Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kmiueufnpaalrmyuiqqbzfmwaqnnatpqtqi' WindowName: 'fbivndcaonevbxzocluubgnggb'
- ClassName: 'pttvpmtqcppmlakdwtuozvcvvcc' WindowName: 'ulpxlmlauhuavqlkksuwffc'
- ClassName: 'sxnvnjflntvzclffvmtjpspkdowraozawtfmv' WindowName: 'dxnoqjkmxxascdfetbisoz'
- ClassName: 'bkuwhonioilthmbgzgaunsewwcqbtz' WindowName: 'tavepjekaukpbneonlwqbkaqfxvkpmcovbk'
- ClassName: 'mshhadkhrgxbbbqjjrnglzefwpeguhbvckfw' WindowName: 'zzxbypeprphmsjq'
- ClassName: 'hartubnwuuywlzmuqvdrbequsfvnufrubjz' WindowName: 'nxsqshhswvqyesrbnrkmj'
- ClassName: 'wcnpmllqpbrzpnynnikpmyx' WindowName: 'eykzgikcgjnhncqbdzr'
- ClassName: 'mcvlsrcncppxuapeecvmqzzolnutv' WindowName: 'gscyofiregxlubnzvgtgkc'
- ClassName: 'mpbxkchvtfshrpgsahbkgvbdvpnp' WindowName: 'ldbhfnhjwccngjrworqfhi'
- ClassName: 'kddlmmqjqfrixeqdhhldbnahupspcojoh' WindowName: 'mddgngmtypctjfaaironj'
- ClassName: 'soeldaamcbvvfwiephujdltygrwnkdbr' WindowName: 'xhymtzdcnzcoacjdgy'
- ClassName: 'trijlxlqepqtyxmfgmyjtavs' WindowName: 'roenlqxjcraebtcbaccoxxnjuklsydeqtcpb'
- ClassName: 'wvaovanmdphczlgvf' WindowName: 'shjbokwqtphuehuwxkopukgcoqulouvfw'
- ClassName: 'mctjbecbjgbyappevmtyzbptmeznxc' WindowName: 'radpifuxahvuoltklfqqjvwuv'
- ClassName: 'hwlgrgqiwwcyjxtvktmdmekyg' WindowName: 'fhmgjlwfzgugqpa'
- ClassName: 'xzyhzamzelwfijtikjqplwdpgdffavlamnrh' WindowName: 'wuurgdcflgrpzpzmclwvjpuqsamewlnwhnx'
- ClassName: 'yzdrpwbuakvkzqyodxhjmjygqrcecjazekq' WindowName: 'dvnbayqfwvcxmotfejjkpwtianewkeperta'
- ClassName: 'jzphbufylgitfxawxcpuvvxaqocjrpkvewwzmus' WindowName: 'nejlyytoiiqudoihuluusjoyykyfptdv'
- ClassName: 'ouqpybisolmwehprbbzuuxvgazy' WindowName: 'jdrsvrlixbaatebwztx'
- ClassName: 'yriftiejhiodhxdybsooswwvcpksovioh' WindowName: 'scrbpqhwzpontjpqadjgtpamuvqinxnq'
- ClassName: 'wbfxmjwmiidwqtek' WindowName: 'wbwepqpolzohkyvesjhogoj'
- ClassName: 'fhicqpdafuixaaaic' WindowName: 'qorohljytpjzbznzgejhycflepv'
- ClassName: 'oopdhkpaisuqoblsootlpfgudtyiseife' WindowName: 'leksdjtfweqktjnkyzpmclexyxwgao'
- ClassName: 'mwfepbxrzhnuyvwknugbsznfz' WindowName: 'xhseqawrigenodbrtunzktpjvhdkcecbfgi'
- ClassName: 'ifzvpulihmzjfrixmzzagdslbrkoufjmj' WindowName: 'qbdpvvmjnrsfoluyi'
- ClassName: 'prwprzeznjlisjvxvrfmszfpelxnchgpjtqiiz' WindowName: 'uwvdzxhgfewenmyyyzaobuobdgnfpca'
- ClassName: 'cwqlvhsfterpyyidl' WindowName: 'lngwcstfgwjppjvqhdosqojjvweseplncvnjqo'
- ClassName: 'qapclqchuyzoyovblwibaxdlweqqqko' WindowName: 'uuqcyvaswgponbiddfw'
- ClassName: 'nissksbaepwemmdcqzovxcjtxcv' WindowName: 'lbtvbdkhtppxaltudovscysrxt'
- ClassName: 'rdbbkgjeaykpivhtwpoznqscf' WindowName: 'fujqtvyfdwacyyqrihjmoklahr'
- ClassName: 'llonsaipegdehmalrfqrhkjzkkjsw' WindowName: 'ihqztgyvqwctntngebz'
- ClassName: 'kymmhxoibbpyzcdbvwzmhmdshrvpjdlrnmd' WindowName: 'dtbubftrvjsjofwsgcnzhujl'
- ClassName: 'xkciugfzuvcrxprvhltwfnevemtqvzwdgb' WindowName: 'yhylhwbhfjidsmjrrpvwrsyfn'
- ClassName: 'uejinuvbursknrcswzlhvlxsrlyqucc' WindowName: 'zwpreptilhlqxngvbke'
- ClassName: 'fnndnueecqyuotcykefdeqbzjiwbwlubuclxquj' WindowName: 'ugexffnspbkootzhlulzyxdhjchqrygx'
- ClassName: 'mqxufbbiyiinuqzrofnluygdgnbg' WindowName: 'dtvmcqibofjkiefrf'
- ClassName: 'qcbstqugdybpcwdinvsvtl' WindowName: 'lvkebkqgcqzawseuzqn'
- ClassName: 'zgjgolmuooiuznqngdnhzoyemclsmgsd' WindowName: 'gkraghrghhgaymznfxlfifocbrk'
- ClassName: 'rtqlhjmetlbewgmfxhefspahqqypqckllguq' WindowName: 'rkircrbfwayesamzfijybeqovdxnggz'
- ClassName: 'iptcoeklywhxpkcedmpjpqvtzxbykh' WindowName: 'hoknbnskwdndxfynypgoclfonzvyckdf'
