Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'ehqbpilhgvwhvavpaqqypy' WindowName: 'qfuuewhvftwjaaodhjqnmixuvnszx'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'cjbomcbzlskvvey' WindowName: 'qivijxhocugsrbp'
- ClassName: 'popnsieqhasoichxzejb' WindowName: 'bzjigcvzhouulqdvvyvlbqqsuysocgjjdrivur'
- ClassName: 'bhfltfoqiwjzzspzmdx' WindowName: 'nfxegjywoftqytjhzvhjutjdxwvfvhz'
- ClassName: 'pxmnbosicegywpw' WindowName: 'gypaxcuobdmnlrzrfmahganxo'
- ClassName: 'oyrgfupyhpjhrxwxcccepc' WindowName: 'sqfhrtksqguvsgdtrut'
- ClassName: 'cxzqgnwxsrrcwiuwdvtipkfzremtjdzaymidz' WindowName: 'msrzaaileflygjcobhjxwudaedd'
- ClassName: 'itaoyjzfpqlzzoba' WindowName: 'jbphjbedmbyprkzebmjifjqyuppx'
- ClassName: 'ngtbekakkdzzugjwgfyupwmvgxduoitwhxicj' WindowName: 'yueifapeqqpnqisgwebsqzozdx'
- ClassName: 'tvelyuilvipvbyo' WindowName: 'ukijczqyzemjdcmpkenthfqoqhuip'
- ClassName: 'phijxaiilnpnbzjcbwzldjkmwujtsfeyz' WindowName: 'uofysehubrpgnworeukdlncluecnrrt'
- ClassName: 'rhzahxmpywxeqlqcenpztkseidkdpdqlblbqyem' WindowName: 'gzscdqlgkmpiswqacmiihqhhse'
- ClassName: 'cnqoxecprzbegstwysgdawymncigfy' WindowName: 'owqwbizeyyekkhum'
- ClassName: 'hdkxumudswrvmkjnkshpj' WindowName: 'fwtqolxccynmhnrlumgxxilbvuqsu'
- ClassName: 'ojssdtoddfnsmipsrqamglzssgjkgzzyvhc' WindowName: 'ugnvcviyqftvdlqyfwldryierzyww'
- ClassName: 'ushzvmcnhfdofbxbzdfzpcncqedkhrauvr' WindowName: 'asnlrariprsmibbkkzo'
- ClassName: 'uvlzhmctjujxlyimugxxpvktnswjv' WindowName: 'aiiaghnicrwqlpwy'
- ClassName: 'dnjkviywqzqeujlhmnznawynjilmhrtgpzxrdjf' WindowName: 'vwiwjffdtoauzevyytznupvkle'
- ClassName: 'nihmzjzhbcpfemxlnatnzbiwrampdjklrw' WindowName: 'drsgunqprjeyumiqhlmyffsvdozpfqtscho'
- ClassName: 'euitxkykorveutmqujbpyp' WindowName: 'vaanqapdcxjbbaypwvipwcbudq'
- ClassName: 'hqvocowgaklqqonmxyzhuovmbfytdrcmkhbhrxo' WindowName: 'jorgchncjdzolbazwms'
- ClassName: 'zdusuqseqpvtysepik' WindowName: 'iqrkeedsednsrhxkillvyayzweaiabbmz'
- ClassName: 'dnnyathxwwakziwcfmpxjwjcnqi' WindowName: 'zjfqjhgygvyxxltkqyqjqqwjlvzqz'
- ClassName: 'lzvsfqqgjmhywatbnvvgvd' WindowName: 'rclxwvgkswpzuqhaornx'
- ClassName: 'dxxtfcszrjaicnis' WindowName: 'peusbvdxcxiuihjcyosrks'
- ClassName: 'ugrhfirapuuexmyducfgffxeu' WindowName: 'bnidyeialnohxoohvespufbgfevy'
- ClassName: 'afeffwyaylqgctu' WindowName: 'dussuxilcgwndxbi'
- ClassName: 'zuqhinnkndjhzzvjnvvgladjxqyoetmvpoh' WindowName: 'vnarssejcqlspqcyebmzhmskprmnkikwzszqss'
- ClassName: 'unqbtrdtlusbgnrpzlivcvtqn' WindowName: 'nrgbqvivychthihjxdhtgaysjygmrdbzajxxk'
- ClassName: 'qdayxpjeismhexundgrvmwsqgxrxmsnvsu' WindowName: 'nbyhjytdfbjwmchdgngxh'
- ClassName: 'fomxwewimvuadyhacwoz' WindowName: 'obiwrufhwkumdoyurypxhjmtbg'
- ClassName: 'qenrpzjrthsegcrfllzqmtglrsyytauq' WindowName: 'bjtxrjgszkgscbhwuohgfwmbhljioz'
- ClassName: 'vpbzoiluouklryxkbkwejvyjdbfgffsfd' WindowName: 'ugbzpsbvmghzfeceqqjyvtvuwqaljksajtxlw'
- ClassName: 'jaqjrazpxrawwcjva' WindowName: 'hvrynhnpdaktxipvieymyk'
- ClassName: 'dssrlibbjdvkljhvqbioknl' WindowName: 'kmuzvirdfivmfpgapyykaemzmk'
- ClassName: 'ftsqioskerdnrdkgubhwj' WindowName: 'nrkwqvxohtisgbtujkkbxozupg'
- ClassName: 'dokayktmrcfxlorcj' WindowName: 'trfyrdzybhqtpktpyelrcndyrsj'
- ClassName: 'ngtpeipvttfhdhpj' WindowName: 'cddrxocmfkvjmcfbqpyvpoirqrlqtzj'
- ClassName: 'ybytvllhvuzetkdojssglvy' WindowName: 'xsfvuwzheetlynmfxzidmqnywwfu'
