Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\NSISdl.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\NSISdl.dll
- %TEMP%\nsv2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ulgaqdgjfkwtecawbdhpekzarzrvxvzmvm' WindowName: 'jwbwmmxpuapzvbbwoklppafuazadhsy'
- ClassName: 'tcgokwttmodcfmmhddnqaehksqjzsadleqkh' WindowName: 'utbptoodzmpyojo'
- ClassName: 'udolclptyqnkirhqooalxjsxmasonjpdbzn' WindowName: 'yhfcsrnihusborfukprev'
- ClassName: 'zriduuywojjhqdx' WindowName: 'qgbqkhkumjjuhipnfgimvp'
- ClassName: 'kdhriyalpejteeccvmcabzoqnerpfl' WindowName: 'cyyslisvixldwtymexava'
- ClassName: 'wtuufelhmamhnvkawewfbfrtqcla' WindowName: 'ofnylhdhymyvwzxnmvuakbrnjipxznuvewe'
- ClassName: 'gdvavztglogzjyuwstwhbanmytpl' WindowName: 'xkrmumsugcivejkkzveomtekxpefdnzdqt'
- ClassName: 'wmefjlcymjvzqavnajsbnamcdupi' WindowName: 'efvanhgrdyjstzjjjmgniwlkvyg'
- ClassName: 'wbjrasmxvghtrawnzhfmytewrkdjukbmocsdi' WindowName: 'nmtacknrjjynitrogjes'
- ClassName: 'uzojbdewslsbyhrwcbtlegfswrhgayjve' WindowName: 'iijymfdrpnunhvmpfauxqrbcsgnpssdnecn'
- ClassName: 'djyolqcpqzlnsifeozvexotmkajtwy' WindowName: 'egkznwehweqyjjhvwrogmftxtocwy'
- ClassName: 'jkmkjaiekdghjtwtghtuz' WindowName: 'unszvpmuouxukieynmhmayepofcjlcccuoie'
- ClassName: 'lbflgouajggmgmcyebrvw' WindowName: 'eppgmdlmywxldrse'
- ClassName: 'glfmcwbnepdbflasefpqgpnhsgskbxbv' WindowName: 'xwmyhaeqcaepwooidzvetarrfpbbbsx'
- ClassName: 'tjrokjxmuwgbnueuabdo' WindowName: 'vemqeyxpsqwlkgeyve'
- ClassName: 'wrwfpvjvquoeknlhwcsbcnuxqkhjpzdfmkote' WindowName: 'yomdwcbezrxvhnkhmmakwgqclymqazdgbbt'
- ClassName: 'ufdiparlwszwtuzidqtfmd' WindowName: 'xjwebfnrqxizhvbrmavoqhnl'
- ClassName: 'xauytnbiccyegmlpfopxrh' WindowName: 'bytqvexvzwlkarpkxvncfvkckevlkisz'
- ClassName: 'nwsrclarzryqhpfknstqovl' WindowName: 'scmozkbwxqrwtelymkjaimpxigcbq'
- ClassName: 'bmgsptbrzkxsoyveg' WindowName: 'zbmhhejvnnfoyzdhpftv'
- ClassName: 'nkxaoxismvbucffrr' WindowName: 'xgcurvbakvgofdmhalpwmlksftdvsjeu'
- ClassName: 'jqiqhjbqjtumkwexv' WindowName: 'otykhpczmhlfrwwqpyosbxv'
- ClassName: 'sxyqduwannbvbnf' WindowName: 'fglbiuhxqvpfbfjoalqssggbewxgkt'
- ClassName: 'ayxrfjmhphxtotandh' WindowName: 'fqbzmjgxvhevfsiiyfgfsgbhpmghcukmpbaieqh'
- ClassName: 'vvekdzkpzpdatxgjqist' WindowName: 'onjpdcauhwzxdfikqidljtsqhdnhqyijgkeue'
- ClassName: 'xaxipgwgmaddgxabxlqljvfjrsdaxq' WindowName: 'zuvwyfrasvpbxzxkgdqluxcnmyeyndiptrrqaut'
- ClassName: 'lgwxkdplrdwfgwgqojiusbfgui' WindowName: 'vhgkaxvfgqxfvsnh'
- ClassName: 'ugkjrmefrgkfabwttzrdpocpmvr' WindowName: 'umhyyarsiruextfkufgegqygzuvhhhjutfnhe'
- ClassName: 'fmdaixtytuydfkjdovxrqefeddwfdqczdirppy' WindowName: 'gxvlcccnuftcntk'
- ClassName: 'fmksarmtqihwrovdkyaardtkmz' WindowName: 'adgtlsdbcgnkdmaljdqfqqtcufkwzmkrgblj'
- ClassName: 'imvijceuzmznqxl' WindowName: 'pitkjtfywjbqtotzxerldzlhniega'
- ClassName: 'qatyeyexejnkgzkcfwtipjyynpoqg' WindowName: 'edqfwmrseoqcndfergcbscyryvbhwxw'
- ClassName: 'lfkkgefhwqddiugpbpkwfwbrbvdfxtdgtq' WindowName: 'rfcuicqbnoxhqzqxeyuvlvamqwwswde'
- ClassName: 'hmknsaevfjtljlpvonpwemso' WindowName: 'owspwmjcpyjjxacvwyafyoadqxsvxc'
- ClassName: 'zrwjccafolkffxvvuvazznvdvwkul' WindowName: 'xvsmsstfsiyqgxndekah'
- ClassName: 'jsstwygkeobmgzooizqkusasebpkcyzkh' WindowName: 'xpmeoragmrledvqvgsgvqxnvosctwpao'
- ClassName: 'rydaghvjlbjbvxpfvrrb' WindowName: 'ronxwmuxkpcuavkkajylqyjufokeu'
