoesfrtrfjecmavus'
- ClassName: 'yqmlaqumchkrzbxsrmcgrzglelwgsvuiwij' WindowName: 'fgsrmnrnrkyqpfc'
- ClassName: 'yozrxoxriplxcbxgaewinqddqxsqxjxie' WindowName: 'pyygqpfvyjcneqzuukpdbflasclqbxududfer'
- ClassName: 'thrbaoyrmvtjphdcvunssznwgrigko' WindowName: 'ltjdddwgeeswuukhefocifvvchieqaseahjldq'
- ClassName: 'nmlpgikelwoochuuydfzwmjmt' WindowName: 'pwscizspcvbsnullekttxdoytbxuchqufbnqsw'
- ClassName: 'aerdkwahydkklpvitlkvrnfkhxylytbbnc' WindowName: 'wpmknotqyeaaevtsmfyopcyqjh'
- ClassName: 'znadcaaupqykjdkhxcgcuhx' WindowName: 'mcxtlohlsmzusymhpheaixdjtyomzmpisvscyb'
- ClassName: 'oredewxkbyyimqkvqnwhjpkkmngylafusrbrgwb' WindowName: 'gbvsgrbewugoslhafmktbfzmwqfhomrmqoyzb'
