Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsa2.tmp\InetLoad.dll
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsa2.tmp\NSISdl.dll
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\InetLoad.dll
- %TEMP%\nsa2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'doqaktbzjzmnlasvwalekqcvlzjnwhj' WindowName: 'dgkdekhlussvpxdlinlnhcantswoeouqjrf'
- ClassName: 'mqqtneitofmiglwctnie' WindowName: 'gahnyidbyphxchvqkqziscihuyvrd'
- ClassName: 'gbaouvtwavjqxdytcum' WindowName: 'ibsalhaejommcrihbvfwnzdsibbbljamtuay'
- ClassName: 'yrsnhomjsbxhkfhpwozgqsmunifppvl' WindowName: 'okhnrskudcntagsxiiljsnuqmhrnkmzvqtjn'
- ClassName: 'mbypcofsuepxsgrqjmvkabv' WindowName: 'llzydmgrdsobknojaozlbosxucfjyqynlwesv'
- ClassName: 'ajnrscudcyddozimxkiciwrjjyzcztsaln' WindowName: 'ffnjzvkeirsvakz'
- ClassName: 'xwnijwagjpdbxahvraispsbxgrwszvujtbu' WindowName: 'qifefukxgzwwipdhrspowqbjrpsltqisf'
- ClassName: 'vcbkryooylaoahfgugam' WindowName: 'ijamoglvsdehxmvveyjnxsxstfo'
- ClassName: 'njykhguygqliexarxbavuovhgxntzzegp' WindowName: 'fzsfdennkxvbehhzoijxgimgwnlcanpatvsh'
- ClassName: 'hxvhzyuvqqmdyxwhyr' WindowName: 'zbxwtjmopnubytgqw'
- ClassName: 'glleromfdgigqvrdfy' WindowName: 'efjcessktqlmnzntzqmkjiamkrrmxjfnsf'
- ClassName: 'ndxohhjbmyhbslfvacvcthehhshizhflam' WindowName: 'nttccmuleoswfmaxvolbbspurcjttok'
- ClassName: 'yontnvavsehmlajfjmupjbomoxfgjq' WindowName: 'gjynlojtrsyrrrutjplfwizgbdfidkuf'
- ClassName: 'mbjxujppxbxhpvweohxjkwwwnioyzmdrhkkuz' WindowName: 'kpybjbfoujyjeausxxdpznbjqffgjuiitwg'
- ClassName: 'hqnitirfuoxvbdia' WindowName: 'laklszorexvkhrafpzskmr'
- ClassName: 'gzezavtdnoojtuosxlarpjxmitys' WindowName: 'kxzcxqymvfcasya'
- ClassName: 'aptjppaqgdcrozdqznwqswnadmiqxtipfww' WindowName: 'abunomahbusefjnc'
- ClassName: 'wwhmheelpzfqcgnsvxceluw' WindowName: 'gcasepexxeffhcrxnwihihlyspgbolmodxguyjs'
- ClassName: 'bkpjxopoqpelybrkwyumelpukkusjyjn' WindowName: 'oebhgdwrznaxksojcjwbqeaivtszlwmeg'
- ClassName: 'wnheypsbxrftnueeodmc' WindowName: 'zktgehubcfdcaiwfrhuqlaytt'
- ClassName: 'pmctruidewygkcg' WindowName: 'mpbsnlpfpnxcszrrzrifl'
- ClassName: 'gsmqcxwhwluimygljwwllwmspwehkfhj' WindowName: 'pidrcqyqickereyhttzgternsfqtcfpwyviveja'
- ClassName: 'qqdnhubuninbyqtnekdmllfjwvqslqylz' WindowName: 'uhkjcssiusnthxauimcxyhohofksfiqhmhin'
- ClassName: 'gzcddnkieiqxcrms' WindowName: 'ltvoktbbcpfpgqifgqhjnvdwgbhsdyndc'
- ClassName: 'wzjuhklsfrzjufrnoldb' WindowName: 'fpqkbhmglcoyblghdcodd'
- ClassName: 'sebokpricslnfefnmtbvmaubmb' WindowName: 'mekhwryzxrxcxbpyoivmmbjzbc'
- ClassName: 'jjjncmzjihqkbtgydkc' WindowName: 'sbozpzpeccdxtdjim'
- ClassName: 'otiullpipsoxfrgukgfzkx' WindowName: 'tewkwqoxmqdccdpgcvkjo'
- ClassName: 'yjbnakblgdebundn' WindowName: 'fuscmzmxkvlzcsgecap'
- ClassName: 'xaetqklaqueexhqfnuada' WindowName: 'ssdkjsurysnnuajtczxhnykyakresqogogu'
- ClassName: 'ngdftzqaclnpozbvimyiipenizqlnfbnvyp' WindowName: 'rsjxfdlhfhjjdggiigkkrawizazx'
- ClassName: 'hxaifhfczqmfuzvrwohvcp' WindowName: 'vktbhnjxlmhsoieeqlvymscaepgnjmttr'
- ClassName: 'botaehgslglnmqblqzkbtduwdkltcbcdprpkd' WindowName: 'zpjeyxjgfntbgjmx'
- ClassName: 'xqrzaljktgvazwelymanhja' WindowName: 'lvedpvgcpjoscfsd'
- ClassName: 'fsrepmwblsluaogrmhsulinccvrfkzayzmkwmdm' WindowName: 'andqptmvpkyssaslnvndthxjbd'
- ClassName: 'nvapcqxdqvvvnnzin' WindowName: 'gyetavxzjsizubibnukjemshtbwmufby'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'rdzdevucooyyrresavgorjhomrrwxci' WindowName: 'dyofpndsaqgiadoaahrmwncfezwcobs'
- ClassName: 'xphrperjedrmqxdkfafqsc' WindowName: 'ufqganhyskyezkbxmrjevtkvsckrpu'
- ClassName: 'offsjgeyexuoxwqedoq' WindowName: 'khmxgwvanjwfqvom'
- ClassName: 'dxutbcrsjolwfjrdfapukhjchzpurczfkvjmr' WindowName: 'pzbodvnaaedawwoyclpneinyvifutdn'
- ClassName: 'oqduhwvncefpntnvulezviytgdxgabvla' WindowName: 'sgfahwgydmjjpjyrdtmmqhjvokwrh'
