Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kddmopcncivfmhooqr' WindowName: 'ugsqlcoyarftglwsjfdsxxbvjiujiioywmt'
- ClassName: 'oszvpchflmxsdtpxz' WindowName: 'klpryvoaaaqspvznykjqrpnblandrwhwi'
- ClassName: 'uhppfpunnvzmdirvtbrhfeiuolbs' WindowName: 'eoykfjqyekehjejxpmrzaoqstrikxalme'
- ClassName: 'oqtgpmcnrnofhmrdupfenrsoslgwwm' WindowName: 'vcqpkqrplkggauasgjcssoajtyisnmfx'
- ClassName: 'nmtrzieddokjtwxdmkfto' WindowName: 'elsnsazvajyctopciymlrmuot'
- ClassName: 'duurqfvykhmaxrqdaycctcgyj' WindowName: 'vrwoiwmtjshsmxpqdzaacekluotse'
- ClassName: 'eqazjrheizzfhjmdqzfgytkvzfj' WindowName: 'ridvbayzvvrjqlchjrdpjjxkufggsltx'
- ClassName: 'sdevlehvhplhfmxtrpzcnd' WindowName: 'atnnxlyqaccrrmbucnuehuxan'
- ClassName: 'mlmqqkbytnzfljwbmvalwtxypd' WindowName: 'onakjjbabsswipfdsixazglmqpfrc'
- ClassName: 'txnnjyrlumelkcqhztoczmysymmdwgdbtugkk' WindowName: 'irafuplbvrvaskkvozepxghmil'
- ClassName: 'hmhtdncotsewolllvbo' WindowName: 'rimyuhreynnvfigaxzrudjfdtnsogrp'
- ClassName: 'lemakztemtvctvhujwvkgvdszhighhhzefxbrt' WindowName: 'txyyohgmzzphkxbevhjkewxqesvgiddjo'
- ClassName: 'mhglzckwytjqhwyhhezahnymhbtvamnefmw' WindowName: 'dzcxilebpszpfbq'
- ClassName: 'mgkjdjayceaqnao' WindowName: 'damzlggcsmjbzyijizmgj'
- ClassName: 'suyimtvqxtxlotwtjipasrytlxye' WindowName: 'oxgyeisjmvaxxgebcenmqvelqrgvaqfkpu'
- ClassName: 'igseeybpxhrqagbd' WindowName: 'uetkfovkdwjcyvxh'
- ClassName: 'avfctxeymesomoailnltdz' WindowName: 'qgkkphbncfvziobb'
- ClassName: 'zelmfmturtpwjhkcbdrybnpezw' WindowName: 'eoaxpmmxtvxupotiihnmokopuleeascrcea'
- ClassName: 'csnthvmuifjqgudbogupoplwgdormxlq' WindowName: 'sftqsspoqycyzgflepjgsrniwrrhkyfkcqhqo'
- ClassName: 'pfnmcpyyjcippbxv' WindowName: 'pnikcuiwqyycteewdghondntwdybbslhhccxt'
- ClassName: 'noiznnkdoiczqdwgw' WindowName: 'lpqctlroknbxeamgadajwfdsljsmunrdbvcpobx'
- ClassName: 'iibnbjhhknvbdnybrnltsogkrjbntz' WindowName: 'rbedotdxocegkcapvvgtjpncbibenslhohp'
- ClassName: 'oqsukalsogkudmybiwvyh' WindowName: 'lqxhliqkoshllvzbnpo'
- ClassName: 'nupdhilffvopmgqieztjcyhsdll' WindowName: 'iprznnryymvyrywupnoeue'
- ClassName: 'ymyukekwekiyrhjwiyqmvadwgonh' WindowName: 'qarfjhfbnrsogkvbhmclkzmmpwhxyrwhuvrnih'
- ClassName: 'gkexjszvhdnlctmbyhsndex' WindowName: 'joprumbxgvjgyparznbkjrgrrxudqjzwogj'
- ClassName: 'vrhowigghsrfdziqwbxvpcgepvkachap' WindowName: 'txyirhohwjinnhocbjjlyomg'
- ClassName: 'bbvdrwwmcxcvdrbvdoajedlimgvay' WindowName: 'vdwyuztvcbnlnatrcvuueuoi'
- ClassName: 'wdvjclmtnktueeww' WindowName: 'fjqwyvsptjqvapnxvvnouyzimycejlr'
- ClassName: 'hnnreafoqctoxqvcnspqr' WindowName: 'fuqbyvddtsrxobaquhkkgjxl'
- ClassName: 'lmdmxizqrbycwwjjcesz' WindowName: 'utivppzdbggjdjrcfybehsotpdedhazguaskh'
- ClassName: 'ugrwsdrfkhccsxxehp' WindowName: 'suehrkojzqawexkazbjcht'
- ClassName: 'wbedmeovlzkcprhtiwh' WindowName: 'czoymzbvmajipxifmvum'
- ClassName: 'cstkfycwxkqfltaulqxo' WindowName: 'jkzavknyvohrtcpea'
- ClassName: 'vrlkdqefiaqupjnjvbikqsstaneclghcwetebl' WindowName: 'whugukdrtbdreakvvmkmveknorfuimful'
- ClassName: 'rzmqjrpxcbanduqqrpnfkteuorvetxkfgk' WindowName: 'paufbzpejlrfhzbvuhhxuxsegabbpevqp'
- ClassName: 'vwvisjvpmtxbykwncssmkgctjrxeinlmnovijct' WindowName: 'lyrvgrzrzlzyfcppnawtuqxrgekrouo'
- ClassName: 'knythwiglyyeszcrcacjsooh' WindowName: 'rpbgmoeuctvnrpfdiyyncesetyu'
- ClassName: 'osmdqcfwbrkxzda' WindowName: 'tccasybragxznamvpzadaifyawxhvrwseypwvmi'
