Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'yzpyjfkjscxfhglaypjfjxhjengypnvwe' WindowName: 'panwrircybajcmyojjwuqllooamgtqmysao'
- ClassName: 'szwerfhujoggyteollox' WindowName: 'tngsmvepwicpiljvivxobrthmi'
- ClassName: 'vcvbwfzgeocizjlublzasp' WindowName: 'wabpreetpcoeneyvgcfuoexicvgqnglugnso'
- ClassName: 'sahdacwdmmtiovlgtx' WindowName: 'wnfxryqoepbbdnzkahubgj'
- ClassName: 'vlrhrwajduexguepayleeqtflhcuwrdvorjw' WindowName: 'irubrbdwtgsxqhfacjefgj'
- ClassName: 'cwupyjjhqrlictrxryadhhcdjvl' WindowName: 'cnegoegdgocjegrmsgz'
- ClassName: 'ldxaispydotamnwpitdolj' WindowName: 'nafoocrgsythwlebwrlgchjvotznnqm'
- ClassName: 'gicoqewruxoidqancszchukhciqzhgrmi' WindowName: 'pozrvjtaldddwvnjcf'
- ClassName: 'gzkhztpzzvxbmuszrhafeslzlkjg' WindowName: 'arhteaofjpkhmkndowvjcezeencojmxrmbff'
- ClassName: 'bvlmnmyrxcnndcndewoxesuxrokjexolvnrfj' WindowName: 'gjtnnempvqjyapsoixbnphldqvnvbyw'
- ClassName: 'guihhiimqmmmlvllefnfnmpch' WindowName: 'ludzjdfwhnuzpikyp'
- ClassName: 'kgwuhfzrqpwfnqtenvtuigzbhhm' WindowName: 'kpwwpkfncnqnlctfgqrrv'
- ClassName: 'zbqtbwobyujjwvij' WindowName: 'syerhlunhzepfkgkvqetdysylrlnkir'
- ClassName: 'dzdijrqnxhkfceledhqpgeqfielxvjjbroisps' WindowName: 'imdapxlebxomlyue'
- ClassName: 'gtsnsfudsxlvejbgmtiaqy' WindowName: 'sisfmjbjvooolln'
- ClassName: 'kgmjkqoiufzxlgjcpecjxhosju' WindowName: 'qwdcirfwomcvryimqxuyrnqciolwualnx'
- ClassName: 'jvqnqsapirjulmgsctsgl' WindowName: 'wizvqqdgpgixvjvrljbgs'
- ClassName: 'gtgkzcdjeegcqasfdzqjttdhgiqumcdsjvi' WindowName: 'empeihkdylgrmapsphlxh'
- ClassName: 'jgtpuznltzfwpmdvxcatdlhgavkikegwwxfswz' WindowName: 'tjcwbcxtfnhphtefgzqnaeghimkwutwfoflmpnz'
- ClassName: 'batteubzsuoeaneehjedrhnvpevvogjl' WindowName: 'aunvvctnfzviyquyzqahhntskeegefvxluxuno'
- ClassName: 'xpyorwdibkicuqfukmeimq' WindowName: 'odhttqrpywkpvuymyaa'
- ClassName: 'goxkvgnozwbtyvgmrdtkyagyluejk' WindowName: 'qbagbzpoomdcofeeevhnqpotodc'
- ClassName: 'mdmjcofaryxykpn' WindowName: 'ycsxhrntsdvflacbqfbvxbpdcdasqtirnfwnelp'
- ClassName: 'dgcdceitkvjzjbhflhvzzltvv' WindowName: 'otehhrrnyjzsskubauztsxbjpqcgmorgwanhi'
- ClassName: 'psvujyvbmymkjjmr' WindowName: 'tguyddzejbmpayarenxjncq'
- ClassName: 'mxkwlhijeizwchmwkzleiccycqfpokoq' WindowName: 'tkmviixmeepsifvwblgdpctcbhchxn'
- ClassName: 'buijckuijgpajcmxqhvqro' WindowName: 'uxpcgikfcctsrfyxccngrwslgk'
- ClassName: 'eqdhatglfmjbrksplkyjgimekpotv' WindowName: 'szwisosaybtgjfyioaqinx'
- ClassName: 'clgxkgdqarqnkpybhicjrrrqz' WindowName: 'tkiyckubyauvyqluwfonnyqaoufppph'
- ClassName: 'fbnlydhbqwotqazprlwqndfwufsdu' WindowName: 'wfjwumlnmxbtanxvwdehtojwffxlfueaktyilj'
- ClassName: 'hmpnzbmcoxpfmibpbdynl' WindowName: 'tdqktocglkdmmxlztgbhzapcmjddetktx'
- ClassName: 'cmuxumqgdvycrfrmjzj' WindowName: 'mlugzqsweiigoewbhubezxw'
- ClassName: 'kohhhofnaukfpnhcpf' WindowName: 'jcwdhsefylnoikitetzqpxhutv'
- ClassName: 'wkgmmqrwavmntwcjajhylilmj' WindowName: 'blfrljeyzmluvnfleajzymiwqlipfitulgssva'
- ClassName: 'euhgyppnekeexhhqaprlgznlncsgyjptuoc' WindowName: 'fxjdxrbkouuyxipzdn'
- ClassName: 'xsmwnmvmttgtqwlvniwcyqkafupuxnffpgvc' WindowName: 'wchclkhcksmvgjgwkbchnrcmoudcynkbhvmdz'
