Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'aspkgofmumplmhgtcusmpzxucs' WindowName: 'izpwxqbfpcnccjxlsauylyyfmqklcwzmuq'
- ClassName: 'izbzqstjdrydxxbolfnkpsxbsk' WindowName: 'mrqpealvjergtnxsipzcexypzktxaxyssmkbwsh'
- ClassName: 'bwjmwhbivmvbiacpiyrjgcuthiduuecrqtnf' WindowName: 'oqktnuspqvinzbfowibxi'
- ClassName: 'bzhzxapcsaixbud' WindowName: 'exbpdosexrdgarynzbomrmjnkwvqyabgfgo'
- ClassName: 'sneohbdqdfurqzyoaoxldetdpu' WindowName: 'urlcobuztijgancortlxfhjnqoibsaancbn'
- ClassName: 'pkruhksugkudvjjkdppwpperescjymluoeor' WindowName: 'zmajbzggacsnvekeqrasuquca'
- ClassName: 'wneyspskmhtcwqsxsoladcdaavremvxxwcfbc' WindowName: 'zowwvmpjoesmdzokenhhygdetpd'
- ClassName: 'htcpasiwcucggihhlragkuqjhad' WindowName: 'zcznmwlpkszwoktfdtrjdmvmpc'
- ClassName: 'uyhlkoadjxfzuwodin' WindowName: 'ejumxjbhbfovjqsuei'
- ClassName: 'ruupossbaxyfvcjatewjtnbvvvkulvgoswwnad' WindowName: 'oyccydqknerzrvmrveqerounsrhcfvvh'
- ClassName: 'cjwxmhjuniokshtlbh' WindowName: 'qljrafeclhkyckrts'
- ClassName: 'knrirnwrwsmgoitflnqsfjyehrdmib' WindowName: 'hbmugzpxkuwijndchqfmsyrwfit'
- ClassName: 'ulcqokpbasrialcpptnrrxr' WindowName: 'akeorlibhhnfwvidhy'
- ClassName: 'dxtlaansqssalqtpkszteirpad' WindowName: 'ocyvhrufdqifqsu'
- ClassName: 'zyvgijyfgeqtcqnvzeqohehhsikewzmqtqn' WindowName: 'mxizsedggvqysxlogsgc'
- ClassName: 'uyebynszotundwotbogyofbrlappnnbbfx' WindowName: 'dkkubkdbvgcfhfj'
- ClassName: 'sblbsbgzwkfepqhgaa' WindowName: 'sgqhiqbgkfmqyuoxofewgftcwybzlfldik'
- ClassName: 'tnjpjnlcbbyatgvlinyeffcbuzlizakzjwo' WindowName: 'dtvixftftavkicaumkjuolduktry'
- ClassName: 'dmuimstifgcwucmtl' WindowName: 'vahauglhldeorlmgbdbyinvf'
- ClassName: 'xxiejfagyzpjfvq' WindowName: 'hxdoafjydvblzzkebzhvkavf'
- ClassName: 'xrqvljmvalszurbnxxyvlfs' WindowName: 'pgncivvhhrrdkss'
- ClassName: 'xrymukztuhskgvuxycquauhar' WindowName: 'pyaxqbadygtexthkgkdlgapbwqembcazkcerhdq'
- ClassName: 'wkoaglfaggywibgjhuwi' WindowName: 'jccerpqczqtewfqde'
- ClassName: 'dtgbadcefivpibnhjeu' WindowName: 'htcvjgigfymyhmjvl'
- ClassName: 'bpwtclimrfjrjpr' WindowName: 'oxgkevmrykeeadoekhmkndkotpnohkphd'
- ClassName: 'pmfxofjrzvjbubgbepsojwo' WindowName: 'ijnwwpdcthzmfuvnaqreywpyvglgiino'
- ClassName: 'chuttwavavlradaduafzutnrnfyzaaetj' WindowName: 'xtzrjqzuuzgbrvkqaaylonncdgypqjzlvwdxlt'
- ClassName: 'pquvnpyrjhlamaxlxpduwzccrzmzmsgh' WindowName: 'znqlfrddpekthoyhbztksypzc'
- ClassName: 'zvkbalkswjhhcphzodrrowoipngsrcfzqvt' WindowName: 'bxtzwstqqjowctzdndnjujyvnidaqlurrorwjg'
- ClassName: 'fmwspvkkzfwxurflqrwgihqvrvvyuycpsx' WindowName: 'odmyiizkzlyirzvjdf'
- ClassName: 'ygyczfknqyruqymqvemncwwlrwdaxhyqjqdfyra' WindowName: 'sbmskcsgrltdwemeslitwhzxbxe'
- ClassName: 'dseqzjwlgadxdzwn' WindowName: 'daiikxgjhkwlkdn'
- ClassName: 'rqjaemrlyxrokbycsjmw' WindowName: 'vywetgerwfgqishcgweoncnuxxkhdzsufwqpe'
- ClassName: 'tpuksmnoqrkcsanmixgpjieouvl' WindowName: 'spbhtkyeyoysywhfcfkfnvctuftxyjeuqpcs'
- ClassName: 'phsepgflsdmyzqbexezjphvnusbbfxcmcocioou' WindowName: 'bigsvdbzblsyvzssgddqmzovgyvkgwvguhl'
- ClassName: 'hiqkbnkpawkbakgkfehmqotdwnid' WindowName: 'jjiyrzzzutjhgdtiujlcdukdttbrwmtv'
- ClassName: 'nvueahemawmeojbmqmqzvyvt' WindowName: 'atwhkpohtixxoohadmenbhfjxgxvxddlnsq'
- ClassName: 'unoxwivoahekscyxnpovzoonmhatbqwcbmiy' WindowName: 'bljlldoyympjmfwhamkoxjkmgxmiziarfvqhcjz'
- ClassName: 'psrlijqjkcbdhitimcckaperhacmcwj' WindowName: 'nhkjcsxmesmrneefsttoqtnviolsriycg'
- ClassName: 'loykbuaeqgznvwgotgvvxffrd' WindowName: 'yppiovojafwzxodpwwteewvunj'
- ClassName: 'ccunobdeyorplihixib' WindowName: 'luxctnzdpexrfdvkzfsmsphnmt'
- ClassName: 'ydrmlblweemuhidldpelkmswuclenepa' WindowName: 'lohltxqeuzirnjudihjjbforzafi'
- ClassName: 'gzozsbgxgsqezhlmbdanougo' WindowName: 'omkkgqqzakthduzptoaysjwtw'
