Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'waoaydnnnuzyfuznhpakrsr' WindowName: 'jgsfpfycflrlhbojcwvvkjxdpsdccfeucmiami'
- ClassName: 'xuzdufejdlkgwxducuxxotegqdazubxyovnllz' WindowName: 'hyybmuhsctfmdydf'
- ClassName: 'kjdscefewdfjjrzwspwqfyrg' WindowName: 'vhfavnxhjyomxqycqglqmtj'
- ClassName: 'rkjbkitndguxggwawnweltmmfhsxl' WindowName: 'echoexebtcallqdwmkkfvgol'
- ClassName: 'nkbsiaoaneedgckelgjkrgskchthcrroe' WindowName: 'naraotkknswhttv'
- ClassName: 'qqhjewllargbytnijnaiqsbgvehj' WindowName: 'xhrcmwnypkgxsskoyasvymuvwlgtirhyodx'
- ClassName: 'ydmiwbdfjyllwosmipvmwk' WindowName: 'fdajxqqugofdkmzusqtcpgzsgwhx'
- ClassName: 'jlfunnkdnmtvgbcmuwdbk' WindowName: 'uiqsrkbopfylbhvapeuuoe'
- ClassName: 'dujbsawetvngeiiymnppweudh' WindowName: 'bwffmvfmiltuktxekfpxmkybekvwvizpsr'
- ClassName: 'rpawhnxmocreqbbypmldsdv' WindowName: 'rngdoshmrnpuxzu'
- ClassName: 'mdpcfjpndfmohrfeoopzvbbborltqiwrmbqd' WindowName: 'ojechxtkmlvosrgpp'
- ClassName: 'itztfythmeonsvidpmmebhonbwqbcn' WindowName: 'lyjocmzfiloyvopygcwvaeugzgv'
- ClassName: 'zbkaauoevhrrranjzzjwf' WindowName: 'cbilvfiogxdctniloqshnq'
- ClassName: 'bzurprdrefcrwjqtsv' WindowName: 'wqlrdrikzmmigdelluivrtkrjekwpajkigjhd'
- ClassName: 'ktdgvpmjxtupcbkplsshpgmxxfoo' WindowName: 'zjojjztzeroaslbturgxzuvmezbq'
- ClassName: 'erbowizbrzmzynfrch' WindowName: 'iahdnbmnrqxlmfzbpavollytw'
- ClassName: 'omdhwcpcdmgnzghfeiezynisofgndyqnjujl' WindowName: 'gqfovwcuarolzddzfzvcfgevurfnbbxifjnod'
- ClassName: 'ekocryeuqdyjjnlxhscvvadrvlqnb' WindowName: 'htlrrhyfpwbwprjidhblceqgt'
- ClassName: 'nnukeubibqszxrasgruirfchqp' WindowName: 'eeevwwtxnjojvamgjdtczbwthri'
- ClassName: 'ibdqmbfcrkrhqmefhzefbqhhcn' WindowName: 'vkmmnjpxwwuavnpzpjpbivcmekmwqaoozrcbhpe'
- ClassName: 'tosssqfqlpbhkjoedirilotfqyg' WindowName: 'ldwfllckcgnaxllcmntwvsndwp'
- ClassName: 'ddtepbotqdwermmjismzx' WindowName: 'skwpwyshaaumjfvgrglokv'
- ClassName: 'lvvevmldgenugwthbecrqbpvn' WindowName: 'fhvdtjtgxaqejld'
- ClassName: 'qhrvlsfgoatviyvijvlfhrgwnnadlhhpzhn' WindowName: 'iuwikgkyxciqnurnhemqq'
- ClassName: 'bescehbxapsjjjoeizsjweunhvgknzqtgfvj' WindowName: 'ialjdbnilyyhexljhpbvvjdydekaeksppk'
- ClassName: 'jscgfzgxcpydzsaqyibbiywmg' WindowName: 'vnzotzpgyvysdkp'
- ClassName: 'gufjomyqpifijncs' WindowName: 'qoecwvvvytgoqnjc'
- ClassName: 'ghiycnypstshrukyvnnninslshilfsktbyln' WindowName: 'viepdeavvgdyczlawuvslfzaayz'
- ClassName: 'tdykjprlplyzwdpqnqiatwsyus' WindowName: 'iarokzjqnsecwvvhdggesomgrdfddgxksshsruq'
- ClassName: 'wqucvnrovqbuathrgywoc' WindowName: 'hlolxdzfzqyeojwztxq'
- ClassName: 'qvidnyemrykgocprsfciscvg' WindowName: 'rrobyzvsklapqpfwneyuapwmpnslrdu'
- ClassName: 'yrcfuydsqsmdllfrjp' WindowName: 'tndcqhmigmruhoymconecs'
- ClassName: 'ijrwqmgnruudycornxqvyixuo' WindowName: 'hmbqdovvfpddihvvzpjdkjiwogykmottynzksc'
- ClassName: 'iuoymrblcfbrewbwsgotpcqdvdmmx' WindowName: 'imlihytqunwybbppbeskcz'
- ClassName: 'aalgmcqxikcqeedsoqtamospkhhmzgoru' WindowName: 'nqbuweoyabolmizjgnxijrahpsuqvlqmlrx'
- ClassName: 'fbsbiixagrlxassfkuvnqgagttkxciolhsb' WindowName: 'esgbsgysacgngzujbesqruxm'
- ClassName: 'hxdhsdewgyuhuasehgwikjbudepvuokxubvx' WindowName: 'sdynzcqkxprigfa'
- ClassName: 'sshwednysiwgxpkkpituqrgglllthxhhmltnhwd' WindowName: 'ifbxkcblgyclxyp'
- ClassName: 'kpitzktzscdfslleupzdrszuguzmomhsrdk' WindowName: 'vaftcpedrtorwiiekojyxrghwdmph'
- ClassName: 'wcxcrdagqlxfjiguexoymixztarbsvsahrxb' WindowName: 'hdolsezbptesdeorogtrgwswbx'
- ClassName: 'zjaqywqbudzzvcsjykibvsxvfcieulrmyg' WindowName: 'pmkrdvqfokhgrnzvjkmkwqjkkfhqxew'
- ClassName: 'auohaiuhblrooggyrc' WindowName: 'fusmknaqgfykeylqqqlypv'
- ClassName: 'wkvupgbytkmaqzvyfplrramcgeu' WindowName: 'anqawbkljardilxdfdijpnralpveacf'
- ClassName: 'oqjtpqfpckqkfkgrdbixtyw' WindowName: 'owlcccflcaiolaooqgxtecatcspcbqtcta'
- ClassName: 'qozfiaqrmmzsyvfjpzbrs' WindowName: 'lupltjgxiebgacaizjhrmpgs'
- ClassName: 'oywguecnzzrckazweetxa' WindowName: 'thdjweocsszemkerctxz'
