Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsd2.tmp\System.dll
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'eocxtkuwqsxgumcgxzvrivonhvssfjmht' WindowName: 'ogtzdhektpxeotxauivhz'
- ClassName: 'fwmyexthwsdmgbljrrfpyeorz' WindowName: 'htioxjoexhhbqivmdhibhaiqdkvjmh'
- ClassName: 'vvdkxocifdnkkimfyl' WindowName: 'hundjstpqnmqpyskktj'
- ClassName: 'fcvuwqatytadultmrppxdnsksjuoci' WindowName: 'lclrewapgnjbxrgzsxlxmxrhezqhzmjzoeehga'
- ClassName: 'gxrniqvvjfetpcdnpruq' WindowName: 'emgwlrtfwxslznefkdnhi'
- ClassName: 'ckfhlwwnctulinxupv' WindowName: 'xwbzlqnrpxqkdamylfgyaiqbgc'
- ClassName: 'kxsetgtsvtspokrludcraxubsirokwhm' WindowName: 'gwropwiuckvukkfcswqntptynxaqhmuqwiqtg'
- ClassName: 'rfeofnfsgonbvwerkenopbmsjnsikkbkkejo' WindowName: 'qgamgjzgsjaxzhzxnronhbrrwyfwihatkdkcla'
- ClassName: 'ztvjnrbxcpoauxycgpdfgnceedqzeahjerrmj' WindowName: 'iluiuufmwmzgaumhjkbnsowlyozjcrr'
- ClassName: 'ywhzzwzwaxmyfydjl' WindowName: 'gyauhfetwayiugdovdpjbyeogqwb'
- ClassName: 'gfygtwkplpruysvmbobrfxu' WindowName: 'nixymqugzmfmafqyyhgvzvgiogynq'
- ClassName: 'ttehoziwovmrzezmq' WindowName: 'iladynzwyrzkswemqptkodakbos'
- ClassName: 'oehurznzwlncwsomglqwlzvdizboepvy' WindowName: 'zgpbmfvwdiodmvudfnmcpceaanotbpt'
- ClassName: 'bqkbazyiqhkazdoomyhzawrzeqo' WindowName: 'nvqjqdrdfwphstbewbisrllmxijbiznhsmpscz'
- ClassName: 'imddwcpymwizqthrrewkkrylopdrewuwsz' WindowName: 'fzsvbjwdkxjcjhabsomciqgjziwcaqotkzdyvzi'
- ClassName: 'zjnrhxuuzyaictvihlippotnsjqwuqol' WindowName: 'vbwilznfenayvccxcemxsxojdmcrp'
- ClassName: 'pfryfuiwwwnbsodghk' WindowName: 'otmepbueseunfgyjumvs'
- ClassName: 'jatedjdcpnhethzuessodkypexotd' WindowName: 'bnfplhsjgkjerzz'
- ClassName: 'mrwupzgntopuxyjliybsxvqxjnobdrr' WindowName: 'otppiqxrfpugxjwiodyfoafqpnsxrvqgcsdlqg'
- ClassName: 'fdmpqjtcrkbtjfv' WindowName: 'qpfqvibysnqjfuhbjknsfhpfoinxbbhjuaw'
- ClassName: 'aydeuvnhozsyvfafcmofwzvia' WindowName: 'jsgziiumkkterrckyvvbantxdgagsgbgzjeqqf'
- ClassName: 'poomztlmqwxednw' WindowName: 'ziwryhjletbwcopraptxpdjxobndabaip'
- ClassName: 'mrukhlvbgtfdaxsffmhpxfsqn' WindowName: 'unyripqfmzznjkefchuruybetomymr'
- ClassName: 'eomjevphsxfieoycgt' WindowName: 'tweatajzwfzotekrjirvxx'
- ClassName: 'hvsnuklrjrbbzswwolrxtaixnqbezzp' WindowName: 'quigaczaydwbvopsrxibsuny'
- ClassName: 'itjmxsyoynmpxfgkwvjpusaiva' WindowName: 'sghtzogaodzytzs'
- ClassName: 'ulxmsudijujudzlopvfgnzjdsljk' WindowName: 'cyemxzsiynqypvnmsqaqxiu'
- ClassName: 'ritmtjqbrutjrlow' WindowName: 'flgfnxthixukddcmqtvvymcdbjz'
- ClassName: 'xflcfjmknrcozciqqgzj' WindowName: 'mbhhfnwclxrrziwibbupdlhicb'
- ClassName: 'mkhtkrfcnidbxschmucequgmpkzju' WindowName: 'uromaucllpqrmymlhsdzrmvxqsyarircwhawpaz'
- ClassName: 'qlcfgjssuspwyqcjry' WindowName: 'ajxpdmubhrhbhpqvgehekcnic'
- ClassName: 'cplwihrawvvagnliwnotqe' WindowName: 'grkcwozjosmrxjmbc'
- ClassName: 'yudszbjligmdswyfzaqewgkdeswlxuinijvn' WindowName: 'qtvqgbwyhopdmviqivsifuvozohmxvj'
- ClassName: 'jbndydpvtpragesmbuprfjatfbik' WindowName: 'tsawnckrrcvdhvaladgdlihjjczhgpj'
- ClassName: 'igotcnnusfgstnou' WindowName: 'ltlmllirlgtqrxzvbfso'
- ClassName: 'opmymfeyilnefqkniceprikscgmxcark' WindowName: 'psllbxipfllpvjuhcgpyqan'
- ClassName: 'cxjzuqwpcuepgpxre' WindowName: 'ajdqbcruaevvnkbendshigbbd'
- ClassName: 'vrccawowzdeukrgvioqspcrsffqhoxzghxpexak' WindowName: 'azgyoxfirzagobqxnzy'
- ClassName: 'qlygnvelfjotldpkqphfrusfpbzk' WindowName: 'bimcazlfbahbgmlmxilxppzkwumtcjvsq'
- ClassName: 'hmxjcxjkqcwumnpdkby' WindowName: 'mhlobofmzffqoqfca'
- ClassName: 'kwseaxutyjvxxfhws' WindowName: 'tdqtvqlwuwxzqlmia'
