Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hyfnoysdkansskwkwazcjbtbrpyz' WindowName: 'tdlkyocooqijkxu'
- ClassName: 'purssaafwcjbilosju' WindowName: 'jxzmungvduopump'
- ClassName: 'afihnjzustsaxtwerzocn' WindowName: 'ckmxpvjropxvvrypxwuxybdbfjkiguwp'
- ClassName: 'gmgfgtjknczlfdg' WindowName: 'zcisdbbbmwxkzasbdtivsahxkvhbp'
- ClassName: 'epxnylzjviwhgixdxjb' WindowName: 'qdsvhhfxhkneeatzkaerlvyboxlrykobfe'
- ClassName: 'cbpswpxhtqfyjcdtqeghjiltnqiccyeglg' WindowName: 'flgsoekumdfzcgnyynvbpd'
- ClassName: 'znocmxghyvutflnkmucgabsrucgb' WindowName: 'cqlkuqbbfdebqenu'
- ClassName: 'auodovbqnwsmqqxlsnh' WindowName: 'zqwqoradpcbrkumwijkaejcdflgqrxh'
- ClassName: 'nwqzyfjfqbrxetqhvnvtjhkoywvibywjenckho' WindowName: 'zqadeozqrrvufiwdhsplnknhwxlox'
- ClassName: 'oqxmzzhbjgcjdpfhgtyyp' WindowName: 'lgxvqrrjgfqwciiod'
- ClassName: 'fludsqggmcvlvlfyxavuwohcsx' WindowName: 'wvemrunexcpboheajavptihmkjc'
- ClassName: 'hustetebyyqvqvpor' WindowName: 'djbjpslvivfygemhsf'
- ClassName: 'temkyiqxwldsqazkbfsdiirp' WindowName: 'idaciyrywhqdmuesnlljleilnaexncpmryuxes'
- ClassName: 'slfhntvcqcxsiaxmoumvmuzcmivtpjcwx' WindowName: 'jdlsokvfrrukgsxppftbmukwyrpaovp'
- ClassName: 'wrkmcdcjprsczkyeaoszumgftaiyamjsefgwyo' WindowName: 'roiwsjabeavqqvdllgemacmk'
- ClassName: 'jdjixvqxozwhcgpekdylqutmpwbj' WindowName: 'cwjsstvgkfazgqkylcbatmnlzombplhybzfomdk'
- ClassName: 'gfydyhqeiafpfoxv' WindowName: 'ptthozkutihmchhjlrfijmtixw'
- ClassName: 'dpmvcplwxikkyepejitzgvhnszapdnngnejjpha' WindowName: 'klzafjlefweogchnpow'
- ClassName: 'tizlazrdnvwwmekeyhsquzh' WindowName: 'nbuhpyqilrmkaiagadkxgevvcjpaobg'
- ClassName: 'osvotlwjpiemwlvdkytzcdjuiphoczmjjse' WindowName: 'biyaewlpvwstdldhytktlcgnwupqmzgoekrovvi'
- ClassName: 'fwsvrwzuqxkhwfzvo' WindowName: 'qrtmyarlfmsbgeticnhwmbqpzqgyun'
- ClassName: 'rjmlomruypjxggz' WindowName: 'xoghlahyiaatcrpdprzejredinhyakaizgyrnvk'
- ClassName: 'fnlgaxkbsnbkeskjxxfxaivqwvtyybbsumdwe' WindowName: 'zlzdpsfutojkhiegvcyvmjfzyxfuazdrkyq'
- ClassName: 'jjuvmlymjyxbqjjp' WindowName: 'wdbashdnnoplanrrtaqfzsbdqvrrwy'
- ClassName: 'wuctnvcnyjcoagtlnyooeymxn' WindowName: 'ikiairxzsoylmjetiavowqpubusocwbwmkgh'
- ClassName: 'zlfirpcryvclkzlqjozovpcj' WindowName: 'dkfdlkbypjeqlmtsdncarckenae'
- ClassName: 'hdcugmdloyneqvbebdcl' WindowName: 'ueuwqtzwqkeytqotmyyfxbzlesbtdtshd'
- ClassName: 'qkyaacbasptuvdoijafghmkcgckehfhkji' WindowName: 'cxcaplutolzzjvz'
- ClassName: 'tzcwsddcewzgjzusjthnlwlgau' WindowName: 'nezideltyshszxhktrhd'
- ClassName: 'zbvjywftniysrmzunnhayyyxjctfftsslbhh' WindowName: 'owcmwtdylrdmvfjvrndfqybisxhee'
- ClassName: 'xzgnmbfoupnwkyta' WindowName: 'ftpimnvqazegmufjxhmztdojcvpeotgxa'
- ClassName: 'ynstqeajuseetcvqtoustvydfhhdc' WindowName: 'tonnvuwntsxwgaszdz'
- ClassName: 'nflxmmvrylrthus' WindowName: 'sudbhkdgkbganosloxhiapxbzdrkizedyggot'
- ClassName: 'bpigiqizbgdrscvsvjqvjipx' WindowName: 'yyicxqoawixuywsgo'
- ClassName: 'ahmdfmquxgvyaxysgni' WindowName: 'jyctiiwelnewmgtjmrbkjvnxdiituqofnqr'
- ClassName: 'qrkikigifykxnsikrvfliwsbajd' WindowName: 'yzklpuzdnmscdsynqvkxm'
- ClassName: 'zapxmaxxmfdedywvncbzyafesxpgjoxdytsxwfu' WindowName: 'ogclssvtqfhkweutxj'
- ClassName: 'dbymerafxhhphfsigfxu' WindowName: 'hkamajvdadakowceoxquqvtirewbybcyussp'
- ClassName: 'dutuqbbsyidgsky' WindowName: 'qxichjwookzhzgkan'
- ClassName: 'ifjtjryzxbuydhsgcyfofunaaqbjywnkmszozik' WindowName: 'ymtfbatbxnlgwdlelxyffjs'
- ClassName: 'onkvmontrsubvrxj' WindowName: 'lnbyvkwkkpnibqwhlvhkxogzwxuyjbn'
- ClassName: 'skxhyxtlgodrefnkuodfwnjchdcxbjorwl' WindowName: 'wympvlsoixparmlrmiikcmysg'
