Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsf2.tmp\NSISdl.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\NSISdl.dll
- %TEMP%\nsf2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'owlnzwzncrluennzouowcuoyegjknm' WindowName: 'inxngwwasxckfvdimplbjoyjtrxu'
- ClassName: 'edfgaysubowopgsaxgrthfuvrxyjostzqyqdm' WindowName: 'giwwlmpqnkdwaukcvmcyhve'
- ClassName: 'sptktgvkmetpodjwvrcojbrqzyqsnyplwmbyvwa' WindowName: 'chueqhqfudefmes'
- ClassName: 'vjhsqhkjwxmhsctgw' WindowName: 'dsvbdowfhcmqdkldhgxresehmgx'
- ClassName: 'poqzaimxvsqjhfdqbkzmqtvcuvy' WindowName: 'xfkxjglugpquarabvp'
- ClassName: 'ztjsbeqrqsrwkgfykcvdgsvwo' WindowName: 'euhoqfxvwjgergwchd'
- ClassName: 'ebmafygmnvvhpxobchbouk' WindowName: 'scqdwnmgbtypxbxsgohbiwtwaxzpilvgy'
- ClassName: 'ndjscjifhyatmdzbqw' WindowName: 'tnklwxestwutrsdqwsxplqespygtnz'
- ClassName: 'hybwsuvjipkylqbxowmpgaujygog' WindowName: 'bqyavumnhjaufbssxlzrquonjzlcglt'
- ClassName: 'qngndambuounoinpqnhtvylmmy' WindowName: 'mghairymzcovofjswqhkutgoxkewy'
- ClassName: 'bhxnwrykmhyrkrbxejhzqsg' WindowName: 'duqlqbwrhmkrqogl'
- ClassName: 'ffsvnxfhxncqbdvnmdalkkfw' WindowName: 'bzwpixzzvayfmzarcngmtucaw'
- ClassName: 'rkxffgdmjaucmumwelkndbqlshlolvn' WindowName: 'puajytjqwswgqggz'
- ClassName: 'ddmmaqtyqfmtlena' WindowName: 'hqhwpocfeaoukah'
- ClassName: 'wmnftkeltziqsuwikoquyipklaxcfg' WindowName: 'nfbsxsjxqcivkcmowjuiqfxopxcuuhpyy'
- ClassName: 'qnxrgpjipenckwxpmcqltrd' WindowName: 'rbbesrnkkvxpjuqoidulzsojxitxhftwmjvkone'
- ClassName: 'xzqvcltvnufxamqqktwehzcsywqztksokcjpu' WindowName: 'wodsahnlhfukiyyuchkc'
- ClassName: 'vovbrafhnzlvdvjrbbwgwehqslnvpvrjehagd' WindowName: 'adugwjczjwwbohauaok'
- ClassName: 'mrdipplxwrsmviqizaixylapdyc' WindowName: 'fwsembgijtwvgstglasnlklwcfekr'
- ClassName: 'ehdkomviaoytohyaqkqunamzlwvtuj' WindowName: 'dijphddezaxptalgoxybryekhzmfhedfkkkfg'
- ClassName: 'nhavjxrchsummomrqduwdgwfthdcjnsf' WindowName: 'wcwonitimjhatvubmsfnvp'
- ClassName: 'qkaiueuylxxdllrhjwgpamjqtccp' WindowName: 'dkzcrmqwygkbwqjpgzyaglekr'
- ClassName: 'tgswyriiykqsuogkjpbthhpjwpywoqorpnnrauv' WindowName: 'gwyuelxmotedoimuqnmumuevjtiykaxxfii'
- ClassName: 'lnvyqncmfjzsbuqs' WindowName: 'xvaeakcuuwqiykjmoqxcjhqsugmnbbnt'
- ClassName: 'qzfgjaqtousbxssgjzb' WindowName: 'frexkvgbwyzkapnecvxxuxskrkerzvlmtvsy'
- ClassName: 'zzefvvqynndkpunlkd' WindowName: 'mvjzaceimnwtoawtxd'
- ClassName: 'kowmddeachenbamglwuitdgqbidatenigyfh' WindowName: 'yguhxgclkunpyizlmqqsxqzqbcoa'
- ClassName: 'hoazbseliasfbfyhkc' WindowName: 'nmyosaeojawcvxemgyvdvxfwkjif'
- ClassName: 'njbnakhsnkcfzfpsmqhrp' WindowName: 'mlcaicscrvqlpjjsheibgptvxtwczqdj'
- ClassName: 'iflueibozzuipjkcqyhrhlprunhwatkxf' WindowName: 'qulrkvoxctkixuvzlhdelfdfxetfcbiekbtaxgr'
- ClassName: 'ghaxohtpggcjtjpqfepqceexamyglvxkemlzycv' WindowName: 'zgqwkamdoakrrejqufhllpkxw'
- ClassName: 'swjlmpajxmsvqnzyeydkdx' WindowName: 'lmydcvpromgbjvgxfoguscgda'
- ClassName: 'mobqypbgpydvxxipuo' WindowName: 'pebsbvqufprduwbqrlyqqfrdu'
- ClassName: 'ycogeixhtyiuxnoqcer' WindowName: 'dcphozqmnjttsblslzbpjozrh'
- ClassName: 'keifdprjjekepflydwxuxkldxnku' WindowName: 'tfqvyswcsvovsqdht'
- ClassName: 'eugkadqywqcnfnhtvblgnczuqfbutuwhu' WindowName: 'tzpqhwnhxhhzgaeapgyq'
- ClassName: 'nwqopcankbtizyzxyvythldjdulllhun' WindowName: 'huzregyhjuzmuxcflccj'
- ClassName: 'exdghedpmccuhlgjxqhmd' WindowName: 'wvawhyzchliguzkvbrr'
- ClassName: 'mjpabmexgythtzksw' WindowName: 'nsjocotlbexiutywhrigeihb'
- ClassName: 'zsdzggsgbdncowk' WindowName: 'ywyioznvqrfwkqbkefutgisafgbg'
- ClassName: 'pnhonigynspepuydgdst' WindowName: 'mzczbtwnesuizuayiyzactccnmnnggkjilzxgq'
- ClassName: 'hvjfkbtlhmmpxweuyfxgbljfadsuaqgn' WindowName: 'dmivjivmqcfyeqmrcztpehaqw'
