Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dyezpiiboxikebjwxripbtbxjrl' WindowName: 'wbngwwqjxuurcilkckolxuhdo'
- ClassName: 'gexfurwudqbnzfuztahycfqqgyanccpe' WindowName: 'kctaqmssiqhgsgturofq'
- ClassName: 'cabqwzhsfhchkqxssfnzeze' WindowName: 'lykqvsgxgsajfhqdeyfjsefqv'
- ClassName: 'igqruitptjkvzumrq' WindowName: 'jdczawoezagmfwqqhhzowtvuligs'
- ClassName: 'wqsfmniqmbwgrimuxrf' WindowName: 'yhxeutyijqzcdwxohvauhyngptvfrhhbngojl'
- ClassName: 'qezgryyahnhwxlcpwgc' WindowName: 'txlejdgleekdaibwdlbkimtttfbncmhifchagpg'
- ClassName: 'klblvxdibhmmxfslwvtjfp' WindowName: 'bhaxjulzxmafllxxnizaeomfive'
- ClassName: 'mqhufzwzfhpfvhnbfcsouv' WindowName: 'wwmvhmoyjtyyxms'
- ClassName: 'saklggxbxtjpsxqxwepwuhyaliearfyjphjyc' WindowName: 'jkloebnbotvzdmntlxnovciupnchbeitgqx'
- ClassName: 'fxaanqelvulkzoruqja' WindowName: 'jlipaczzddzcilwvztrnfnhzdlylfmoxzvsjx'
- ClassName: 'nhdknxnjdlfnjtuyqgbchyqyrzrqfmwqf' WindowName: 'gzxfxtznerxkokzttyqrl'
- ClassName: 'azosdluhxaefgchkmovurzlrofaickizh' WindowName: 'bwggwmzccecbzdbrmdkdfsphkiiz'
- ClassName: 'tgumjvluiccpzktmsihirksaxtjkivqvkgutia' WindowName: 'tdabajgupmevrvomewbcrgghgkubwk'
- ClassName: 'zxdmhyjmphteniryesuqrgtiajawpdmcvxc' WindowName: 'eztbhaddmmtvtiewiapuoknmcyebhnr'
- ClassName: 'xtzexyxlcpxuwebgvzfzewiggrg' WindowName: 'egoeczzmnfgskfjayhnqyxy'
- ClassName: 'ibmmxkwwzzpwyblhxpicw' WindowName: 'nuxqomowcvmynxczpznpodoeh'
- ClassName: 'mreiwbtczhezktxaqwfbdfmsxmblqxvuytx' WindowName: 'awsjaoaidwvrrgeytnulcemabhyggis'
- ClassName: 'dwwbgvwfzswuxndyupyzwvatogkzllk' WindowName: 'suywpmaduhnwzaqkkyculyitbltwixlncyrwd'
- ClassName: 'eapmpqufnvxuzscbaybd' WindowName: 'eovnlrzkknpcwzchicaddprjimmwzayjznhshls'
- ClassName: 'mdwxyspsufcrqsucviizrpxdtrhaeobxhuzvsdi' WindowName: 'adpentivmcjtckeafpzydbuhm'
- ClassName: 'ovhxeylwofhxiknogbrawgodlopbselhudsk' WindowName: 'desiawyukieqykbxumrvopdx'
- ClassName: 'xhwfwrinthsizengafqtlspkoxwxc' WindowName: 'sffppfeaeuzwbqwfwvx'
- ClassName: 'qbissubmtekkoauihqdubbyxnfiaoieaiylqobr' WindowName: 'jyzgdvqprqvnyfywpbsndgdmutujihyye'
- ClassName: 'yvemfcwqnbmkgdtxdsepbffvysoptalabijorg' WindowName: 'nnuioupbhucnvabskbfafdwhqnplkqykojqk'
- ClassName: 'ghwobacxacunvghqr' WindowName: 'ujksbyqttgnfqmhzbgkmu'
- ClassName: 'jtgpiwpuepquivjfhyuenlct' WindowName: 'rdjpkkzqueewqzirohamfwur'
- ClassName: 'zusxyaaxwjexuipldvokrdzwrgduc' WindowName: 'jtctgjsocmvvkukisyjftvng'
- ClassName: 'beskymhzepmmslhezgecfedfzzejaqhylevq' WindowName: 'fjstztkojzougulmwijmbkjsb'
- ClassName: 'dejdltymszzaumnyltvan' WindowName: 'llvtjeghsupooybcfkj'
- ClassName: 'zvazptcdqlikwrvllrmabsebrdytfb' WindowName: 'lzmtcqptakhuqukfxbfwhkyzast'
- ClassName: 'xbpojyuyuciulhhfklwyoomforktxihegf' WindowName: 'zljmdinpcakrxauybccqu'
- ClassName: 'qxrfqewbfxbpvxsjsefezxgotgynifkg' WindowName: 'xibmvlqnzitkniom'
- ClassName: 'jzjtqqfpvedlogxbmflnl' WindowName: 'eoinmyahxbwddfaplrwivae'
- ClassName: 'applefyeuxmwiiuxfrprwb' WindowName: 'yjintuxhcqbszpcmd'
- ClassName: 'qeosyympntdclpaduzkt' WindowName: 'ouyhwahfcfjjhygbgfccotjcnyfliezinwd'
- ClassName: 'udvcjswkjxbczgyfzkuapklakds' WindowName: 'cpdylriovgaxxratsvdqpdbvlvxmvukhbvjsan'
- ClassName: 'egsakpmnmbhhxwyqy' WindowName: 'zpnyrqgedfwnwkymoxqe'
- ClassName: 'qoaoukwmnxlrpsefmdjwamjgrvrdq' WindowName: 'pftviudtmdwftgdnwemlditxrxz'
- ClassName: 'cocwnfculkdrhxhwhnmzw' WindowName: 'ixpntuhbfhygouyedopgtuqoxmvttw'
- ClassName: 'srzwbcqvpwnltzyzkltegmctqycwu' WindowName: 'hkdegdeoyozwaqlawpxssefnjznacreeqc'
- ClassName: 'ydwavrwpgxqqirrszswgvjmzgjcvydccwqgbpyt' WindowName: 'krpkxwqmxruqcfcbjqizgjxydcgsqyvbcte'
- ClassName: 'bgvsfmgzcteuyebwogapmhrxqvokfxpivqmywb' WindowName: 'ifyibivauqtnasqhmxfjaundsjmrropevtxj'
