Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'lqxszqfcqvdyjnymeofmwacahrwkkgvqqtnc' WindowName: 'qezkbwvtlniiivrgfhyjjfquzfpmj'
- ClassName: 'whifzrtgzakyofftmoqgoklsawq' WindowName: 'zwusbmbghdmqvvmampnilcw'
- ClassName: 'crtdjbtolmskjaweuixxnjqlvbmkaa' WindowName: 'wxguumpgdnesfzkacssrgvqkpnyektcofmqbc'
- ClassName: 'wcqihnlsdfflgutmcgaexx' WindowName: 'uuscszptpbsjqowqrnc'
- ClassName: 'tdbqaxfpndjypwbztsqndjzmkowntvkb' WindowName: 'ikgkrvxmcrpeeqvevaq'
- ClassName: 'xttgxfrhqdcgbgloyfrb' WindowName: 'nvvrcaafdpbudrgwevdxtigsfan'
- ClassName: 'jmvlocetgqpgjpe' WindowName: 'dcufzhinwlvofqbzs'
- ClassName: 'filhieiivpubgryqze' WindowName: 'coglanknbcnmihgc'
- ClassName: 'boxisfletbgbfxhjeujkahdgbobcooqpdjuqhy' WindowName: 'zzjaeizplbwhvylwskxsexjnpcqgedlb'
- ClassName: 'xtebayfhmlpvgkhxtwm' WindowName: 'vlataiscfuqynmlpncojh'
- ClassName: 'omaejddaetyynalmryjheblhyfbx' WindowName: 'sebeljclijiemtwrkhmnokhglse'
- ClassName: 'zuyfhumebpeavygzoidltbjipkte' WindowName: 'mothbjhjccnjfpphwgfjfmgr'
- ClassName: 'bdnbyxpuchproyvzoshzx' WindowName: 'zvqkttdwaqehxpfdxkvelxiuulisevswwkijcwe'
- ClassName: 'doibtyljnsrorehnhjfkspwadxghymxbnddmg' WindowName: 'evvayfunbacgrnhroegkfwunzwvgsscebkoolzp'
- ClassName: 'zkinldoqaqvmngoixxmagticifjxfthzj' WindowName: 'drgathsqjjpomnrfmiaqiwqxyxskeivsk'
- ClassName: 'lgzaiqktcvujtwaycp' WindowName: 'dcimkplwxbslezwzdwjnschgcgmaidgvervwuy'
- ClassName: 'zsyqneibxmwkjzujjfucsoyv' WindowName: 'zztmjbbserufwlicgmjjdlzumrxybiqcin'
- ClassName: 'yhgunxoxnqqctwuqmcpw' WindowName: 'uakjobmjnswmchtalemagnen'
- ClassName: 'zbxpkyqfouvdtefchudcmleefmfrffiunibd' WindowName: 'islozwomjdlrrcvi'
- ClassName: 'eimpezrbtkedrwplfltoqwnabidivawxumltipu' WindowName: 'zuiwqbooktndxvbsxugvpbintecmqvjm'
- ClassName: 'esbqahdtxeckvhcpxxuqksxjboxknk' WindowName: 'skmyygzytfeftdcnazuixz'
- ClassName: 'exafdvuhtofbpinxlnstukjjgdpsmoosswlncys' WindowName: 'oimrtvfapclluij'
- ClassName: 'yovemicgkublesjufgxcfkuheorfw' WindowName: 'ieghsfpltsrrawqnvrnnaoonkemwvnhzdnaa'
- ClassName: 'kzorwcfqrbfciozplyjdypwxdhcl' WindowName: 'pnyikfttiqnvbznyfknegofwxszrvuq'
- ClassName: 'pvkjdbajhhnuzyojdpy' WindowName: 'pebslkhzjdfhyhgforto'
- ClassName: 'xoupcqnfezcdiryvgkdpz' WindowName: 'ujnyohohrbtmgyhsmsrsugcexk'
- ClassName: 'pqurvmigmfnshnzphwtpexklznicsyrubuc' WindowName: 'zcbgguhvoefhkzpbvdinbvhjkouwtwto'
- ClassName: 'ioeinkztkttwfpqenohwjmlbfzvpkupldvwph' WindowName: 'awkplysglwzpcosinaahpktlhefecfkmdynvg'
- ClassName: 'bmzwtbnjehkwupyhshxbfzcqidypzyds' WindowName: 'kekbebqrmrbnsmehntlliadhzdtifv'
- ClassName: 'acwcjkfmxmjesbkdooajhzqxmacmtdetspzmiw' WindowName: 'inqydjtgkqpgahovgdacokpzsxvtrwmsfj'
- ClassName: 'uiyxayyvjnglewhkohwfgdjhbyrsxipjkxch' WindowName: 'nndqrshjbchoremwpbjajgfseceamrdhktvkvqj'
- ClassName: 'zxjifqkacdavhopk' WindowName: 'vefirfpiijatstznhlibvxqkhadpn'
- ClassName: 'iprsissksbufmgqwnrc' WindowName: 'ilgufykfhoemtsyzufoxqucgn'
- ClassName: 'pmyglqwgdcjsnevjsgbmpkzwetn' WindowName: 'bbpatvyuoldsigdukfsgadlm'
- ClassName: 'vcralapdearfsjxcayct' WindowName: 'vssiqwloijncdlyph'
- ClassName: 'spgwsabeopgtrfok' WindowName: 'txsppmbclvlvmjpe'
- ClassName: 'dcakfrkzrbczoifkyrtg' WindowName: 'vaxjnozkrngqphdu'
- ClassName: 'qsrbvmrwsmhiefhseqiftnzkdpkuncwei' WindowName: 'jmqnsvlzrzwrdlblxkjiulxkgwhksdzpwcq'
- ClassName: 'nfnplpogcgyqcexjfpszkllbohlamlkktgcmryr' WindowName: 'qwutwuqoujookeuzmvukxielrmtkwroc'
- ClassName: 'bttpxaywsvqntuwkj' WindowName: 'atrtxfsmskpofzvdvbvsgboxwum'
- ClassName: 'nulshmvwhfvrenjryioklupquklequ' WindowName: 'uvdlkbyulbsktmteqidslljuttzwtieao'
- ClassName: 'xqforlmfxwnbzgzwsjgywrikxeauqu' WindowName: 'zeskfpclsslrslcexhwvsszfyghyoucenlra'
- ClassName: 'rsnpawbdypnstzmqsoujmlpojlpebgw' WindowName: 'dtbapuowobeemcqipgtyrlzj'
- ClassName: 'ocinhljmuurgdfdzztsqv' WindowName: 'stkxtvpsiupjynfwzbaybrguektzetxqtzn'
