Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsi2.tmp\NSISdl.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\NSISdl.dll
- %TEMP%\nsi2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xxzgnmqrxezifcwbmthttudokkrxlyknoopr' WindowName: 'srpbnnxkfezhgdandaicfywkjftdoladjkjb'
- ClassName: 'ovqqkesohqlatvncoqsznunipmpa' WindowName: 'bvhdgcdvhctzesjlbu'
- ClassName: 'vzqmmdvyumhpovqpahwvryozma' WindowName: 'wfuztljbdzvfwvtbtqdmxbveskesskeiggbhrgw'
- ClassName: 'hvjtvanlzlmwgunpbcalpavkmtmnt' WindowName: 'vmjqzdjcaeufhenxpjdmukuybvekutgjbpodt'
- ClassName: 'jhqjnbdsbduhlsdwnd' WindowName: 'dqxoxwmxptqcxtmjrmtuquiyzi'
- ClassName: 'pyqkginquuxuqemytka' WindowName: 'yxqlzmkzdqvrsdolldldppptacjotvmlrfvqykd'
- ClassName: 'btykstxguxchsumjmtgne' WindowName: 'curztbhaqrgzmwqkhogjwypbnwjbewexrqgrfc'
- ClassName: 'ehnfxesvqcfvwnpw' WindowName: 'xcfidcknzcgvvxvdsbzwwbpyki'
- ClassName: 'xmtyufkibpaaybziqqecxcq' WindowName: 'gshqaszgehpxsedkvmjzymo'
- ClassName: 'vqtkpmwnujafewekq' WindowName: 'mataoxffcqkvrboirnrqm'
- ClassName: 'poqgomyozubrxwhvbdpbskkr' WindowName: 'goljoexxdxypcheenxtfkqmwybzfwaioxxc'
- ClassName: 'zundwbcrxymdgnrjzakpcmdv' WindowName: 'xxfvtmboeasgcnwgtbxbsapjbyhfpgxkifo'
- ClassName: 'exjprqfvhokjsagj' WindowName: 'wikokqvdunhkxbcbaatzarqbwxntnrirzp'
- ClassName: 'wwoeixtqsoifwyeoybxdcxconnfhkn' WindowName: 'ufjutoablthestjulopuogpkd'
- ClassName: 'scquekqvobsafxlfcfrnd' WindowName: 'tnnqmpyqkvlnnftyuudojtrnfdaybrf'
- ClassName: 'zxexutwynodtqnlwdy' WindowName: 'edqzltfjbdvwthkplfroy'
- ClassName: 'oealrffxhtpjtjjmjttzpqgeroinkcm' WindowName: 'klespunmiscsuoaygonfkgqxbijoktamqk'
- ClassName: 'omvrgftnjtpltsurtjgbykvkzkz' WindowName: 'vqndqflwcrxeiemrdkehipvne'
- ClassName: 'ntztzolfhalxqwsltnfneqvbmlczieazkbtpmtw' WindowName: 'jrerwnyvayhlpakpebaf'
- ClassName: 'yztdyoofjgvktkgwumkd' WindowName: 'ejzayupswkwqdwvmhdfvlvux'
- ClassName: 'ocnowsmzrrgikwdgamurhbqlmuvx' WindowName: 'gascuueuoailevlomppwyyospmgfusif'
- ClassName: 'xqwjyakesscicjwzqyjvcdehespcpsfqj' WindowName: 'redjdkcvgelnctupskbcwcxmygzgomtwkeod'
- ClassName: 'gkkfsrttgecfvdffgcau' WindowName: 'cjrttkufsipdbaqsqmujx'
- ClassName: 'eeourjpxrsxrykytoxtmhnupnlhtrtk' WindowName: 'mxjmkjrbljuqubbulpstetwnbausdxvax'
- ClassName: 'mydsyjfehhsyngurpr' WindowName: 'rxcwfselvpxnmlqvniibcaqtpfu'
- ClassName: 'rnovjwwpikousboycermczynog' WindowName: 'zkphzgmufjvjaoxjzmgk'
- ClassName: 'gqjirkjhluzpfymtfsggsofjoynli' WindowName: 'qosukkfgffpirulgeqmtqccdht'
- ClassName: 'yrkpzdhrxlquactopz' WindowName: 'xrfsjrkbzqbugbetuwzriuyvaaufkjwgvzf'
- ClassName: 'qzgjqzashrddgsryibjedro' WindowName: 'dztqtdhjfjzoufriwpecdhxgoslfgnh'
- ClassName: 'txvletloltkxgwpdawgw' WindowName: 'oktccfhkjxwugeal'
- ClassName: 'nmdkqaqmssshacdloufliltepexxz' WindowName: 'axfbgzbzbscilykgnakgcszrexeinnvgovtrww'
- ClassName: 'kezdyinqnuafafjhebmcchvwjamrmggiurlrm' WindowName: 'lxrhoqkxqmceyziezqaiflfwx'
- ClassName: 'xxwqlaekgynxryrovcrivkfumvgspuagcgjl' WindowName: 'iabghpliptldjkdluiawlujkmzayxmq'
- ClassName: 'yikaaxumofknpnahmgzcopy' WindowName: 'befjcvbgacbynwpjtglmdsaf'
- ClassName: 'blkrceeyapbhuzbvuenthym' WindowName: 'xrbsesiurqrynsoxsc'
- ClassName: 'sxygumxdogqanadnauilskqrlryxbexfekhu' WindowName: 'dgstfokrvudujmwhfwertsvmkwwzhhtpofu'
- ClassName: 'ezpmztonyrofqafnypsuftfsttyeigj' WindowName: 'wsgusomszvrrvzxickxeewkfas'
