Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ncovywcmlkyqlowkzb' WindowName: 'zskydbyfitrppkvigdfbm'
- ClassName: 'chbrgjmxhhpdzafqb' WindowName: 'ysskvktduegqkltbjoijftleacurbzebkgt'
- ClassName: 'ldgczvypfursfaqvcefwii' WindowName: 'knzwvcknhzcznymfrnabmzvskwpbpnhg'
- ClassName: 'ulgrqrsacvddndywqfyqohr' WindowName: 'brjrkesbnavngtu'
- ClassName: 'ypotniloppbgdqde' WindowName: 'eywlttdnurbnluorpdemffq'
- ClassName: 'dawjjqyfsboxhanojszuiyauvtu' WindowName: 'erzqsernfksupwibamdkgtssxqdmxdgdkc'
- ClassName: 'knncwenmeisjrhvjs' WindowName: 'gnfxcpsicvasliush'
- ClassName: 'keyhtvljskctweypoqtmnlen' WindowName: 'qwgjcaiznqysgjtbmhzmigjlgdyl'
- ClassName: 'ojruyrgafdvcafinqjdzweptoffuyzokm' WindowName: 'xuwzbxnfeuwodtyjvuiabscxyyikjujanejt'
- ClassName: 'szjuqttrzxrzctldr' WindowName: 'swndaqgffvrynazwxbrnoypzluyyhsqlyryoh'
- ClassName: 'avbyirmvrqsptcwnrsxqnvrhcnmspgka' WindowName: 'hvoehenbtvngifyx'
- ClassName: 'wfxrpqyprwqeujvihipkphfya' WindowName: 'odiepqickpwmofeqjhvdhestule'
- ClassName: 'camkxjlyyomdwqnfjouhtpelnebvuxiy' WindowName: 'jemffkcyxhrzckoeqfw'
- ClassName: 'hebbybzmukuazwocqvcesuynqvmrozhmqodi' WindowName: 'ktjufiygesxcgsuhhkvzxxtj'
- ClassName: 'raqljsdtbablurfhcxeqdg' WindowName: 'hgrizsdtqyevfozsmsgfvk'
- ClassName: 'rxqtewbtogperhlelcgvfr' WindowName: 'jnkeygnmebdcjlalluniyekemb'
- ClassName: 'hknuoczloyfnhbaocqzifzindlxpebgspr' WindowName: 'jgkcgpwmacjtpanl'
- ClassName: 'vkfxwvibvttyiubnbmwgmozlqwl' WindowName: 'qvjneddanuwebbjqyqkfogpjdrvsfnjagk'
- ClassName: 'qjricnluqvztmopnrgpugnyiwqjrhealxeqxllz' WindowName: 'uikresepcgclpaybgcgdvuqblodurwcalg'
- ClassName: 'nuecoccvchlsmusyaxoiojukgqljshw' WindowName: 'vpeskaiugqhmfgje'
- ClassName: 'scgjyyqygdjtugbwvzcgqewuuhghmbfixswlsw' WindowName: 'hvgsxsokejjxwspjlugpssexmflwakcnr'
- ClassName: 'peznemqcxwwrewavlamf' WindowName: 'niqheqpfvvoxddrgtdffxrgwunnft'
- ClassName: 'dypplkzyvvvathyxvbawerwlasqvmqqspc' WindowName: 'tydevycprsogkkn'
- ClassName: 'kmyrbredqhnhebbopt' WindowName: 'zrdjceqtpvpffdha'
- ClassName: 'rflmmoxfyondpwewbzvxgqozeldrnjk' WindowName: 'zxexalvceyxbebulioqyewsaaatbsy'
- ClassName: 'laeuhqzukwryhvnry' WindowName: 'biovmfmccsaorfmq'
- ClassName: 'xcxchomsuwbnfqqlsssjwjljfggmzzbymhjgazd' WindowName: 'hamjguxngirsvqnhnzshghgosiocldbocgcdoy'
- ClassName: 'yaibqdjuudqvlipfcxsmognmddzffp' WindowName: 'ipgdweepynpwvqzwhifhjeonvojdzhyt'
- ClassName: 'ackroykyjczxaaysrss' WindowName: 'bpmavwnaoinmvsfy'
- ClassName: 'jgrzelkdzfnvfhflkeeldemqmtsrlagejlly' WindowName: 'pxegcezpquggznrsgpsvayuywqqldublyvc'
- ClassName: 'eiikixcogtvpbciuykizzozuklmavrkpuax' WindowName: 'ozmmvfvvkejsmsfcprmswimauzpkvesho'
- ClassName: 'pvlefegaddrbkcrlvazdkw' WindowName: 'obqngsqkeqjqposjhlmgrmvuqtwqbwvf'
- ClassName: 'perscvxwmmxlmrozxwceqahllkdthww' WindowName: 'sqcflbnbburwnhcbfgntalsxdgvjbeysswotub'
- ClassName: 'czbttproidupzhjkedqrachcjcrrahedle' WindowName: 'geyoiizloyfkepreec'
- ClassName: 'liqrkmvlervtwgqrzsnfaxzyhiqxh' WindowName: 'kpoufbarowlhfugdvvyylc'
- ClassName: 'mzowxxwcyzpbihme' WindowName: 'iwuqxptyhpsfpglfqgjiridyd'
