Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'wdxcsltyagiifrjmgtycgicpgbqqj' WindowName: 'hdibhpyyxkmvfgjcdndacjqfvdivphticgldlfm'
- ClassName: 'olrpeyddkwylsfolravazjnjpccstxby' WindowName: 'txlbtgbdwomfqmdzjxabxkdwjbn'
- ClassName: 'forrpzsnvflzmnzurjbzxmmjtyrw' WindowName: 'ytiumpzcmdhejrrbhgwilt'
- ClassName: 'uzuldynjwwhekqfkkejyugxxnwzxc' WindowName: 'shvhxlefganbrkjdnpeceirdwunrezbwlrcl'
- ClassName: 'ewktvfgdvluoodjutjxmimrmwgzxtiqsv' WindowName: 'cidczzzdnpfxyzybqnrugwag'
- ClassName: 'nmsnzhfpwfmfpzdngmqfslrt' WindowName: 'koratdrvagifcrmqmerihzvhfrhdxnmgpaumhj'
- ClassName: 'fqawnccpyabuikwrwstdsfsgkkfj' WindowName: 'guoscbfrckydmyhtmmx'
- ClassName: 'vgpjlalhvvnbvnvjmoxoss' WindowName: 'oqokmnmkjywxkrtytbdsdwtlmlasae'
- ClassName: 'jmbdlwodfrdkmxsehmin' WindowName: 'kdnrnfjqumsbnbdosgzftnao'
- ClassName: 'mzspqszsgyripojzvlf' WindowName: 'lvwqxkvmarzcxnefpwmrivbstec'
- ClassName: 'pcrtftcervtknwgaqguecohmg' WindowName: 'zpxduwerxhgzvtzzqiohrtd'
- ClassName: 'agahywyubwkooqbvwdavaldgecooussqtioyzmu' WindowName: 'hsmmzbzrbjshablzxhkfum'
- ClassName: 'hcfmhioajqrdyadpgbgemdrsyexnub' WindowName: 'kngtmldqwfslggjtesrwdnrkwdertrmkz'
- ClassName: 'hvlstgfhtcvouvkwfe' WindowName: 'luucddakfecsznveoaajmtwjo'
- ClassName: 'olvvtspoodumhsqkdxfdv' WindowName: 'ymddfcekekasplzwziibjlyujujvjdrtrohd'
- ClassName: 'fnevxyzvbrgdcupdalgibcwssslusrmhaefimg' WindowName: 'eqerufzcvbapdhbdknidnyljstyyekigkh'
- ClassName: 'xbukrvdymazmrmlxgweaq' WindowName: 'snoupnuqujqcwrewixzejjc'
- ClassName: 'kujbwkmzsuqrujxhdb' WindowName: 'zqyzfegnnbnpfrzbtbczkc'
- ClassName: 'ohbpuztlroetbnlhflpkaibxbeivhuomtiae' WindowName: 'sikvcfvpyuvgfcxagnvwzymnjuufnwmzyszsrns'
- ClassName: 'dytjylbdczszezsshctxvlvxawidoj' WindowName: 'fmrzwvvfgjfmgyoxwg'
- ClassName: 'lumddblkjtgqauzfsnvvnbdtsmdhvc' WindowName: 'lipqdrvaiznjyhosgurrahxlnfbs'
- ClassName: 'qpfuehuuekhxhgbpbrdt' WindowName: 'xqjaiwxueznktepgqgkibl'
- ClassName: 'icsexzgmalntpjjbddlcyyggzdxklpefqpwhmj' WindowName: 'vajouvisvqbgtfrrhcoqykyhpmieqicjgqxav'
- ClassName: 'cnrhsckhlnlgrewc' WindowName: 'zvtaxicedclldjnwgq'
- ClassName: 'rlkghkduyricngwakyqrrockssmccd' WindowName: 'avglysqtugsoldvnm'
- ClassName: 'zywqsomngvktmtojilqniupiyipnov' WindowName: 'lwinocebbnbrqsiamdmgpngh'
- ClassName: 'sgxzakzalijzjjaca' WindowName: 'xjepqbaaittvaqhkjamurimfw'
- ClassName: 'etryeuothfptdzbzuvsfeilnwgu' WindowName: 'bdnigqbwgxentbybessznnmojbuolyaeoyue'
- ClassName: 'phfsqhmmubcafzpybptblra' WindowName: 'jvovbooapfeftxwvnvql'
- ClassName: 'ipisjjefeqnwjphb' WindowName: 'tcurujmvxuvokonnzyodyqjskqidxrkb'
- ClassName: 'ynooixulwlfqqknrjyzkuvfstvmu' WindowName: 'wthxebqdamqmtancxtycby'
- ClassName: 'uyzuycuulxvcsvxbygujpmfzwyfupsicesmm' WindowName: 'xjfnydwssdmznjipsemztnthfokwkfkxyqhiqlk'
- ClassName: 'wjfbrqarervhghnuwijvxlodcoysvjiiymkjv' WindowName: 'agspkafrpribimzfuyjlctefqqaapvac'
- ClassName: 'uojhrhhjtpuqrkr' WindowName: 'bhnqiyjxlnitqkjxhgjcjqedlhor'
- ClassName: 'zxxcfmbrpfzpnudjpyfunyisa' WindowName: 'gxngsoedxjefruglbtuko'
- ClassName: 'pzxmmpbliwuupxtoehlwbn' WindowName: 'xbnojjmgodykpkmtxaprsav'
- ClassName: 'olbeqdcsbcnouhauarmekqaruzhpwxz' WindowName: 'kkmfootgwbxxhccpaxtq'
- ClassName: 'fxykhmjyodgeqegjhmr' WindowName: 'kqlsqnssskzoxvoizvokjzyxypdnkeeeq'
