Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\Math.dll
- %TEMP%\nsy2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\nsy2.tmp\NSISdl.dll
- %TEMP%\nsy2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'rwofnqabmimohmmvsngfshaztvqquz' WindowName: 'vndlxyettxffesbcpiikvmktd'
- ClassName: 'qautuxffvkpjfofmxusdtfjeoqdbmjqb' WindowName: 'lbfapndzbbdpsrohidfkvdjridwniebyidlnps'
- ClassName: 'satgohdvortgwogiudtujjvzkkp' WindowName: 'rqkmfcpanlqpkmjxbadvvjkdjukvlhtki'
- ClassName: 'wacusdcneialliqoksubwawvoqmiavgrhah' WindowName: 'czgpyawdzwpsjbbruxtsmsrfafadtwdc'
- ClassName: 'uiibwzzpkonkijeqbwrylpbxlcutjjhwjentc' WindowName: 'gnywsqkzzvxakpezqgcaothfuqu'
- ClassName: 'tfcaicqcjhtsmirkkfsjdrymsmllndlhxfkbpi' WindowName: 'quiucghvqsilgheygtvddcirbmkgijejvyhnv'
- ClassName: 'obfdruiqeqzprtjmhqxcs' WindowName: 'ihzfyiqqvabapigbvlukgkanexhadqj'
- ClassName: 'ngoorppusxyyzovexspfhxn' WindowName: 'asozotksheohnumpjmykokqkkgszakkztamfjg'
- ClassName: 'fohhunswlnljsdkioxibwq' WindowName: 'dynamktnoqgltcoqtuhlflakfbs'
- ClassName: 'okqkpeqmnqlbryy' WindowName: 'kaxzplnqqyxsokxre'
- ClassName: 'kylcfgymlytthjzpzbxdvqiwl' WindowName: 'wwckdectyhovnpphk'
- ClassName: 'sxfzxwpmgmmylxyuagzfbvciw' WindowName: 'hpxjsawnhnvlyjeupvehojqwqef'
- ClassName: 'hwdyaldfacimczrtmt' WindowName: 'nougrjwuhkfayppbmqivjgpdjtq'
- ClassName: 'yipsffdejgnpodlwjqjjljecupnvxkzvkx' WindowName: 'woydbrlqubonlkllpnkiyvvekxgn'
- ClassName: 'fqsllduenblbwoosoyvezblqrmv' WindowName: 'figoqwakmxxcwnspdcrnsahsjhsxfibmrx'
- ClassName: 'ughvfucxklmzqxzsec' WindowName: 'zgickgwttnyhyjcwgiaezahyjdrsvujxnjnpbxd'
- ClassName: 'pvthyqddcwuxqkbpsrcdjypzewlqmxp' WindowName: 'eijxqgwzhnaczmkrxoldeidixtflie'
- ClassName: 'vprjdnaneilqfrmtr' WindowName: 'nxzbeylcovmyqcptxqoof'
- ClassName: 'htijlwspymglzvkjgzenejslia' WindowName: 'ksexjtdazqcoixfzuwubktwnfuk'
- ClassName: 'ylpnutxoxtlomqbsaoigcxmdop' WindowName: 'ysscnhzbewjnjiob'
- ClassName: 'bwtpgmjcmuzwryxcxsqxpwmrkjhc' WindowName: 'hbbdpzhnspiwfwzjvfniibkjjpsfda'
- ClassName: 'vddswejyshfphmfyevowkpankotmd' WindowName: 'xvofuqevjhbagfwwzqhjbnuk'
- ClassName: 'pschqxuoysfvjllwxxbvjsiakwfe' WindowName: 'jnqhycjuwjhmrrgzjtu'
- ClassName: 'xbnflpdlxfugrhbearpjizwfyrwgw' WindowName: 'pvpmrxwfvnirbcvthynrsbimfxuuyrwjbzxigrx'
- ClassName: 'jodfymzbvjuphpdsyigtlafudwlepsizjpppi' WindowName: 'kagrsjixfipdxembxjwdkghxslmnqj'
- ClassName: 'oztmmeynhhoingemzqqrlaxnewttfoxj' WindowName: 'sgiwmrctpdmloxrdszabpzrn'
- ClassName: 'nhppgiafomffyngdxcajbvjswgqucsisrnhq' WindowName: 'vuoimsiolkyoozgpybucjhwibgbevlmmtowp'
- ClassName: 'aojhsyehruqwnlmryetkrpikjdvcv' WindowName: 'yyezliugyfsfffzscyr'
- ClassName: 'ehfmcmnvgkswitfiwxmtfe' WindowName: 'uasnxldacafpcmrsciwnxfn'
- ClassName: 'zrfvnhqwvzttovvwlitmg' WindowName: 'hcgmboeggfkdepsudnngpl'
- ClassName: 'tzrbxrixkowznxorvnucrqvvwalmhbuybuwpn' WindowName: 'vvdrlzmlvaqzliboggdifnfn'
- ClassName: 'vfrlrdtxaznzmnzgrnktzhjmrglsh' WindowName: 'hgbzrzenlbnuhgzuepzlas'
- ClassName: 'ayodygvqsnquvtrmaxlhbneqiedlzdgzzf' WindowName: 'lgeneszubivlndjeqplyqpj'
- ClassName: 'omdqgtsqfkvqeojyysj' WindowName: 'vexndhngygyagucujfvujckvko'
- ClassName: 'segovrwzifeiscncqpaogjntiuxqyuqjcmex' WindowName: 'jdyvgnjbyufocyjc'
- ClassName: 'cfxpvbexdwwsxodwiwiqemsfyjmxgl' WindowName: 'mbzsafqebhghqvliprknxkohjdvfrmqoptbmi'
- ClassName: 'icsjnisqvphmkuwqxphynbopnjatrbaqxm' WindowName: 'dbxczxybwgyrxnmketmyqrajgpbejlhgkr'
- ClassName: 'yylmjbqokqgnijamxlwgqiicovwmhjbuk' WindowName: 'rpbrjxnfburczigdbyyjz'
- ClassName: 'gxydikvcogmhklcjgugrkwkpzofswfsmiinnafs' WindowName: 'sogrllkesxacoegprgizxeffulsqappwaj'
- ClassName: 'eolalochuwweikdftxybfhvqatltywubv' WindowName: 'inknoclfkfdiumzbenluwnidjuafkmggu'
