Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kktayndwyiowueavlbp' WindowName: 'nynygspnxzuqmtsry'
- ClassName: 'acxwjprxsvikpxguvcwgqstfuxrsh' WindowName: 'iysrivssxhlquuvlovsplfq'
- ClassName: 'walhsfenvuwicdecdcdwfxkutwileza' WindowName: 'rgxdtajqhggkfxnxs'
- ClassName: 'ouxafnicuxyhxtgdhposhlvb' WindowName: 'cgftehplsjgmbtz'
- ClassName: 'fygthqrcxbpqkodmmwcmvaucpdbqihwosjiwvl' WindowName: 'mbldkmxwmcyhzcdkkmmdufzivxoacwwiu'
- ClassName: 'orkxjxgpblqlzcvmappqff' WindowName: 'safiegedgiqaapvkrmqdwbdttffam'
- ClassName: 'iyxxzmieylyvotgugjwxpsp' WindowName: 'hrxwjziunbaxpavjvunlypxlbec'
- ClassName: 'xjmevzwporerwgxlzmgrpjgiwggifxxugvbs' WindowName: 'chsjzfnjaspjbnlxmxrcalro'
- ClassName: 'ebsmeofwfiqanjialzspfxkobdmivdujrrwzqz' WindowName: 'hgjvneficuuwferfuymgesd'
- ClassName: 'qrunixdmnvnumxomwk' WindowName: 'pwqyemuwmetcyucakbw'
- ClassName: 'tnbbcnzywxjdxgjvzovclwtkpkhksiyytanoaqv' WindowName: 'moqhqotbyczoheoaxmvcwfgqah'
- ClassName: 'lkoeiiafbeyqhslwgnydlcsvczrhtdzjystxv' WindowName: 'dwdrvjksrwqlwajmsbgplzudehsoxkuftutbwn'
- ClassName: 'iidponxtdxfbgboxwzxghunck' WindowName: 'twdvrcdgozglvvymvh'
- ClassName: 'kubrgikxboaezicdscgyrllwizcprsvkdj' WindowName: 'phaikizxktdevmzwgorrrnonhitxuaehpmulel'
- ClassName: 'jopnpsggsupuswcvlmcijafagbeczjhrdd' WindowName: 'tnwkffajtujuarqxempugwpsm'
- ClassName: 'soekhnqxqnaehovgouz' WindowName: 'kzjdvxfxmwzmljpsrlelimgsptzqrfv'
- ClassName: 'ufkyzmbsrnnayiicdodsyobcluu' WindowName: 'jzpwxcjoqvjhlhuwncfyaxuklhoskhsc'
- ClassName: 'pthhxhjyqnhrkestpuxostktn' WindowName: 'uzgyavrldctvbjjbuub'
- ClassName: 'mowkfuajghgfczaiitmtorxqwyfmrpcfwldfr' WindowName: 'ynxurmbkbbqxaoqacujmrclhxubqdbbeuyqmvr'
- ClassName: 'gojhgtvpsantzgfcbvanlgdxbzmooct' WindowName: 'nlcnpokyioxdxjkpqfdj'
- ClassName: 'bbmirzpuueplkfywjrxfnfaaaeqcs' WindowName: 'wotbazcthbbcapkllpqqejnuwwsqdxgknoisb'
- ClassName: 'jzaflavazbjtbxxy' WindowName: 'wmitlijcyyarphwnydzioobtsepnnsrian'
- ClassName: 'rgfvhtihzllbwkeogfw' WindowName: 'brstyybwehqvlgzqwulmjgvnduxfiosandv'
- ClassName: 'jhpibydammojcgihwjlbnivenvjamoseddacl' WindowName: 'nvgjcexqcgcwoawbjigrsdhdsnf'
- ClassName: 'uzqtlchcrdepvjvkxevscbvfejcuqfgv' WindowName: 'lcopcllwpfikxyzvqtercfndyaklexihrodplhh'
- ClassName: 'iqcqnsbesrdsmyuxwlmlfasfh' WindowName: 'eenssqokdbpdghajtaqvafejtbtypicfkbdhlrj'
- ClassName: 'mwrxzrpdgflibrvhmzdifwl' WindowName: 'ecrpdpfutmfkzdax'
- ClassName: 'tzrursudbkkwlmcjcvqyaywbclrpkxrljxdnqmo' WindowName: 'rmhjwqbhtabdtpmws'
- ClassName: 'vpaofyziarhwygxlkdwzdygbglcciem' WindowName: 'ukxowdotihlbzesbiwyegmzghxaqmj'
- ClassName: 'glkqovqxewmynurnoqloznqnzzar' WindowName: 'hlynmginvvhkiecjswcmpboptfqljqepsbxxf'
- ClassName: 'xhrtsvmvgnawpjzieecclxladldvpxpiosdoxh' WindowName: 'ksrgxxfdkmfnvsusidhsqxsrumctpxew'
- ClassName: 'saggltciggwjgmnqkvkwwnqkqcrinjpykkds' WindowName: 'hhxuxoandmsqxatwced'
- ClassName: 'pmcerhgjjesrcgkydvwzdhgblant' WindowName: 'uxdonkiwbwnwwhsvbfkkgolsiucv'
- ClassName: 'pdojxnkpxohutnvrql' WindowName: 'rktrxiupynufwiy'
- ClassName: 'cgiohobucykrfkjacwjwbtwptfuwwnlmrzby' WindowName: 'xmaxnqoeydznjfjo'
- ClassName: 'leqpkcpgxighlshoqtydxd' WindowName: 'cbxqogldhkftuvqvzlkftoghttetvlhhe'
