Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\InetLoad.dll
- %TEMP%\nsz2.tmp\NSISdl.dll
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\NSISdl.dll
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\InetLoad.dll
- %TEMP%\nsz2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'vlzbvcxgdlyaflwzvttrdjdwqimilwdtijyu' WindowName: 'fdulggexfwwlakw'
- ClassName: 'fqedapmqucfyogjifecuadhyaflnnlupettj' WindowName: 'zmffcxlkuqyxtntqeqqal'
- ClassName: 'kqdkmbxfdncyngjc' WindowName: 'snwzgrnbrgeyewhtmspsuqpnvdtgiwblqplxb'
- ClassName: 'zhhxmwzgmcangyqosaicna' WindowName: 'vaspzhuagroaeyixavrbxlfcuvn'
- ClassName: 'jemromdahaawkcbroqevpmmlgpdfqfvcm' WindowName: 'hfmzjpzznqdxaazmarpddhawqw'
- ClassName: 'cxseqxcnbdelyrrtobc' WindowName: 'pncoebgdajiqzilvfoauorzcdvtybrg'
- ClassName: 'ceckitcdawxural' WindowName: 'bjygwhzsiupiagxbolneymrtebngdh'
- ClassName: 'drxmisyboxulonfdkfyoak' WindowName: 'mjkrdsylvspavtnasettbicrbnosowotu'
- ClassName: 'yuytqflrpxxphicyayd' WindowName: 'jrgkxytgmvadozthkclagpm'
- ClassName: 'wjfperjfrlqzrhaxneqevvif' WindowName: 'bcknqlbichlhwpbxrtmunbgxweajoeqij'
- ClassName: 'smpphzmtivvkoeaokpqjcgyjsrmasr' WindowName: 'mwchpqfwjhmmjzjgzqztmqjdzpxaidxaf'
- ClassName: 'zssrfgloldgfmslvontlgnuzvoyjbxrqkmk' WindowName: 'thcqjydakqrzpekeqqxphmj'
- ClassName: 'zptyuzdqhdrwuruhbgprnji' WindowName: 'ptmppjfwrikzdkkeuinnhfsfogynsseboqmpqsv'
- ClassName: 'wogqdgzrwyzojlccplmmykyugllqhi' WindowName: 'zlinhdbyniooehhnyxrhk'
- ClassName: 'xfgdtrgvcrcqowluhjgcoktouwr' WindowName: 'guzgnuzchvdteiumbovjfwm'
- ClassName: 'qlkcewxoyucklqewxabhflswcrjk' WindowName: 'vqqztyheqalviirdujcnukllbugst'
- ClassName: 'gyuynajatwxkvznnmajllxxhit' WindowName: 'anvbqmmihhgbkmcxaygdldwwyquq'
- ClassName: 'kchkoiblmwgtytrfxbe' WindowName: 'ympxqltuclirirjuzuixdrmhwuadkqrpcbdn'
- ClassName: 'exdtqpzzokqftisioefkzolujobzvpchrsiqni' WindowName: 'lwkwqbfyphejaez'
- ClassName: 'zsfzdfcdclmgbrqbxwhyjhu' WindowName: 'dzukmawdwoacnomvgkfcyrksausujf'
- ClassName: 'pvdzmpmqctbftngivhrigc' WindowName: 'dbihzawgpqshfozukkcru'
- ClassName: 'xhibhnavtgrpuidtqxvjejzobothrzc' WindowName: 'svmfdzopqjdppjslqhenanwqevtkre'
- ClassName: 'augpcjbcagsjzog' WindowName: 'bqdmyzmensuqowdpxwupnzbpzczlbrojaxk'
- ClassName: 'woiusdjtpfpldoxapkjkbdbblqzksl' WindowName: 'mhdaolmzeizvgydjhvtq'
- ClassName: 'gsxxufttfucayeilmevlmtaafhwbzarkmtgnqb' WindowName: 'bmcajghufbodhohtqotu'
- ClassName: 'yjmsbgzvovvypjes' WindowName: 'iwtksutewaefcogqnmtqilcstxknryrfz'
- ClassName: 'hydyrkrhqgtpajkpbtwimbzlxmxzgr' WindowName: 'juujzlndbghpahjzddhvogg'
- ClassName: 'xqfhpvcghbpueoaxvwxwk' WindowName: 'eojwlrirmdniurtdchyxslytv'
- ClassName: 'ioqktqmdshnyehulufkexliyuv' WindowName: 'imereodkrztzuwqlflzybwpmofjtqhsjgidb'
- ClassName: 'iaaruaywdkactvvrbxnitirwslnimfjad' WindowName: 'kbxrpgqfcizlfungejczhvxrascmv'
- ClassName: 'walfazvoxnhywwyksmydrbkztxgc' WindowName: 'hpgxnonhagwespcycftlmkgbofxqqqyl'
- ClassName: 'redioglwxaorawktnwfc' WindowName: 'wffmarttmqmvxowyhekfzm'
- ClassName: 'huphigtfmwebyaeheoxkjwnh' WindowName: 'bmpjhwawyoyfcyyptkajb'
- ClassName: 'fbhcwmsbbgntustyushpvxvnei' WindowName: 'ytqwbuybbfkpegmlvevfxbi'
- ClassName: 'nwslotwtgyrustnyjwtcrewxxpfs' WindowName: 'vdtirtfqrxgcbgsapnyneckegsesfbknl'
- ClassName: 'veuzmvlwsmgyxdjbvynbz' WindowName: 'ygtoreexzvejypthuoyqykyyfmljoy'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'etfjuljplgccpggksykx' WindowName: 'pfhbbyxlrkrdjlryoeehm'
- ClassName: 'ondebczujcujflpljknkyibfcvtjxdlomr' WindowName: 'hvgezvezbokedsnngpa'
- ClassName: 'owhtxcgvplqeknnjtyljkcmxhodljwltbqugykv' WindowName: 'szkdkluepsvzdet'
- ClassName: 'rqrrfhltlhjvnilccjbiussctshfzjtmh' WindowName: 'nfaovbswbltpedhpjcdnvuhluxoadahpdhzcst'
- ClassName: 'fnbertbdnfjqkaadbgihhqvneqqcqwu' WindowName: 'qtoavezqkteddwwhcruyu'
- ClassName: 'vgvjcqgymsflfccxqinlcshxy' WindowName: 'hoqzekdgftvepypinnpzenzohykvgzpcdltkyp'
- ClassName: 'wdkgwukxnqkbdodpagvjpdgjlwt' WindowName: 'ijfxoankmeqwxvvzvuvupfewmcri'
- ClassName: 'tpyyutxvteidwmnyasizctkvf' WindowName: 'sqwwfbolyhkhzuxucbnt'
