Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xgsgbuaxpqcuxeyjcwzouthpibkuukz' WindowName: 'ndgurkczpopzwtvdx'
- ClassName: 'czsnddejlypilarfalkdfweedllxzwlxjajp' WindowName: 'rwqznpwymmuadnujetgpkhmlfvpalzju'
- ClassName: 'pjiytckkynajrkd' WindowName: 'anqxlevoqbzzpeztfvxqcgqipy'
- ClassName: 'csozbjjsvkuekczeoebwsgrgtgyxovizlfijvq' WindowName: 'cdcaooqgnsdbidxbgvycxxgdunhlrterijquyn'
- ClassName: 'lzdkskigelndbilamoxjoegsmantemsinakkzz' WindowName: 'keneaevyrpfskngiecbnuhwjcwhh'
- ClassName: 'trzgapmlsjiwdlsrkfdxjorvuiunlqox' WindowName: 'kxnaydhbejwmfkijfygmjfmubkfecuwnvhmv'
- ClassName: 'qzgdmjhfaytdcdidvcpizcxc' WindowName: 'hdpehbaofhokqrzklrcenjvioskjxlzla'
- ClassName: 'ovyulejvptbagrlmwxpgoky' WindowName: 'donbwllvijrgxytunpuwzvki'
- ClassName: 'lorahzywtcejonmmylicdlmrehzyqxflnxbbmzr' WindowName: 'ragskwukuizqqfmpgwglgduulgnpodfqzpxj'
- ClassName: 'ixcatstcdnukvejsgvcfprzpcmffmxvixenxjqa' WindowName: 'bbewpkzbapdhooembpugsnsdkxhujg'
- ClassName: 'bbclwyrtuuaqsfdqwvleclpgbp' WindowName: 'nyngfifrqgxqdreryyxnjzdytahhsqvqkwxrmuu'
- ClassName: 'bnroqucqgqocvcepuakjbqrkmjgudazff' WindowName: 'hhajgglpwlicxvohfxf'
- ClassName: 'ywcmkosidftjfczhlcth' WindowName: 'aqkzewkmbztrcsuhrkordpcfjvskfovfjvmr'
- ClassName: 'cvqmvbsiibagnjsqtzpzm' WindowName: 'xcyvuwpxgwvioyphlgherdfesqvpodh'
- ClassName: 'uapkpukcfzlnspjogxafazxwmflttoqeznz' WindowName: 'qdgyuwsidkddvkhuducupgkaezbtbp'
- ClassName: 'hyiqdxermhghjoowaoeifjyggrqxkxtqapo' WindowName: 'vebeyrgclvgcagkqqkhdlzusjrtsslx'
- ClassName: 'iqlqogwityaxyuuqjbrrpkuikgm' WindowName: 'koxjwmpnloocliihzhekngkbzvizqrsvcj'
- ClassName: 'hligdinwqetwcmzosuwvig' WindowName: 'naelvlijmanhogtlcngurffcjhopreqlazitzo'
- ClassName: 'imlqwnkeggemtkuutoxivfqsw' WindowName: 'emdbqmzgfldwjvpd'
- ClassName: 'lnjsecyfiyvqghpufkfbpftgpjmjcohza' WindowName: 'lzxdvptpijcxiatolrxpkvoixfcda'
- ClassName: 'zrhntquvzsncugymknjnqrdfb' WindowName: 'awrhzjogalfjihojp'
- ClassName: 'dxholcdhcfetsgeondocybvsdqfwenyebpo' WindowName: 'sedkmaxksffjdnqyyoagqte'
- ClassName: 'apcynusrvppfwiuoofaofjmdlzypxsfcgcdmb' WindowName: 'unmtyfnsuxpaskiuhcnb'
- ClassName: 'pcleojaefqprxahsffpjsogmpthwwrkdlfyfs' WindowName: 'bsdodyevasdxnjphfdldzhilihh'
- ClassName: 'btgotynratcuvxnqgvzfyiwhkllmcepemmst' WindowName: 'reamoxujdzcvlihgdye'
- ClassName: 'kfwxzhakylikjszswwdssxnz' WindowName: 'qrbcrdiaysnfecbcqlwfkflhguhgbpayesanxk'
- ClassName: 'pamqvulfsgefakkdyxrvcigkuoyuvfkgg' WindowName: 'gwsitwhvlsdgibdwgtjfyd'
- ClassName: 'mnxowykssszyvbztquhbpwbbnmvkpnhakp' WindowName: 'uoxoenykejngwmsflwzw'
- ClassName: 'clfehomsjyyauvnnioraw' WindowName: 'atrozccuarpnxjigqbjmpvzp'
- ClassName: 'ckcrzewtmhenvlvhdxwdqgetqbcvzbdeinkzy' WindowName: 'zwfibohelbxndfwmtnsqeacbqhklz'
- ClassName: 'jyekqlbdlgftyhtwxhtuvzqftkgmwux' WindowName: 'guftnicidcoethxtcioqmvsqqlfjpjaodoon'
- ClassName: 'jiyuqgwiljkccwiospbmdjvfkjapwqybzuxzt' WindowName: 'ezygxycsvfpqjnznbqjupoiylbkg'
- ClassName: 'fzvztsctqemexacewqssxlgfsamllmxlqur' WindowName: 'rdmbassduflnfjolauzeremgqzejfmbsyg'
- ClassName: 'bqlrlwfinavdcpczmbiwzozy' WindowName: 'ucopeitdtpnkcnrvbodtpghptp'
- ClassName: 'yibtgsfvyzhcagflngnuetkacnyxtcisan' WindowName: 'yppprfxmzteabmvfzpvoqbkgbmwgwdpt'
- ClassName: 'eyxknbljzgbjvaecgrhuyxvxrequrfng' WindowName: 'absswntdybcrkphfhbkk'
