Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'nupxqsaqxnrwccohbnsin' WindowName: 'rtfyiylyhvegyvchpsbionwzyrqzxgtzc'
- ClassName: 'rxcevphwjhamxgmally' WindowName: 'uskqsvmrzdjrdawaqgxmvacb'
- ClassName: 'lhdeleduymrsztogftml' WindowName: 'mrxsnkpwlybfyqfc'
- ClassName: 'icjikpfqswfjigfumxiddmtbjg' WindowName: 'tlgtntbeagjvwijdghbvifcpaaxuj'
- ClassName: 'odqikxwixasoqvimvdsmwawpy' WindowName: 'wvruienxmxymhfyxecraswdjpd'
- ClassName: 'rmyvasvlqxabqtpnufvflzwiwivcetivck' WindowName: 'jdkavnrkeptwroselofk'
- ClassName: 'ytaongqbnjfzwqemxmjhzp' WindowName: 'tsfajtnbablwzvanuqncjvdtyheyv'
- ClassName: 'lltrruzkjtajztpoajbtewsfmmopalxzn' WindowName: 'unwigrvtcgjfzwptgkqvfdwtgmcw'
- ClassName: 'zbesgsuhxzmgujokgyqkut' WindowName: 'jkmtxpollcaylnugejyzanb'
- ClassName: 'anbgzdmiahfkxjreswjnnszl' WindowName: 'kchscupjslgxwpthfyupoiythzjmcmltvaeemr'
- ClassName: 'yfkuxlzlgwchkedsdrssvlpxlsmdpjwd' WindowName: 'hhiimwpqznojraxxyuxyvdmbilgsyeawratk'
- ClassName: 'sgjtyuehvfcacfdtxqxwksegnyaxkc' WindowName: 'gpkbdndmfcaknrpckcrqkifmufznj'
- ClassName: 'ypmyrxurycswymvpwtygnvuln' WindowName: 'oatotlcaugzhziewnntparmcbzvrifbjhz'
- ClassName: 'zrwonslfqytacqqgijhkdafaxyergzizcgtcw' WindowName: 'szqrkumjncgxgedxnjvosgtjycukdxrvdcbs'
- ClassName: 'gzwbbjlxdaljcuzovyja' WindowName: 'mrjbkdkabqxtzyaomftdnzcjrletajvyuw'
- ClassName: 'xlsgsupncuqwgemdieqi' WindowName: 'htapcvymcvmykndqeztytghn'
- ClassName: 'uriehjxlbtgcdamhploydkvhytztwacj' WindowName: 'yhbkhkusgjexzuwudawjunb'
- ClassName: 'fyonwruzcqvkwsrdryqu' WindowName: 'zstanyoicrjhnzebhgnbqbhhpi'
- ClassName: 'tghwbenygokiwanxtppyhwragw' WindowName: 'rtmydvwslefgufphiajidpnvcu'
- ClassName: 'poqczjwedlpkborncpphekjouxvnv' WindowName: 'ouhkdzcseelvispfitjvwtpcn'
- ClassName: 'nzbojjnhfpfzhuodkigjxvvkmcrdlodbrsl' WindowName: 'ruugobecltlbrxiymxeniupuwejufozgegbylp'
- ClassName: 'hbopwwfjojullsjipicodsekgazgamqjzb' WindowName: 'qiugdhyxrcfczysuvthlkkenquyqqkalzmff'
- ClassName: 'unehqwtorrcgzgogqrejyqyqmqju' WindowName: 'vjykrllnziorsdtnpnhyxcq'
- ClassName: 'dyuvuecofiysavqbh' WindowName: 'vabynjtqwhkqhvtgedorqapgazccalvkk'
- ClassName: 'xvedktrpsfsroiiuxiktovejqy' WindowName: 'rgoufvghxbupbcjdrparzgexepq'
- ClassName: 'thmtklnemfyiejmes' WindowName: 'nresbsahwcafadqkvbmskbgg'
- ClassName: 'ymowzrcdcbduelfflfhtzybvafr' WindowName: 'rdvijbtmqsgekltotwriiyuczblst'
- ClassName: 'zmzcxzjqjjrdgqrqrqapvfzrocfni' WindowName: 'ugreyrksrbgovayneie'
- ClassName: 'ximeyhrytobwdmhkeznnun' WindowName: 'zuxfpucsjwzosjfkdblomjqoi'
- ClassName: 'oufdzpexjsuanpa' WindowName: 'dqlcaptzcuvfcjyhmnttuzqiyg'
- ClassName: 'dvwnerrnzzdwrnx' WindowName: 'xwyzbbmphbvfvejeaxgrsx'
- ClassName: 'ximfkjvqjnevdhtpjozckcio' WindowName: 'mdqmpxmwurgehuzkuxemeylpiujpsirzo'
- ClassName: 'kwwueageeakydppxftanjudgkagqszbb' WindowName: 'vgtnvvfqdhbugnsfjbaj'
- ClassName: 'najemthwyzssrcrrddgzzquyqaisrzcb' WindowName: 'jghiirlrjsmdesocemylqnpklq'
- ClassName: 'siftmuuremccrfvadmqgpmkfjyrkwyv' WindowName: 'jefegibqutyexatjbsiooclzry'
- ClassName: 'mfrfkeqpwbactgxpzoaeymvpgsrqvwnwmolz' WindowName: 'ruuvewryowgckusqftfmep'
- ClassName: 'eadusvxrjcbegwaj' WindowName: 'bunwimftgszjiio'
- ClassName: 'gghibpucjgxsbbdtddhhotrputy' WindowName: 'fwngowvoncpxyujewnisgqvzhayivmiivqdzbmr'
- ClassName: 'ezwdbupdudatfphiets' WindowName: 'fprwjbzkyguunvpnydjgxdvyimwfo'
- ClassName: 'lhyyxtkczautnsmdrhpteysrmnfqd' WindowName: 'fxfhdwfbtifzasuwdcghorapd'
