Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'lcaihmqaoephyivvavpdeuam' WindowName: 'erltdzyvvsbhngomnaun'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'utqmjazcacnxchpq' WindowName: 'apzfrexhtryyygkmvimit'
- ClassName: 'wynokwfvjxenivhoqw' WindowName: 'ymwvhrepbadpmmcrvinrjurnhkqbitinwa'
- ClassName: 'zadpjudvvbtcbrgptiracjkvqoc' WindowName: 'zrpqouscaqudtvdbakvokqbdtagswhxzbvcsfx'
- ClassName: 'nygufkozcdskiloxvmchdhyuanjzwriwbplbwb' WindowName: 'qnkopcufargftkgybakzwgiixuvgycojfmejddx'
- ClassName: 'cwnjbjrmixbaxhiqelyzffrwselldjuzyhkotkw' WindowName: 'prkqysitcqfgfiuclowxtvcmildtsvpngdywypg'
- ClassName: 'nkxupirayzcilfvooqdfjgzrx' WindowName: 'jtunvxcnxvzpsibzkzb'
- ClassName: 'mvtlmfuthabtgmjzlmsxgijlvzfag' WindowName: 'vtxdaunkrrgstnalnjml'
- ClassName: 'jhckoqkxqzpsclvpkljdscb' WindowName: 'qavhdwiklzrdaqakfdima'
- ClassName: 'ulxykgdmuzxqpdrasjlhc' WindowName: 'kaxsjundkcbvbnpbjakaydwqbzojjszx'
- ClassName: 'znrvycyxizukmeihqob' WindowName: 'gvdynhgxxbucmxzzgiscehpvnjzn'
- ClassName: 'nuwyawlenftrpzvweubvwoyjhwewbrynkpiiyzl' WindowName: 'ouusxispneabjwtocljxeqvydjwcwtjymd'
- ClassName: 'tidwjjhccmfejhsbftmcdxuitxedramjlpobmsg' WindowName: 'nlijpoecswnnlzarlfsslgwvmtibqfwvuyp'
- ClassName: 'hywhhgwmyajleaqaitajzihhkhxda' WindowName: 'rcdkxaflfjujdovhijvspoihhb'
- ClassName: 'eqbnwjxqoyxusrytjcyqadak' WindowName: 'esekepdtwdvoarchuandnqpcf'
- ClassName: 'gnwxrkcgatlodcyiwnnik' WindowName: 'fuhkqpvwuqmurfbagtlihwudykjtsgpqucbxid'
- ClassName: 'fxsxxsnqhsdlkopjhkuxvkvjnggqljn' WindowName: 'hvrxdkzhgfauduqpioaqfebokzpnqwqdf'
- ClassName: 'fwxwbdybgruecgeorgkzptuoroktlpigxnjwxnq' WindowName: 'vknvovyulbghnjpcsqyvkcfppnusvksqly'
- ClassName: 'btugmhysrbpgrjsjabrdemebyiyqv' WindowName: 'jvbowmoofuidnvbbkrqatkicdjfmaaqs'
- ClassName: 'ggcoakyzbeqvqbdimp' WindowName: 'fwwiyxrcpjjgjszxjxmmemofxaremlvzwcbifg'
- ClassName: 'gjrakdycqlllcrf' WindowName: 'ukrtwfrhmitreitdcpmjbrgqdl'
- ClassName: 'dsdelaxcuxqgjymxgqtgtgfkaltzyv' WindowName: 'dlsrvyvrkxfswdukzmtqtpyuedlqlsflgpt'
- ClassName: 'genxmrajyxxhfmyljgutqxcc' WindowName: 'fiortrflrvrqmaguteeyrnxaquhcbnqcmyprpje'
- ClassName: 'rvyxxsxtmbqeeimkzyswjfzsegkt' WindowName: 'eeqnhodijijnssdvgdv'
- ClassName: 'kvxdupppqjqedbhm' WindowName: 'qjqgkqmbrlvrfwkbftvsbbzwajzyakrwhohwooo'
- ClassName: 'kwowvymazibysbix' WindowName: 'mxaeinazkjxsjpsjxuztqzihyljitcljgdbd'
- ClassName: 'hprkjmtuigolnpskxzfpwa' WindowName: 'ebihbnjmbbsoqidtzyiwbqszczgmi'
- ClassName: 'vwuxqbdursfqmtrd' WindowName: 'auxclfhnyblcxhenbdiaw'
- ClassName: 'kragsjbwrjrfcpakifmbnnxlorgxsliwewkoehd' WindowName: 'tmliwukdstebfxcnnbirdue'
- ClassName: 'swahfjgxjjcapmabp' WindowName: 'oiuxlnkedlhzktslscimshqoaxfawzkzqncy'
- ClassName: 'ezenhbhqxdwikhupbjrsjzmqredzoj' WindowName: 'ngkveduxhsbrvghtznuzmaywwrjr'
- ClassName: 'arssoleypducxubkmiqitaxvavlrnsaxmf' WindowName: 'ibnuigzknbatxirjccadsxvuz'
- ClassName: 'nmbejzclaxtwpkumrjwnhb' WindowName: 'dmvmoinhdravwfrvosfxrvrbqvaozsc'
- ClassName: 'qknxsiqwbejnbfmkpdfjgjmvlmyzkalegjxm' WindowName: 'xfnqzluctudajjsketkhjtwzq'
- ClassName: 'nrmrfgdkxztymdijrmncqq' WindowName: 'cnmujclgxabxtalfsrqmihdud'
- ClassName: 'ehkfdpumjcrsahwzalxfgnchbtteigtlhppfnpz' WindowName: 'qnnihyccuwxizrkgrzpzfym'
- ClassName: 'ajpdjbwadwiquwzwqrcupxewwdtolzzwidhod' WindowName: 'ejuhorwsorragsnxksgnkiymfqajymnxo'
- ClassName: 'vutmcrfrvcjlamcncjflvcxzrpm' WindowName: 'rdipkvoitycbcjymxltwbq'
- ClassName: 'ukkhbfrrbvrxidbtsrzljhwcbquzkwhegff' WindowName: 'xhfotsimillpwdhriojsb'
- ClassName: 'bwhypbaggvmlubyhdrtvtvuyu' WindowName: 'kgjmztiixacxvqbqcjgebqyon'
- ClassName: 'rmwxiqfsmvzbkgabpeapj' WindowName: 'ymkbhlevltnnummadkzqwgxm'
- ClassName: 'cndlhwyzcndilptaaviznbcwjbpbtwjfcdd' WindowName: 'qemvjgxfgfhvokadunnmczicwhpembwfggh'
- ClassName: 'vmqxqpgeykjjzkqqltakffnfonr' WindowName: 'lkitvmfnziefiaiugssm'
- ClassName: 'gpilnymnehptwixqasoqia' WindowName: 'tfcewktvljruecpxczfzglajafwhddxqwpcni'
