Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kghakazaewnitgxbmhrcs' WindowName: 'eefeytqhszygqrwtqfbkuhqjje'
- ClassName: 'amcdvuwwzrcpgrrkrsstfriytstnawj' WindowName: 'mpqwqvnhvebqxowezylyox'
- ClassName: 'nbdldwmmrqhusbuiapffhnw' WindowName: 'ffacprfbcphotsoki'
- ClassName: 'zwjlqrqpxajfnxqmdkttjefzpl' WindowName: 'ffuqzqffgewhkkgvaawbzqovmqvdmwlgroe'
- ClassName: 'lqunapwbjnyjswbfxdtoz' WindowName: 'rbdmxaoxjolqqpeqfnf'
- ClassName: 'tdofxstiwxwbnrslsgrtotkpxl' WindowName: 'lsmzguhkctdaiwebzkbrscictljrk'
- ClassName: 'agedxfhgcjymmghyfqnbvjevmotvccvqgvrufi' WindowName: 'cgwylimxlpksymll'
- ClassName: 'yxcndbqzyfavgvqswtoexkozk' WindowName: 'deimcxoaihabveupdllzprtk'
- ClassName: 'dlwbxmmgyxmbciufglvas' WindowName: 'eovlcbgfkkidapjfrt'
- ClassName: 'afcrunemtdmvxgruaxtppidt' WindowName: 'yypoymrorvapofjrwrodpf'
- ClassName: 'hanktpofulebvwwvugclgsjzwmof' WindowName: 'mabdsiblwhziwdxzzmtijsipaxuhrjkkj'
- ClassName: 'dgrthaimbgekcepbkirgrrwefcfov' WindowName: 'edxbnybdfyxvpeefpejvhspm'
- ClassName: 'kvebnkfwrxgwsimihxyozojjnhmdavsoul' WindowName: 'trrdcrvgqythpcvszhvlus'
- ClassName: 'lgqgnbkvgqfefzigbtpnknyghnznrybbpvgrq' WindowName: 'zlueblusuiuyxzorvqyetrdkuuqqoyv'
- ClassName: 'toneoxsjitisngfszu' WindowName: 'aselllywubwfykhpxojlkz'
- ClassName: 'drxkdljvyuwrxiw' WindowName: 'iztabdlscbrhocdja'
- ClassName: 'gfczcsyyamkyysrniwihxgavw' WindowName: 'wqixmpdepiqbykkohyhjbcrxuyun'
- ClassName: 'gfnkbkyuekiyonxcrpfqjlmw' WindowName: 'duxsmqoxsiybvfoguphqyekvl'
- ClassName: 'aklygszdxvjnbhilquweyzbsggyfvtywptpf' WindowName: 'hqageoxbpqnemllablxqwfawls'
- ClassName: 'reigketuiirnkdvhqycciopico' WindowName: 'iwnzujophkhgqmgijogerhwahsvqrrkdj'
- ClassName: 'wxvlpdixutrizfynfashfckanpyziyrdk' WindowName: 'ukjhfznpayjfbymrqgzldjnwssrdhzsmovglvh'
- ClassName: 'mbodsdqpnbpwdyupr' WindowName: 'qlmecebdvoehouevzwnctmkpjzquybrb'
- ClassName: 'zfbkzpcxkzsqjvawh' WindowName: 'hngydrgxstzwtzzuoijkvkfobwnboolqe'
- ClassName: 'kjadtzsnfzmjmjzjxmkfurydgcovhnw' WindowName: 'nvaczztbbfbljxyvbpsips'
- ClassName: 'jfelbqsseygtvzxb' WindowName: 'tpedqdmwpjwkjmhahafs'
- ClassName: 'nzbnougarhlhbaokf' WindowName: 'sudypccpfwcnsquzejso'
- ClassName: 'mwysodurfcimeelbzpjmivrfbi' WindowName: 'nuexrrgiqlrmiqvatapbvlalukpgtimwy'
- ClassName: 'hpbtqesvusbupvoni' WindowName: 'agplqchwmgzewnbwztdvccuyjxtyaufusmkap'
- ClassName: 'xkqfhmyfyksikjdtlzuotgdhgzn' WindowName: 'smuojbjlhcefgjdcudfukbm'
- ClassName: 'lcagwwfgzqzbtpvmhj' WindowName: 'jomvqgkchmpkxhzzpotimkkafgus'
- ClassName: 'eipzbxemfwkttrzrwdmfhqldypguvdahdwtvhjp' WindowName: 'eheesdrcmbfevwlbdtis'
- ClassName: 'gzhqrrgycihwxhh' WindowName: 'ejuizhahlgmvaqpeczvrzpnqiroggkstlgwq'
- ClassName: 'urutogiksejjtfqlnakovdfepxvjehagomjnwzv' WindowName: 'wnafnkmmewttiecstulopdx'
- ClassName: 'jrpoecibtbauybagjtbwhef' WindowName: 'pskqvqmbbbcudruhera'
- ClassName: 'veyyyhwrevizdylwux' WindowName: 'grdwcabagjuunhyqbjensiiockib'
- ClassName: 'npijgtyakrpfdhkdbsehwxdqexmlmhfaoashrd' WindowName: 'yjajmlmyxsyefphhmpouqc'
- ClassName: 'oqweowyhcylnhxhuizkkmvyfmekpysst' WindowName: 'dvrpiuzripahzrmkheqovmxfvlsuqeatd'
- ClassName: 'vkjyisrhhcpaijpidyqmel' WindowName: 'uzshasaaphwvcyuofk'
- ClassName: 'bqyzixonasretcdjletpbwvthrh' WindowName: 'sxyyopttwtsjkuomwvqotljuohsjnevayqook'
- ClassName: 'fftdkskadiwxhdr' WindowName: 'zxjhdwivmxienbvddxruarivbqxbbfcruiujwa'
