Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'mnabfoagrbbavpzo' WindowName: 'kaeznvnzootizvrotpabx'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsi2.tmp\NSISdl.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\NSISdl.dll
- %TEMP%\nsi2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kobdkxhspjwtisjsdurqlhuyjwlrp' WindowName: 'bbxzdaaltdjzedqkrprnsceshrlexqatpmz'
- ClassName: 'qvglpjuylboundvq' WindowName: 'rfjvzqqsoovdqlfktiksakhwlmytgwrzii'
- ClassName: 'koznpgkhicndalipfrnhotaatu' WindowName: 'bbrtajduvzpvcwweekuxgopkfvndpb'
- ClassName: 'yybpujdnigbyqwsenppymbtapkyt' WindowName: 'rbfwqkxvwvmnfbhoocb'
- ClassName: 'ijchekeevhrldillplvouukwnvo' WindowName: 'tiiwhshtdtyeyaktjith'
- ClassName: 'mggxacsxzcvfqifoufgpbxvkdrwzoymenfcsdib' WindowName: 'mcsltjoamxnognvzppmwccjas'
- ClassName: 'sfgfmgykfrrylctgltmyfzy' WindowName: 'xdmnbrcwwmvhaeeejvw'
- ClassName: 'wwrjrcvvjrzwvprmmzjpbsrvgpgtevb' WindowName: 'edemfitglkaovnrizezppwrcvkxcslwqckhljst'
- ClassName: 'cgjxtnzczijysutvwqxuo' WindowName: 'vpmlwledueertppfsvzncksatzrrlunbcflbadn'
- ClassName: 'hawifouvpclrujalsrlzpecfcii' WindowName: 'sorjkwzzgbwgtxlgmelwumzlslor'
- ClassName: 'sqkozsgvjfvotfdc' WindowName: 'uypecwcwvnzyglhjmdutwtekkeohgjiuwa'
- ClassName: 'bcicqnckazfmvvtbvgeymsxxmldygm' WindowName: 'cdrefkspkoimvgddqzaeq'
- ClassName: 'gktbdjpimmyoqvtksal' WindowName: 'eatvcfyamrcdeabbcnhuakzt'
- ClassName: 'efxfrllvzwimbvysqtvnbcbes' WindowName: 'efrbcucbwhjikixxgv'
- ClassName: 'eofzmnjpqznxdgltpcwyohcfhwjqryr' WindowName: 'qwvzngzyezcqbgaufnyuinrnnbx'
- ClassName: 'nfnrbyhnjesqdgajhq' WindowName: 'megatedcoafwhffkytyehjgchz'
- ClassName: 'ypajkivvpetolfjedsunxlaxzzeelns' WindowName: 'psmsllwmjvzrpivcdd'
- ClassName: 'gxqtzvdskxbsrsbowafokhcsuebboi' WindowName: 'qulegawnplntuhaaromiunwkwlgedhl'
- ClassName: 'qdawrrvvqygnbadfqaqtmxhqe' WindowName: 'dtriyhzebhmvungxwhgpywxrotq'
- ClassName: 'zgculqmwrzkthlmhstvpwljehznmceipfukye' WindowName: 'bynxfkpkwztblndtbmqkqnvtjblngcdceiupc'
- ClassName: 'clltwrvyfeykpurxvuhojedsk' WindowName: 'unvlgniucvxuhonzlcvkqm'
- ClassName: 'hqzbbemafgjqkfwyuvbuklncdcrzf' WindowName: 'jgfvhubbhwfjoynbxxgrfypm'
- ClassName: 'redhrzwngzbikqxxvcycyvhii' WindowName: 'bhtrmnijlhnmehzpndaqa'
- ClassName: 'yylxvziyukmtwdrjctpagkbbqya' WindowName: 'jpmkqsxrenljymcmxzrgbkdnlvvvi'
- ClassName: 'xbtqonywtyecdnssoultomwd' WindowName: 'jtwuxmxmgiwmlzlgaihpcegpmgopxkp'
- ClassName: 'qhqzlpbnmwcuvmdiqjwvyyuhpxfwzoscvqbb' WindowName: 'hagpsxbqiqbnsiltvmvcwhansozmplnlt'
- ClassName: 'itswcxctdpfgtawusvkqugxavhfthm' WindowName: 'rzhfujupiybzofxzttpimriezhwthfpbw'
- ClassName: 'rleojdkcgootvifxy' WindowName: 'ttpkyypkszzemjytfyclkaibvutyfhvikgtsi'
- ClassName: 'bpmpommvptwshiizwjcyasezrchmaxhmdrn' WindowName: 'dfaeuykhtmfwtdwovhisieluojoeffjdb'
- ClassName: 'llaqjczppwrpiqsfovukiqjmvtderu' WindowName: 'pcqdhweikipzsrddtmtr'
- ClassName: 'cbhxczebmjtlrotmqgxzirbpffpywmrme' WindowName: 'hrsulwbmxrdzyszwrcqykhkrfdtbvzwwjmdkj'
- ClassName: 'foeeamxtnfxxappijuevpcpl' WindowName: 'vrwqajwhwyxkfzkqelzgce'
- ClassName: 'eeaawtkrmwubzyovcotoye' WindowName: 'gwqkhqqmwwnswuefggcagyyvxaaonlyzu'
- ClassName: 'jazbegbkgtyoggz' WindowName: 'wbbwmkzgdmfhnfitcnqqqrrixtppyiczio'
- ClassName: 'nzaybetkieqlipbppnhkxwywhfptt' WindowName: 'gkskhjppefxpojp'
- ClassName: 'vlzbmptztyfhvjktvbric' WindowName: 'splbmigpfvixqgmdoceqvbvtbluyuruny'
- ClassName: 'fjvsgshbvqorwolxffrcjktycnxalyjvekmlzh' WindowName: 'wnvikxzbxbncwylqzqueyht'
- ClassName: 'bbojasqgdzmpuwywisyoytpais' WindowName: 'xmozvsyqzffeackjzsjsevqmwylzgufaq'
- ClassName: 'oqvviciqfkojkacfodxzsb' WindowName: 'ejqasqvmsrhvtgphqbblwms'
