Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'rismrdmavpbnmxkfkwqwdgrfnyss' WindowName: 'rwrejnatyzjdhvqjkesqrvfxpfosrzsfnpr'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kfuzlqgbdqgnuufetvpxfzdrzkdbm' WindowName: 'jlwtyxzbfvmgmul'
- ClassName: 'vpqtyjyaqyjyxdohimdslgyqujfmehgsk' WindowName: 'xngjjzgaystzmtpyaorkverqgucjdspoyxpsv'
- ClassName: 'ohweobfgyekdtmtzekeobhhwbhddqpuxngr' WindowName: 'gjyskdvfpkyuhyvnxitvazmk'
- ClassName: 'blosqwsrwspdtkyqhdgtqrvizclc' WindowName: 'xnhxyexohstlgkrntlmkgngnpoitedg'
- ClassName: 'uxnnlxtxplpfelhntkubnq' WindowName: 'xapvzjrzlzdezjxeg'
- ClassName: 'dyolghbovebnusglmclydrclkffdnu' WindowName: 'eozrfrfvmchpcxbcmahncmvfwconpmfk'
- ClassName: 'cdklgzakswdexkyms' WindowName: 'ouzrugqngivwyrkgoeoirklkyobeglzwrvvve'
- ClassName: 'wpcovcmcyndeujdvzsmjg' WindowName: 'noldsirpkrzzqhigwfwvgijlaspxuvbyvqbizm'
- ClassName: 'kijfsxbkhepbemwsienvhsjkbvjhycaix' WindowName: 'phxdulrlthzgoydpiwfyazxzztwlmlvljhzhn'
- ClassName: 'axjsrgopmxjdtbglvmvibhrxwfbunpgczfb' WindowName: 'fswgtrkudvsvrrytwbshguh'
- ClassName: 'wrewymfosynbtjcwpcpingwe' WindowName: 'febfkfxhlloxesfkb'
- ClassName: 'aaohcavhnooxjguyaa' WindowName: 'aakggbjthojefwybqo'
- ClassName: 'hahxbrnipdtfdxuth' WindowName: 'oahjttypjixbvucurzhcvtxzpugocxaqrmzim'
- ClassName: 'lgyfvnathheivuefwm' WindowName: 'zpqjhyjfomhfsuyxezgeppzhmlulby'
- ClassName: 'pkxxvwzhpiecnicwztcav' WindowName: 'megszybvbgyaupaneqwdwuntzdubpojwiwutg'
- ClassName: 'ehivlvguhsdicbgwm' WindowName: 'squpmqqzpoqpvrntmvrinjsh'
- ClassName: 'sqvedduuibheripmbapyqywnrejhsezbebictx' WindowName: 'jgvxzklzixmeadrvdlraxsd'
- ClassName: 'ljxbkfwqersbwnwnmjjisa' WindowName: 'isykyatbdodvtvrr'
- ClassName: 'mocauhmficwafhehuyxbokuafjrczztg' WindowName: 'udjdbgdmsekomibzirpfwabbolasucczrc'
- ClassName: 'kkgnhghkdeuhctg' WindowName: 'bqswocepwjlueahpaoruy'
- ClassName: 'akvsgezgmwgdgbcdskhxdcebmtm' WindowName: 'lafqjtcunpahzslnbqqmtggcwdmqvdubfbqs'
- ClassName: 'qybkowlmghxyrovyjehqk' WindowName: 'cnotajzricjhwchmy'
- ClassName: 'uzsmrzobiqfsozlxeyb' WindowName: 'eizmmankpekxiwlnd'
- ClassName: 'dciaqvvkjugbkasnmlxgkn' WindowName: 'iyoqmphyigzbyzbmelbyplrz'
- ClassName: 'ehlfdrnspuskpjmpjyonwffccyspwglryqhinm' WindowName: 'jfpwdonsmtcwnaqoqjhzhsmfeniiah'
- ClassName: 'jesprhxgonjhcwiwpfbujcjptwhgmr' WindowName: 'bqxbbqcewkulfjkvtxklotna'
- ClassName: 'huanywdydplyuik' WindowName: 'eafgdwvihjishyuabwairkslrwstdumi'
- ClassName: 'ufmtvibfzkkmjyqvkicarhsofx' WindowName: 'dwqhtxicasegkjomskbas'
- ClassName: 'briuioghyyoyrkaywjneq' WindowName: 'caxamwwppbexjjs'
- ClassName: 'ymfsygcdgbzauojmalfdqdnyiesmbnxkguy' WindowName: 'fvzpfriekkjlklxcap'
- ClassName: 'ntiuvmoekbigbcaklldvlwfmsphp' WindowName: 'qolkahsiwgrnzcodnjlkahetimhquwunpzhwvii'
- ClassName: 'fudukgwyekrzgmskzwvudiumpxbx' WindowName: 'xxqrkiebjwblttzm'
- ClassName: 'ropujfizjdvwkzdtsmkeaescno' WindowName: 'mrxfhywwbxresmckgjezzibk'
- ClassName: 'qhfgydulnpwbegoonxtmzuywlpyn' WindowName: 'xsozddlguwleolhzwjrrt'
- ClassName: 'tbbaemhcjyuccdaaokqkgpkqnwzczlouhsv' WindowName: 'ulbqjpmtzlhchsidm'
- ClassName: 'bqvzsqrsfsyeermwzmnidosboebfzfxxr' WindowName: 'yirjhmjgintnfjafqoythg'
- ClassName: 'yeosbpfwevttachuxtukcerdxs' WindowName: 'ctaxjjeioopxtqtsckqkuieqjwtiwfidb'
