Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'kgnoddiplcodyavpgtkyllxvvpefzci' WindowName: 'pcyodulxisxdbxakf'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'lobzmoaxqobnlybnehbcqwxhywnojqfiivfrvx' WindowName: 'xiiebjzvsfnzelpcmnshemfikgr'
- ClassName: 'ypnsvfftvyqydsxnoormiqqfrica' WindowName: 'wgpfzvnvzohecxijwltcycd'
- ClassName: 'hoorfkorbxjnjzbjk' WindowName: 'ynjuqjpxrlahvjeelffaayvt'
- ClassName: 'uczleteayfzasjnojtcfcayttpnsbxasmwvd' WindowName: 'fidmjwtycixyzyxcyepbxwpx'
- ClassName: 'vphulzohqwvhudhpudhzxosfzjjkypdpbrttyzt' WindowName: 'jbyvzvzkxgtcsuyysgyzklvwiqbwvzmwhrfx'
- ClassName: 'rjyqvotheldzancsacrwwykzzlqmsqgi' WindowName: 'osqkrfghncrajsjr'
- ClassName: 'boxgeheegmohjtxazekalnawiwdifbdcooczky' WindowName: 'pvdpunncnhxseqyowo'
- ClassName: 'vpsdnnawwzofzmxszjoedum' WindowName: 'qohddpdgfcxxnjzywruyf'
- ClassName: 'tsotuldsxrirutk' WindowName: 'zmaycwclmdgjzkkrvntvyuwd'
- ClassName: 'ceonrjleiojomayrifpuvsvwqqdsuragpp' WindowName: 'opqnqoahvhbbueycheouqmydvfvehlxxkypm'
- ClassName: 'azmuupxseieovskwyqrinbiogkcepnpsfd' WindowName: 'yzpsypxjqcnwznkrohlq'
- ClassName: 'yneggzlicjcdfxculvdeieddssjiwsuqslsu' WindowName: 'ynxvwekqccoiukepveuapbeblursakwcgyeaq'
- ClassName: 'ldaaejrpovvjuzbfglvmwosyvghwpi' WindowName: 'xxxswsjfusczqqkdnikepwyaunvvyopgfrx'
- ClassName: 'zyetillhlbjndvhowhlgmejogbw' WindowName: 'brwhilifwfciyfnhzzcamgdjigciuqesbbsba'
- ClassName: 'hooxzphndfdhzfgccfhvihmgxi' WindowName: 'hjawclglqxuiokmihvzuxmfxncxojhpvikspe'
- ClassName: 'ntioqlxiaucnfkvctvqxgj' WindowName: 'qyhmlqbfejdmjlprtmphjrecsf'
- ClassName: 'lvojqdcjycbkpmadwozeodyjwwnvzzjcni' WindowName: 'kmxmwxzyrxpllkairzdyxh'
- ClassName: 'sjvotrdmnttxefheyttkrfnpvjelujqtbb' WindowName: 'saqxckpakglqdijvippmpccwen'
- ClassName: 'ueefccrzvxnlrlxsjwsiiucejq' WindowName: 'rbmgjaqamiforpytzavsblcpzjzldkh'
- ClassName: 'kfzwrgwldidrgyszosgoze' WindowName: 'qdmqzyuwirzizvxzkttkstzquc'
- ClassName: 'xpyneceqsactiaxaesdvvtfoop' WindowName: 'kkftgqkpjocizcefwmsyrzcnubwxsfxgya'
- ClassName: 'gsjzazxgrpnqkaojyzjenwowkmgcryoqjqcoc' WindowName: 'bjqlrprdmpaewmusomvcmjpovazfhmprt'
- ClassName: 'gjbskjbasydoqtx' WindowName: 'yecpescdjcwtfqysjntfehnlzvd'
- ClassName: 'uutuwbikoxesrutrhlowp' WindowName: 'dhvputxscnmnqitrenfwzinmnmhuh'
- ClassName: 'xiqwwuwepgiorunamityqhisegnfuzr' WindowName: 'zjivwspmnafufvfk'
- ClassName: 'nuyjafxopufbcvzrdfueyakzpsrqmsu' WindowName: 'wgywoonwcpuhviweeyyoplf'
- ClassName: 'wyixsxrmvdxisybxfrfvrfjgmccecwpsup' WindowName: 'ffatmrzmrjgyypxwof'
- ClassName: 'bbcgssylnflcrpxhxdmuue' WindowName: 'hzhvrsrvedhytcahcfhpsouadpygr'
- ClassName: 'weqinhsbubdwnpjlstpowygukoc' WindowName: 'zuhlvyzhwoyzpzj'
- ClassName: 'kiyynnqgjwqhomuplcymzfideztndtg' WindowName: 'lcbzrhackcwqddrcdxcegrdqvptjlvmipixoi'
- ClassName: 'wvvbrxqazdtmgcxrrdponmmxfz' WindowName: 'lezwpsmwlobodmsmlmvqhqbapqmvvfpns'
- ClassName: 'rkemocqmmsfnyljypbsmoxg' WindowName: 'iqjeerqvnakoclnidjdspwbnwwchilxo'
- ClassName: 'mucuwtlgdfyffgyidf' WindowName: 'ndcphsruqnbgsqnjsbwcstxtzdhadsak'
- ClassName: 'wrvbxgwexotgepzbdstrqwlyvudy' WindowName: 'jjmophkuezpdfpmavswlsilgqftdqdwaoxdv'
- ClassName: 'vlqiqpkexmefwywazmbfdynxifrwgnveylzhuui' WindowName: 'aldgcjqraioqwkuefixnkji'
- ClassName: 'ptwopeplltodyklmyt' WindowName: 'bmietpilflciqpbmgfrtkg'
- ClassName: 'rffxbqlykpapikwuiuptf' WindowName: 'bbopdbyiusxjxysizdlwig'
- ClassName: 'atrnjtacvogmzzbiqhwtssxirnqigjebzcj' WindowName: 'pzhgjrfwdlvzcodlwm'
- ClassName: 'yejyeqpdbpydagfgawvzhlb' WindowName: 'hdwxatqibihslxrwyenugjytkis'
- ClassName: 'svxfyasjwujehlwmxqtbi' WindowName: 'pomqattoxcjucckm'
- ClassName: 'kplpcikqnqnuoiulbgbdlkotynrgzlbiixnaysj' WindowName: 'xjtttyqcfdebxhpzuzahfuvzyvlkmdmcv'
- ClassName: 'dhtzihnknanhqdbvycl' WindowName: 'edtfuzjrgrviyiownrlcbqjf'
