Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'cutxtsxloletvkoaajkfyjfjadcmrq' WindowName: 'rvicbupdjbtrogjpiwssiblseznqibey'
- ClassName: 'trkqqovfkbxdlljivmtdrfyvgpfcqfdgkbukv' WindowName: 'wprtwfpkligpqpgkfogfvwv'
- ClassName: 'grpopbhhpsojderukrdaljqmfyqiyeeoia' WindowName: 'qvkclogpgsdtihfnldgntrbbplvtwupsoamgr'
- ClassName: 'pccummnnuwxvwxwcjiievmvhfqs' WindowName: 'gztilumhrqvuvshz'
- ClassName: 'shsjraqjcwpwrppfokdhgklowyk' WindowName: 'kfqxvrlueqzacoumrf'
- ClassName: 'ybvdgufbbytgwpcqammpzniwlu' WindowName: 'sizgsntytvxzjbyfzdxwleynqfnaqlevbe'
- ClassName: 'xsntmlantmsltoobegqedzcssxw' WindowName: 'chnoxyisfpqyqbakbwimttqzmh'
- ClassName: 'bkmtunbhkbkfcyax' WindowName: 'rbzrbcbipugibgofqpswgywmthbgutpxrqpzdmp'
- ClassName: 'efqygaymfqrpqecucjozxnruhzgrkbzdifay' WindowName: 'xjgnamnqieldumvbhkodwk'
- ClassName: 'tvrugiqkeevwwqywwj' WindowName: 'tfmdptmakuiykeuga'
- ClassName: 'unrmmxqwywemqxwbczssijmpowtecrz' WindowName: 'klhermfhtgkkruizmhuccprepdrsdo'
- ClassName: 'mouckctjrehxztunbjqzcl' WindowName: 'xherekkrignjpijragadnhmot'
- ClassName: 'ebgxroiucnmpsfrxtcyb' WindowName: 'yqinuhhsefznpwdvrhlqiz'
- ClassName: 'btbpvkijxxgiptqbyryyqqjixz' WindowName: 'qesokopjyihgulhnltkgk'
- ClassName: 'feqzaycqwozqtnoeauogqlgrrxpabhlpngnifv' WindowName: 'kqtshsuzjamzbdy'
- ClassName: 'sxygobjhttdlrsbusherbbosvgusejjlysukp' WindowName: 'mmhdnddkjksduzqyrzcwjgqjcjatztonofc'
- ClassName: 'oyzrxygbdeirflhusszrnihofsblple' WindowName: 'vpiohqlvkkjrbtaagxtvmbytgatzmnxmiegjpj'
- ClassName: 'npumrcrymyyjdxtojhyzpjpbncdyhphh' WindowName: 'esgxwsfxpbgjsprwjszrrcpwodhhl'
- ClassName: 'bsxdqkscvalbpptwrwtxmlufqgvdaaitdtytphi' WindowName: 'lkuyewrhhwsddkpnvgrqwi'
- ClassName: 'axgkwceiwfiiclivnwozryj' WindowName: 'cojifgjvygqqvjhhsxyomj'
- ClassName: 'ixvpflocowkyheehgtcgvvtvqvfjp' WindowName: 'kamdeblbxptxhnuditlzfrdu'
- ClassName: 'ussqhmkjykvtmdbgjdxi' WindowName: 'fxsepcyjjtunflmadvufrwoo'
- ClassName: 'ieaiepbgwltliyueywnrtiatb' WindowName: 'hdvedacyotlbgutirfpbkbwwsbyni'
- ClassName: 'ownqslavtdibbrjd' WindowName: 'sqrzzkhwkrzjxag'
- ClassName: 'pnlsxwffdkkrvrgfxzjvowzrzjqo' WindowName: 'aywcxprghjznugjawzvcbbyturch'
- ClassName: 'wxhdavzlwfdgsekcewxpbfytvuvizgswsj' WindowName: 'nzynuhrgiwdmlziztjjjfhhukshkhclc'
- ClassName: 'lueycqjinbuatlor' WindowName: 'vjfzgcbwzbhwbqm'
- ClassName: 'iuajweqhyhddwodslxdvzgslhlcyuzgrenx' WindowName: 'lwrplgqncucgqussezchethquibn'
- ClassName: 'mshiapqbskyzlbclhwaghkfrfmvwvtpyk' WindowName: 'qbnvgtehxufsiqoqxurbxouninzj'
- ClassName: 'thjabbfnzvdybwb' WindowName: 'acdkkohkuitmvbijzickeqjwkri'
- ClassName: 'rdimfjvzmmqtyvoh' WindowName: 'bjvtmelbutwujxvugohjh'
- ClassName: 'qpkwgdrpfmourfffwfbcal' WindowName: 'ahhbfshobmuexvgwcewecqnubwvadwl'
- ClassName: 'qpvjkkrobblfvakhfffkqfkwdsmphwk' WindowName: 'kkifnfvmlbfpxbplgzufapxvxerlzmbiiumf'
- ClassName: 'wxgtlzlrrvidifcbfv' WindowName: 'jvuqdgnnsbrbhlkeqxogsujvulikus'
- ClassName: 'ygbfciyrzxmrsztsbvimbpe' WindowName: 'ictbqiyznlzarypv'
- ClassName: 'bixbtfpoaaftvipslhsqfbxfgsfekzowb' WindowName: 'fhbmvramkexjabqspbmtpbvtd'
- ClassName: 'azvwfwhgsvppawdplyeyosewmzg' WindowName: 'xebczniqbxfoxpamqsusizcutoakd'
- ClassName: 'lsivysmlossedkp' WindowName: 'xfgwbumbieyshtszmkxzxp'
- ClassName: 'mzoaavhoztsgppntnihgodybifeaemaqvp' WindowName: 'cqimyoxceqamhzgpoi'
- ClassName: 'riqfmehhigqiljjgibayurzlcgxrfqduu' WindowName: 'xmmkhbgrnutfexdlmpboeoqmqtlugyb'
