Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'esjvljwjngzpyhlswavpzrjaahieyyob' WindowName: 'zwufteacthwfayn'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\System.dll
- <SYSTEM32>\PerfStringBackup.TMP
- %TEMP%\nse2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'qutfvlkqpmisirowzrsxdg' WindowName: 'eckpplcfmextqglrszmvhbjasrshevp'
- ClassName: 'puafpvnavartximsbtuxndtdfllysi' WindowName: 'kzusrungsxcnwcvcbvkivjlmfriovhecdlecrp'
- ClassName: 'mleeivfupulgtsxukcbainopc' WindowName: 'nxagkcimriaimpfvrboimxcgpekwsy'
- ClassName: 'bbczzvadmrkvmdycsvtcovacsvxyyoqhpidrusq' WindowName: 'qzordadoldkqkqqikvasjrlo'
- ClassName: 'lnwtqiwsiynebivy' WindowName: 'mktufmqueikgnwqayxbcwxxjsj'
- ClassName: 'jsmidhlzdncktxgryekdxosjcxjnyvoujwn' WindowName: 'uhwlfoghviuqylw'
- ClassName: 'feklubrcddxqfybynjl' WindowName: 'fnaluquhpvrxzeptsjwaquumzedawp'
- ClassName: 'yqbsnmmzmrfppfxpeemrfeestfgq' WindowName: 'wyeqscjvhnrsbjtytpigetjlvdtjhsckdubpz'
- ClassName: 'wgdkzsrwnyrcesortgccipqzpwrfzcnpq' WindowName: 'rrywzobuhmhgctcgmcartjqaqv'
- ClassName: 'ujxjliuprmpmsugpsqaggwo' WindowName: 'itjrobgxbtlmamflkfkyspxxrallgxvo'
- ClassName: 'murmfixrucdjuaemixsyvczgjyeougseqemj' WindowName: 'cbfacdyzbosbbetfuezcsj'
- ClassName: 'hbwekiqyzniczxvaiybj' WindowName: 'hmioqrpmvfawxvbbgbgqypzosvztopoynkeujrf'
- ClassName: 'kwkzdbhnlmhmwpl' WindowName: 'aqokuudnsrrkxupm'
- ClassName: 'wkrznxwdtdlalfoiah' WindowName: 'xjdrmefcsbuvwewepqzfivvqnbifgjanwzoog'
- ClassName: 'udzzotwfavjwrhphjcpiikfspuuzackvuyrb' WindowName: 'kmivwtqfewxfxfjebfixobyzmhyyohwjzxzxauz'
- ClassName: 'lsdqgjrlftkkmmmdaoetyxjtoil' WindowName: 'sdccimovvkcxjiutvne'
- ClassName: 'ruyukdsporjhiqovccuteprsoorftxp' WindowName: 'lxxdhpschitbvdcyrubrziqysfs'
- ClassName: 'bvynlsyokidsaefxwonbfhtzilvwjgkywksps' WindowName: 'yosqjabzkqiywkbreqwjmykjwyfbvuqydutwowe'
- ClassName: 'gwdpjsiqxkmbmvvahbe' WindowName: 'hksaamddccjknhyndrntcxplxkivmxfomi'
- ClassName: 'xuslkagvjjzrhxlpsvpxogfveqadrczmpmfzim' WindowName: 'wqdsinopturzqqxewtyrdrgivlkw'
- ClassName: 'khoxdklyvirrjmjiuanravdxwsy' WindowName: 'mlkiivipdhjkshpbuxoemccrskaxevmy'
- ClassName: 'gdukxfhognauefhtdfnqudgkyqxcoyosls' WindowName: 'rquzuziiuqoeihsphfmfxsossokdgyda'
- ClassName: 'tlyttsnecljahdipzwixgetx' WindowName: 'keopdkyvbqlpfftiaofz'
- ClassName: 'pxjvynwaxrdpjmebbvemfxbezyafrsmzdjdb' WindowName: 'scpyfrkpfcgcdbx'
- ClassName: 'arqijacsurxzrhennmhucwokerc' WindowName: 'ihgyvmsrknaiiupegpkixwluctc'
- ClassName: 'ylcfniksarplewtxriujrjcqicwgt' WindowName: 'fuvopjrhtalmyymzzoantyxovaddpxxfztkgp'
- ClassName: 'bvfrvfcczstwzjijkrwviyy' WindowName: 'znkoqwfedgbmuzqdhyaytqookslankmx'
- ClassName: 'dynedswgfemjraxfwhaqkfspguhh' WindowName: 'xwkbjxcnuvpzxlgnimjjrfbphozzcwqfsvps'
- ClassName: 'pjanpkzplkgmrplmroagmbwbwsuazsgkbngi' WindowName: 'gnusinxlckooakvjljenusfzevtxlnzf'
- ClassName: 'rskrsyalxzsvzzmmssputwhguymsmirizl' WindowName: 'xvujvzusowwsbvdkgspwm'
- ClassName: 'qdsrlpjkseqcqmrhntanwmxndohquboqjswadh' WindowName: 'qgxnpqkqoctmnaglkweitsc'
- ClassName: 'jqdxfuqqvdlohvnqxrojvaj' WindowName: 'mzxkemwwuplisroyrxxpjibkvrxmqemeyksj'
- ClassName: 'wefksppulmtiaqzbzjqxe' WindowName: 'pzsvpxessawwqyzvxrrnixfom'
- ClassName: 'uywabemobvjpewaa' WindowName: 'ocfuxghdmstbtmsmmyghdcypjzrrceg'
- ClassName: 'rbakkfghdwvkzmnaqvjojjfpkipl' WindowName: 'ygrhlvtiypqysofqblvfwndjshbtzxykgbp'
- ClassName: 'jhyhghvjesmsukoxvlo' WindowName: 'hyiyqzzhdrgckrypwdsntvpxbzgtiaeb'
- ClassName: 'mdowhejvrxhlkcutvar' WindowName: 'rlbhyeqxlkozkqrpcbdjibioemvrqhqs'
- ClassName: 'mklsgzhagpmvqclbedfwdixeeybnfdjhjqsp' WindowName: 'zvhljhcpcoyrmshdxjao'
