Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dlxhexxjocuzxcyagptbw' WindowName: 'tngbuhdocovtuyevwuvviq'
- ClassName: 'fxyjygnbvmgkzbfqelihyhriagxtyddleuxzfv' WindowName: 'wrfxqmmqjhxuavpujjnrfkasrfa'
- ClassName: 'irvjagzifqkegcyztfdumsjyr' WindowName: 'gjnbgjdodothvhnymmbqtpbxcvjktxbnriypwt'
- ClassName: 'txlqtjxmhjknkahkaopqt' WindowName: 'okcbkxkfdecmmodtkfxalf'
- ClassName: 'cwucrbwcyejfxwttgohg' WindowName: 'ryncuybacrlhnzvyypmh'
- ClassName: 'acorubawwpnhfqlgpsreogjpyttnopu' WindowName: 'joxnuxpnyuaqkta'
- ClassName: 'nrsaieoryxilvtmdfodhftpueqts' WindowName: 'gijdhfkdvtadjwpad'
- ClassName: 'drtqtsshvcboeualwkenoeq' WindowName: 'jmxafibksbrydifwphaodnjlwowmg'
- ClassName: 'qcpukkoiospojtcvjajkcijdsh' WindowName: 'ffgbqmjftrfqlsdqhdtznrcuo'
- ClassName: 'aiqofeiarrhjpyqgflnbhksyanxmrc' WindowName: 'ahodhjtcoqfqjzyscrztgl'
- ClassName: 'yflahihciaykannsixzmmraljufy' WindowName: 'mzktwcgtvfftfcxngpxqgtslh'
- ClassName: 'ymsbuldscljgeqocurcnnwoyseaafmbdxdqoh' WindowName: 'zhtfprcgnirpimgvrlbhmxbb'
- ClassName: 'yckgdetxjklwkibulyt' WindowName: 'tpxtluurdaopgqqokqp'
- ClassName: 'usgvjfuhzhzdbkryslqkjmfvtzyfori' WindowName: 'hwbbpadceugrslchzdfepvtawxqujglpipxsme'
- ClassName: 'iltpqvxzgfbaygoxwgfbxlvkhgrg' WindowName: 'aouboujzneihwuppjsqkdrofwjt'
- ClassName: 'abrlicogniszrjmokiex' WindowName: 'uhrvskkicebowakneqyfkexrwvvxuk'
- ClassName: 'ldfsbstfahtnelvejoianvgwssfksmwsne' WindowName: 'noegynvwrpiqiyltsvrxtbmqymflde'
- ClassName: 'wjtqtdrskxtfzmsryehmiikiifysjjukrg' WindowName: 'wzpjezrmatjijkimtip'
- ClassName: 'tycxtlfoctdrroumshbbiyvygpbg' WindowName: 'arzfeszygmhnlvkpjgmc'
- ClassName: 'tiesmemrmsnbhusdxqpoutmzjx' WindowName: 'ktftjjqcacndyllbpyngxp'
- ClassName: 'qhecjqkrcfifarqo' WindowName: 'sossgxbphjbmnexhdbatuvi'
- ClassName: 'waodglknzwjttexyxphtysiygbdijrirmvinzi' WindowName: 'artxqewbbiajumhisquilhpm'
- ClassName: 'kcpxsbetaqubdsvdhkwamhrniowkps' WindowName: 'dbhycjxvvyaffisztfgbifvfdnlg'
- ClassName: 'rexecdrommxwxwoccczl' WindowName: 'whqjlswbkfbbqdzmahsqnofcftb'
- ClassName: 'lcqzuymtvecoogdmwqckdkonryobcnzeoqfbu' WindowName: 'kbkqklmtaqscljbk'
- ClassName: 'tndnyjroppwigldopjcmogolldqodfjrujbmprk' WindowName: 'uerhtbhnaewlkpyrobqxzjtpsjmmxkwknkry'
- ClassName: 'vyvmmvuvmryfpsyzigfrjfsgnvxh' WindowName: 'amehcuriydefzfnidhwy'
- ClassName: 'nxxteofzfocgbfwrfbwnsxv' WindowName: 'mpubioznktrflemnuoxspf'
- ClassName: 'vegkhidnmywqebzliqq' WindowName: 'zonxvgsvrvuqrmejurjbusfecwbyrvxyjjyzqfs'
- ClassName: 'cvzewcfbnpozneyif' WindowName: 'vpsipvwqdwmuqjuufyzvddmfgtwjyjh'
- ClassName: 'phxirlclbrkbdkbm' WindowName: 'ordvhripjhisrvdzlnaxsqnhwednulnlbkm'
- ClassName: 'dpcsfooonwtylwlgwkdflwskeljwltxercqadru' WindowName: 'gggmsvjbfqylkwdgczjkrdlyagfwp'
- ClassName: 'uttlrddvkrtwdkvjrjtaypwcyrgpuycgjjyrf' WindowName: 'xttjmsrqngcgxqdfowuxndbyjvftj'
- ClassName: 'syhhjtmnpzoqjdgwljhzyyvljsmzees' WindowName: 'hhlkqllkijftrxzdbiyxqym'
- ClassName: 'lqinxsuxuwxmnrdgzyvgokcfqgxdzqpca' WindowName: 'zjwqorzgstatcrdzedpennjvecvjgtuy'
- ClassName: 'xxhaxsmvtpkjygkco' WindowName: 'zgyuhshimkapymyh'
- ClassName: 'kswpszkwrlokplaukqtcvocb' WindowName: 'dmqucrvyoacbabkhekkoyelvp'
- ClassName: 'abpggenatxdlvofi' WindowName: 'vqcmjnihsauggfemi'
- ClassName: 'qkzpoyazjthdwceujkmye' WindowName: 'vixzrqcfwuqffvaoxoraskhxufrzdkdfakw'
- ClassName: 'rbopzfemvutpudnncsr' WindowName: 'anildwnygmbeffwgjuztgptiijsvnucvr'
- ClassName: 'curfiwlirawwfonwaofblyzjdaalmrkjxbngsb' WindowName: 'rqhqxbvyhddihjaenkl'
