Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\NSISdl.dll
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\NSISdl.dll
- %TEMP%\nsm2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mttakgywzjroile' WindowName: 'cngucgnblimjtxnaynaucredlsgl'
- ClassName: 'omneszgwdxlffzeglwgbmppnfw' WindowName: 'zeiepcusppmzqrdx'
- ClassName: 'aloypgsrpxtcndxhklwxle' WindowName: 'ixsogknngmpdreuyqtdpelugncnnoqayh'
- ClassName: 'jjxbfhhvxuociupmkiwdsxykbczgodgnxpa' WindowName: 'ubolsvwosxobyoysjqfnviegekioneui'
- ClassName: 'grquxqlkgxlgqbrmpdgpto' WindowName: 'uwcgxgagiggafdsekizlwubpbxijmulafbq'
- ClassName: 'gxgjsoanetdfxdqg' WindowName: 'cgedzbiaqmzrojciszilvnkpwtrqkcpjatrl'
- ClassName: 'ryrogvmgkhjekkagghvgvwuurkgaqf' WindowName: 'bzqpxqrdnmyhhfurznhuwqfeppsg'
- ClassName: 'owtlgqzwesxvoretmhjspbb' WindowName: 'lmxnyybldaovqhxxazqabtedynhc'
- ClassName: 'wegwfdlcopuhnmcu' WindowName: 'kvsyoqohkaiwhujtbbmonkpnnz'
- ClassName: 'exrsxwkvounqtetj' WindowName: 'prbrtmosnvqfvpymspzxg'
- ClassName: 'pnwnvdabfdvxayjdhfsmnlteekxrlo' WindowName: 'nqfwfsnqdttgxuhphwucnm'
- ClassName: 'fuicbycssplcqlyultgwvfrhi' WindowName: 'jgmutsrvxiostokpqyyblxloital'
- ClassName: 'owiszixidtmqdzwkiecgpapexozsalg' WindowName: 'ggapixadrksetfykxljoidaovzefncto'
- ClassName: 'ecbpngcumzfaiqgwkvlbjozbprdoczzho' WindowName: 'wiqojmeucrxmrhonwanyln'
- ClassName: 'ieauruxveopygqwplpitqnyrljwrqvhrjzicb' WindowName: 'dxpztsnmrpothbkowud'
- ClassName: 'himcmpkkagcewtymbnasvbrtlnsjbpbdwamsm' WindowName: 'wdzitpywhehujxkgucyvoehzylhpxniss'
- ClassName: 'kmqugbknsahwwvqvsbjttqlridkjpnmahknjlqs' WindowName: 'mhuxgsxcnwbqnuwhlvoxqeczbpljvxavxyt'
- ClassName: 'ujkljednizesrilp' WindowName: 'domszxvgmmpmktqwubssculw'
- ClassName: 'myweznbpvqkyhmvquljiaakpfrzx' WindowName: 'ugutidwvuxemskx'
- ClassName: 'arnpkujtncjavtidzzfibrnhbfsaajvbl' WindowName: 'swyzbdohxhziwcnqdfbyglodfgm'
- ClassName: 'kbkmvkkpfomyjuyioofk' WindowName: 'fekunmtviagusqmyqhsoeluir'
- ClassName: 'vvggkqaboczmtsxogszgqu' WindowName: 'gmjervhxkggxstcksxvdyuj'
- ClassName: 'aetpawthkpmetjhfkzssgquxzphucjn' WindowName: 'wonutlxhulksartfmxedsgc'
- ClassName: 'txbbdwkzwvvjvwjzgv' WindowName: 'vqigwvlqgorrvrokhskfuosynd'
- ClassName: 'clynylacgrplckosrshq' WindowName: 'ppgccquqwonuembcgcsqdnonkupf'
- ClassName: 'tqqyzuqlkobtnaaimlaoijeygwzpqe' WindowName: 'bfsubtuduzwofjjokmcgismfqqeeektxp'
- ClassName: 'rusazihvozfmshvyumphzwhnmftlls' WindowName: 'zdiedjoviqvlkhldpwgyyn'
- ClassName: 'zydxjkpjuceqzudxosstawxmhygyrmckx' WindowName: 'hwxoknozqrgtpcxbstmjdzkdaortwxrelfxut'
- ClassName: 'tisxvayvfgennzckxdocdvtpttuujrzrsthpw' WindowName: 'pmeausvfwiifslignjgcjovneoufbkxudiho'
- ClassName: 'wgkxqusdibfwriqfgaivcrafovlskqprlrk' WindowName: 'qoesbelzzrjksvd'
- ClassName: 'qmgdyulasaqqqsikcedmvm' WindowName: 'zhxncsglzlostgfmfpkrfbitzjtmkfqaez'
- ClassName: 'okcknroaqfrvmdioydmpkltcexj' WindowName: 'zngnzhcyvkdahwkzhd'
- ClassName: 'xoqzsmtcvhvjxftjbyesrmfhacea' WindowName: 'ndxubnbdwmqizbssoombrefcicyo'
- ClassName: 'esxkowjgplsscoelxllnrnyyerdsfchqss' WindowName: 'cahpdfasbnahxxomrftcmrtnesbmdgqwvqbi'
- ClassName: 'tpxindamfmwtjmmxlsgpkr' WindowName: 'icbspqmwcixnlyoxrmcjjiepxda'
- ClassName: 'dopsztfgsbbqhndhuglzuinglzx' WindowName: 'vrscqoccnvmgrpuhnxwceliupeuwhjx'
- ClassName: 'bmqnxksbwqlugkynnwffejoddbvg' WindowName: 'bxzjrvhxthzyiaaqlirbrczdplknbqttozc'
- ClassName: 'uoyeyaisxzyfvikre' WindowName: 'udsciofslhztmjvcmosleytjcuw'
- ClassName: 'djhonlnobbwemukp' WindowName: 'bsikmjbdiwulgmwio'
- ClassName: 'rsipxzynsaywkfh' WindowName: 'xeouwdtyvtfxdyywqg'
- ClassName: 'yxukxrowfjmukpmhwqaxebubyweieoda' WindowName: 'qefpgwpxbdyzbbqnwfvkxkjd'
- ClassName: 'flaymaswmcebsnhedawjslrujbfuei' WindowName: 'hqwtaqcstqkkcdbrubgtbsjzvihgnry'
