Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jnarltddyrsagozrgfrrfslemdxkrpt' WindowName: 'svjgjhkikpmbkegmfwziuhnzrjwoh'
- ClassName: 'tfptydarksyywvrtuwtklbop' WindowName: 'fpmoglmqctrrimij'
- ClassName: 'jrnfeayocgozhyouldbujctmlsnkusgvgdaca' WindowName: 'islkjalavbyvransffufadfncmrorlslwnkdhzk'
- ClassName: 'xjnttwxlhdxsmhngwbmclupjz' WindowName: 'fwlmpnmxcikkzkfqfycsekdynhndpcsrf'
- ClassName: 'kzqqxhlceagijfqdolwooughdrobiladga' WindowName: 'cggyxibpqmxtrbjdpnlkpeymthpqsmbc'
- ClassName: 'ukofurkrfrouzfihydvdwvofsvbemnhea' WindowName: 'kygxeujlyqzjxvdqqlbfqrafwzossdbm'
- ClassName: 'vytczddsdieakilbgdora' WindowName: 'pwhojnwxcuxmxdagodvbsqedihicq'
- ClassName: 'zbovpbkijqjigpvekgceflhcsslpqdubj' WindowName: 'gaueumevdigrvdzgvfaxckqcquqzdkwrkw'
- ClassName: 'nlbrlwjjddvgyynrifxhajvhfgdf' WindowName: 'naogkqnevciynfgsgtgigsmsaxwgjfqvcb'
- ClassName: 'tdoxakoqkksmrpgtqgaadvrnvlsuptefat' WindowName: 'vgbsxkvniwsplypinabejjdskiddcnifmlwvy'
- ClassName: 'mvocjvdsvsklhcqruksnihfcfdtmhjfardomzcz' WindowName: 'xnqegjgrlcqwqlbfzyetgqhtdqpqqnyxbpwuwb'
- ClassName: 'zkwncedzhulfdfg' WindowName: 'uvkqodgdlxiiyivissdkutzgat'
- ClassName: 'jgfhdfrtnsiqcfmbqsymgveotmycxnaumuzge' WindowName: 'ysdwaenttxvlroswrkexqpbvexyikzxtgtq'
- ClassName: 'gayiybpfxwikrvshxnpbinncy' WindowName: 'filnpuagsruoejhzqibvawknhxibxulyzjzdn'
- ClassName: 'kxgugezjumgbjcmpkloxfcw' WindowName: 'dmvdrczsvvogskumdjkerujneogcllgyerq'
- ClassName: 'gboybqbhdiffeaq' WindowName: 'ycetwpyqlmfhbscvhpixgkne'
- ClassName: 'vkmywyzvwbqqkndojr' WindowName: 'obfpxcxeeogdxigsilsgxsralcddksyx'
- ClassName: 'sdfutiaamuaduoimwxbtuswgzvvmxmb' WindowName: 'rbvmbuqorztoellxfkbgiunirpviqqw'
- ClassName: 'gzcglsjdiapltjsbtatbpyrijiifd' WindowName: 'qgcbmzrbkkzaywkqqnfpwgewhpablxwcpyeqp'
- ClassName: 'evuddzfsgaxfckkffrxujrzlw' WindowName: 'nudvrpzxhqwqdappcklibdrcxahobazi'
- ClassName: 'yaxovakymdieitknadostjyjcsiieogilkyhwv' WindowName: 'kzgmmohkfkpcyghqyfjcdorvjmqmu'
- ClassName: 'uzrzotgosrqshotmdbchzmicgsxrcjut' WindowName: 'wkqdvlemgapoksumq'
- ClassName: 'zdrnqzvkhhrrjaqicfjcogpnl' WindowName: 'xektnibulyeomlccahsht'
- ClassName: 'sgngftpxgqmczipxsjczbzeusramewz' WindowName: 'zlttvtvicknuyggbpzwfjig'
- ClassName: 'yehxergpsrijpxhrwwg' WindowName: 'clhwnpdvcnekelbx'
- ClassName: 'mlaldcvyoqayrwn' WindowName: 'zzjetwqmzjrmphyfchkhobcdfw'
- ClassName: 'nptvwgzymfdexgxaddglkm' WindowName: 'puosdskzamzmyzbd'
- ClassName: 'fetiemwoeajohhjufitlkxafgotfxxmxueh' WindowName: 'sdoefjlsynozopgwqaowgmnecxn'
- ClassName: 'cykeyfwphpyrktftjsdirzphceirjpgn' WindowName: 'enwrbbkrprcnpgndagkxvyzcqgndg'
- ClassName: 'ktlqmhqmxaviynizikc' WindowName: 'puzgjcmezxjxkzdovgfy'
- ClassName: 'lmejrbkuubuslebqsfvodnmrqtelxnjpblvytev' WindowName: 'fjlldhukmiilvpsntgllgwxj'
- ClassName: 'xyuasahhfpslliq' WindowName: 'sgtllllnxrurgnucmtqpv'
- ClassName: 'vpzwabhvjtyoqrcoqe' WindowName: 'cqealfowaxfqsllvhhbgkmsauvmcxoggnjzhnag'
- ClassName: 'lqgtbfxbxsjsejmwhqgonxhf' WindowName: 'gkudnsjhgqoynwmftdrspeavcgwlanltpja'
- ClassName: 'ebltsyrbamsproyfckw' WindowName: 'ybjcuwwotrhgwiqvxqduelfggkbgiowlaklv'
- ClassName: 'gfnsqkwttexuazentfmtrxbtq' WindowName: 'zooiakgwqpdkmctnizldkusqgommi'
- ClassName: 'ebrklobpurvjpioogutduut' WindowName: 'vbttpeotswhaaajqlzeyhudzjif'
- ClassName: 'xpswbufrfzviizduivblmacsjirqrjndmqcjal' WindowName: 'fhmykodisvapiesnsu'
