Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'sweybfnmfmecmknavprw' WindowName: 'gezakcgamoqljcdwgpdfoxbjdjftlgejgbn'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'yarqwydwwwqxhuomfjmymmn' WindowName: 'codxapmdqmybjjbsfcnfqxiqntcxbjc'
- ClassName: 'pswqdmyemgkbuvoi' WindowName: 'doxuwwqnswcsrramtvw'
- ClassName: 'okeflxlgjrshjmbluod' WindowName: 'nyxrjwwkbzsihncklcepblesf'
- ClassName: 'nzjwnnaehijtfycvymbzgwjtjbvnnalsi' WindowName: 'klstdrfthvsdffnkix'
- ClassName: 'rnjcwxtmualvfoilrnagjnjvayyktigdcpwjk' WindowName: 'bclubvaidpcbyeuvjeoiqsuk'
- ClassName: 'stwylmaophvjzekatkldysnvlukhfaaodkjni' WindowName: 'xbidbtxzeadgdpc'
- ClassName: 'kqvecvvlgmokvfgggibfozrljapexwftmas' WindowName: 'fjfoacolxebjgcmswox'
- ClassName: 'vpuoquzgsagpqtjluvclgmtmpfhxplvpeqx' WindowName: 'cpokehzqfglnvwvknqwylckmausqksgbabieba'
- ClassName: 'kvmpspkxbdsmohffiouksxtgdeowuu' WindowName: 'wgsitqxoseutvbjhtdgsyu'
- ClassName: 'uatgtgovaihtmqra' WindowName: 'esgcgyftmifutychlpimjgyjclsxjqacits'
- ClassName: 'kzncoadvxywbqdtzffloibmwlrmty' WindowName: 'glspcjsojbmwveygnduovkogaavcooihwjcebo'
- ClassName: 'fcrfkpzueesjfgwycwzcqixuhklnkfh' WindowName: 'nphalkcvytsosvrxncmwjdx'
- ClassName: 'srqieczcetdoztymfhwafqleyedjndlp' WindowName: 'iusfghdukjeklrkonohrmvn'
- ClassName: 'batlzklaidigyadkcmwosweimwfsfv' WindowName: 'qnceftimhkfbmqgrqccvxfg'
- ClassName: 'qwswadolzqexjxig' WindowName: 'glppngiqrxmlzffxng'
- ClassName: 'zljxqjpqyykbjtbmfwatipshlrpqjd' WindowName: 'afeynmssgpsfewhgkqcbprlvlvoofjo'
- ClassName: 'qalkwqfypjuqzlnaxdcnrluml' WindowName: 'zbofkfcxpkuncxej'
- ClassName: 'uvewpptbtwalsgnsdutjyaeqrlhirzn' WindowName: 'tqdkckqdojsfshdhif'
- ClassName: 'rmiweuspctjmizodtpsctdjarjbvtdalxag' WindowName: 'fvdpeuqmyatlmceglejekcikuheakzqxeu'
- ClassName: 'rjipxezaidlymoitamhrnxefjalxthiox' WindowName: 'fotrrtmbnnzpgrbxrxyhizapgfumeimliafs'
- ClassName: 'pkuxyzbuztnmlsnheoolautaefgjesppcihg' WindowName: 'yyxgntbhnqojfjhlrrwpdfeildaurfwbrrkszf'
- ClassName: 'jesewcgptkanudyzbihip' WindowName: 'wuchkjacxvkpxjce'
- ClassName: 'irniypzherqfcsjn' WindowName: 'seoocjnistyfdaccnhztsvagsvpsjxbzzhs'
- ClassName: 'gjxomvuvjzodllxklihmdgczhbugojiiikoqom' WindowName: 'ekyycagvfzjcxuoldctombsuexafojhzynuu'
- ClassName: 'ntdfhbzusxftuntvjujggbbotbbqumlphce' WindowName: 'pyvtnqgftoymyynvpymziexhl'
- ClassName: 'bunitzbhctfvhvttjagfwmfvwjrgarmkwcgj' WindowName: 'ingnxgbckgllzxlskimotldr'
- ClassName: 'qcaioxmizchscleosqptacuuwpcqlpvanncw' WindowName: 'mtzprcowhpkftqhcjrln'
- ClassName: 'sbumfmznydxwghjsabni' WindowName: 'xgokpfzokmuoutodyuxiwdimh'
- ClassName: 'gxrsiflebgzzbogfkhzwavrlfvrydsrjxvzcxx' WindowName: 'cmftbvfeeqgwrummxwxlarfguycahsijifnv'
- ClassName: 'rhlwbhoyrfkswyxodnnfaqjfuenindpuim' WindowName: 'dvcxlmhiqtiwfsvtiojjzqisnqxzjouswtf'
- ClassName: 'rapumwxuvfdnljyqorriwkjvcqyb' WindowName: 'jwjdxmvrpelfxrcwz'
- ClassName: 'jbwgvxipwjurwbxugmvvrxbhvbficzztb' WindowName: 'hvyjtocwlqoxmbruvgt'
- ClassName: 'nttrxonsmiulgrpmlbz' WindowName: 'xakvrlzubpxzqbdckpyymvghcjt'
- ClassName: 'wysiknfwcxksdlyfjflmbrjugadbnopxhhfdimk' WindowName: 'rwvsnuzepnurynkmmci'
- ClassName: 'glpywesyryazbgyynkrisvgjlwhrisyfjon' WindowName: 'cwhwrbtusgvmubwdkcyojgblxmpahmpclitkvjx'
- ClassName: 'rblpdgrankkqauldfwamewv' WindowName: 'jiojzhbkccpcluzwuwnnfb'
- ClassName: 'ovacntatulcuiugcvqjrf' WindowName: 'jbbkjwbtvsoxzyhncjshxskvemoflugkk'
- ClassName: 'mhamehhpvjdjsalwqegwwiczj' WindowName: 'tmygxqkyovbcgxpxudagbbuocizdbqmndzirn'
- ClassName: 'fzukbuizknrqeqlsnfefvnexbczkazqptvmzzty' WindowName: 'iozuqzdgzeoobfrwjnvqnvzhzqotodkisyaaoz'
- ClassName: 'ekworeceftdrntmelqvuvtkanq' WindowName: 'bjynsqrrglkkymqyiiowmqexbgmzghkjoh'
- ClassName: 'wnjiimggsyhrangghwy' WindowName: 'cfiohjspdvqwjspcdbgdlgomsvskwutkkjcqa'
