Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\Math.dll
- %TEMP%\nsa2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ltfdmdfaxltelczneoy' WindowName: 'enropukguixmkkvwzvdgg'
- ClassName: 'ztibgouuixfbcmh' WindowName: 'uhafhhcanbcplxgxthpzrxhazseqsavdk'
- ClassName: 'qrcztjekjjcdtweqcdpfpgpyvzxlj' WindowName: 'aehmbopeeatruxboiarfvpeswkamrrlfcgs'
- ClassName: 'jqdsmntpitrawugykvviolltezjgbmat' WindowName: 'dogebplucpftvhvcbqsv'
- ClassName: 'qmpbheibcahgmqfplzraotmrjjyvvxlnpzx' WindowName: 'wewibdcdytyrtpypaa'
- ClassName: 'ppmdxulreoyklwlqqzgyjcpqpu' WindowName: 'olifzcjnlbqywzdhblsh'
- ClassName: 'rhkmemochtbnivpmsqcwcfzb' WindowName: 'xymkkekdpzhbxkut'
- ClassName: 'yjzroklliythnlhg' WindowName: 'swdkqlensshvxakzatgobnzgctuyl'
- ClassName: 'vritpnfuferzgvvntqdiohm' WindowName: 'suxqavgrwfjixkjxsxmgioenlmqgteepzrnfty'
- ClassName: 'pabebjgnemjuwuackhhpkvibzecjdtgk' WindowName: 'yykqyhatwmbqtrcigvlbflznexqvdkj'
- ClassName: 'bfodjltlfppwidbcbbalvaxkl' WindowName: 'qtsyaarbhoyjvmscwvaehqwzdqixivjpljvqc'
- ClassName: 'muswebbxnlegizmjyegzy' WindowName: 'lxenqcqiyoamzmzckytub'
- ClassName: 'iwxmxjipgjrztbgein' WindowName: 'ckqrpygkuqjvqmkjvjds'
- ClassName: 'qwjjxdtqaqsdlfpabvacussvaxnyqksywdunhc' WindowName: 'ulhwrupnapgcdcibdolhu'
- ClassName: 'lahnnbnrguqxbxjqxlqkaolkal' WindowName: 'oxmetdfclaeyjpklwqzreq'
- ClassName: 'losmezocxawqlhlbtufxzyt' WindowName: 'xjxzfcawrwvfwwzxgzuxkzckhdk'
- ClassName: 'rysoynltzcruntkhvqig' WindowName: 'nefjlzqqhdxfwgieaboeflgmrsvjucj'
- ClassName: 'jumjoluawmfdrelljcbgbdsdtfonwh' WindowName: 'cwcwxzvlcngkvqww'
- ClassName: 'yboktjtfkyclvudfrdnflkomjih' WindowName: 'rzyqhjpdlfzmzpbkhjrmbdnlolzxxs'
- ClassName: 'zauqbipwigcwrjufjinhnvxdayjtkglqhtthrk' WindowName: 'morgfxdfrjdmenjszvawbikbdogmo'
- ClassName: 'diugkyqadihycmzcocgyxumiarx' WindowName: 'hrldxebnfmujmsdspcslnbksmlqfds'
- ClassName: 'yszskpqtdnwivbpbuvgksuuowtdblspndmrsv' WindowName: 'gcgvapjxycyvydigutctqzdvv'
- ClassName: 'oxdtancevnjowghsxutfyknwwkx' WindowName: 'hjnqihzqgnyhfrkyaruziepkktxa'
- ClassName: 'tcfgdsagycmkpmxmroqd' WindowName: 'lepdewazgjwuhwwxhx'
- ClassName: 'ymetwuecehowydtkaziievmvngycl' WindowName: 'frzchhcjstscdplfokpiet'
- ClassName: 'vwjssvneffkoxsyerwqffxtgoabzcszsdngqhrs' WindowName: 'pigbfzbnkzgxjtpkbe'
- ClassName: 'htjhlcfwacvsexivxmzwbmcfthirmiymwvwh' WindowName: 'rkakljmngajpymiyphqeovzehpoqvgatw'
- ClassName: 'bmibzkhgnfvblrfr' WindowName: 'wgvkwxvfronxydrqmvnt'
- ClassName: 'dbzfjhkvvzpbexzvlean' WindowName: 'abwfepssalhysteffqdlwlzydtqja'
- ClassName: 'pqtxdhddzsdsnrdmpqkla' WindowName: 'cmwdhjhrhxlmfxxdfvwzufzklsxkhhqzluf'
- ClassName: 'jodknjelsenhlohhanrntckasa' WindowName: 'bxjbgacrupofpdqxwkjnadsststkhpero'
- ClassName: 'fotjsvsxvzutslethvlctgcgeeqxbusizuagtbo' WindowName: 'vcskrgmatixvwtswdrgtbumilixguqwulu'
- ClassName: 'hucplulzfuqnlstqztrnotbzpigidcehi' WindowName: 'dvmwsreybxamkjrtzkkttcmljortmzf'
- ClassName: 'tjnwbpcsfmxpsscnfokrxwrhuvnbrkexjipwlzz' WindowName: 'vaxrtqmbfenqtyiuxaukesmdiubxuv'
- ClassName: 'okttuyvyszqwyzhzdmtziqxuuxnnlqmb' WindowName: 'ctmfqxaanmcnyupvdzdl'
- ClassName: 'ntqchvtoswaigolinocotw' WindowName: 'vqasyhczpphgfsitdpvhomhbiltyw'
- ClassName: 'chxaitxqlzhdnmhqdxvhpnjqsgmm' WindowName: 'womrsqyupivjwmegkqekcsnppxbrqty'
