Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
- %TEMP%\nsx2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'srvkknfbrwbthvjoochfzkqzofaeuxesipiq' WindowName: 'gmotushhtzoqvkwymcjopepktzpntwjcfotfqi'
- ClassName: 'oagazkvnvcwxwbofdjqunvxwsr' WindowName: 'elkrdatcsnshpntnhvpx'
- ClassName: 'tqlddzkwgquifbrynovipzvurquhzgvpabxfkpt' WindowName: 'giiohmfhwfqcgqcwbn'
- ClassName: 'tqfiazyjtiumbbimqmtfowphsrcsgh' WindowName: 'tzofzbvshgewnmbfgmruaauivnpnczieqy'
- ClassName: 'mfcbrapkdxorhukdxktun' WindowName: 'kyebwofdiysiqgvmafjvmppmrqglqlalh'
- ClassName: 'ncwyiuwaffdevyutkd' WindowName: 'tjderidgdxuwosemtqmkpabmfodcdxymljmhu'
- ClassName: 'jhslaizqciwvfkkrjnaczgagsqhmxejpvvb' WindowName: 'gdxtjhyfwcjqcthtazun'
- ClassName: 'ilehsgthqwjdqxlz' WindowName: 'kmdoiysjlejxtluwwviukdwsphnkzfrufoahuwh'
- ClassName: 'pvkyiovxqjoogvqxkqvlfqqjrvc' WindowName: 'voijoxfmnmvqgyasnryspvwamkprieeaaohhiz'
- ClassName: 'zgmgloqhupxoxydygzaeultzmyr' WindowName: 'pqmkspylqfaljairijdgheqbpjp'
- ClassName: 'xooguvkerwlmlroyhulzvbsiyjjookdyvfel' WindowName: 'qukzkayoruulbozjvnthohrmlerxvxjdlxnelt'
- ClassName: 'gipxkhgruhpcswrhwhhnxflswnecdrzvxle' WindowName: 'ajnubogbcbaaycdji'
- ClassName: 'ikytciungsidoplfrwfocrrwyyim' WindowName: 'pkvacdlrzaigjykholkzchyoqnstxsav'
- ClassName: 'teeitiupsnjgyjklbhyxtvrznqmltgzmqwz' WindowName: 'mmjeiodqrgwgucmdfgcgvzqdhzciho'
- ClassName: 'nwybflgdadbdmaecgyaxg' WindowName: 'bqlvrdnbiewawhqhvgvwyyrmrlkbdczcp'
- ClassName: 'chnwhurbzngpnybqzetvxaiaiqxnxoijauzv' WindowName: 'iokfajrnzlphvnzj'
- ClassName: 'gikxaqssrxxrnfmqkodneajfpb' WindowName: 'fktjwjpnxpqdmdjzrflwflhvoxeuhrhswztgfwt'
- ClassName: 'exqiqhswxmusaqgotecwrrqtkhymh' WindowName: 'czzodganxnmmnejhgousquxujulmq'
- ClassName: 'fzwrbgmmriptdbpdaksaid' WindowName: 'nzynthjedtizseqbpjkatshpqhvgmxcie'
- ClassName: 'caxkmwkdbbmmhppduejjdmodivlwumm' WindowName: 'luefbhgqmkybepaavxhpjijxdpxxrhsxjo'
- ClassName: 'fnqysllvjqtlkrdkgtosdzksewkgvb' WindowName: 'xkytuqvzjncqrvkkjjozmh'
- ClassName: 'hirvdiztvfdqyrynmpexjhdy' WindowName: 'ghjpcckuhkwrdwpxivtmgdcxrvji'
- ClassName: 'rtxfvomyqsfkdfycsqqkpxgxlghkgsnxep' WindowName: 'bttrhelhahhhlan'
- ClassName: 'fdzmypojfymqkkslsjlookwxexz' WindowName: 'ychgoeouoniycxkvvdmj'
- ClassName: 'akmnfdoojvqiietof' WindowName: 'eazpuiqhebawbvwrbncdstahbwuok'
- ClassName: 'acnmrwwmuizkjnukivnghy' WindowName: 'ombedvkgtsketlglmzuuekxwfntgqrrjiy'
- ClassName: 'izhfisostyrgedygopqujshotflbjfxnmf' WindowName: 'oilcwxioemkbedtomalfpdabnrw'
- ClassName: 'fxkxudxuwelteuxlam' WindowName: 'cguhppcvqjmkdwkfvjtghicbubkcgyo'
- ClassName: 'rnpcbskgrjzuuoegzpubbitwjxg' WindowName: 'iryczhucuactcziurchrunukjxxotlyacn'
- ClassName: 'sfesxqvgzelcsabtjaejvm' WindowName: 'klunxirhogypefqvpgroidtyhahhaj'
- ClassName: 'iexxawszzqljbbrqbuigczccfxdesflcxq' WindowName: 'ogjbjmvlvibdhyynydhjyelrp'
- ClassName: 'ojfqhwtqgdqefuqkrqgyuqawqxhlknsste' WindowName: 'stvlumeaaptjlogkiffbupwgztl'
- ClassName: 'bnfstgppjwaqxlsuoklndltsd' WindowName: 'oetlwxnvvlcvcroabjesaovexe'
- ClassName: 'kdkdxrobhkzdgfitbp' WindowName: 'ifsjnesmphmwyhyyhevkyytalprmxgxyjneyy'
- ClassName: 'ktaabaeztjymcbbccrololaqmrnhzz' WindowName: 'hmmwbucclyatjzqjxashzmfiokorrmchkc'
- ClassName: 'ibvzdywnbeugcbupg' WindowName: 'zktfmnboyaadjllqjqvnghcocsrpypanjlv'
- ClassName: 'oczezsycuaphrbmucadkyecdi' WindowName: 'biqhqtqdwegebzxhsz'
- ClassName: 'vsfclsahvexlidrsceoiwta' WindowName: 'scculnbvjpgdwstdejjbgzywnnn'
- ClassName: 'menxrxzifpygvfufisjtevpzjwcvszopufzwf' WindowName: 'jzoguagwtinmqxfgiyhnhwmnygpgvmreahgvai'
- ClassName: 'miluabkcmuosijmjaixwrtdhugp' WindowName: 'hogbjqxireufxmua'
- ClassName: 'zhtyqcpegcaevpkzhhf' WindowName: 'fbmllwzfianziqbpreqfmmgtvrvoljowry'
- ClassName: 'oicdqctetkijezgbqwhvpbljbg' WindowName: 'dojzndukttqjbjmvh'
- ClassName: 'fgxtepwmtmpmqljknpqdjggcwbzwywzqgkpjkwj' WindowName: 'fzkpdxpotnydmbjjqmkpqsbjvinqsldpulr'
