Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\NSISdl.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\NSISdl.dll
- %TEMP%\nsz2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bzqwohawkduzloaybawxnuyoyubxopybm' WindowName: 'vpgxxrbevxydeategbpfzsaquaxhnfm'
- ClassName: 'yuldllxyltpihxigv' WindowName: 'iqhabsmafsqkpmswkluruusnee'
- ClassName: 'imjhfuvpqpfqjwbghjmvupmvk' WindowName: 'yydngkuiectmpqesjrwpzrqakeqetupzseajk'
- ClassName: 'kgyrukcimdzkfdralzw' WindowName: 'pvpkujfjdbhnyvdk'
- ClassName: 'cpvghbujxcxwkkckhhtilqfxujmcvebcumwcd' WindowName: 'prlforodbjdvjzrrrrmfpuhlezxbkjic'
- ClassName: 'gxmiwmpvyumqbyd' WindowName: 'uywcqldqbhytouvvpkndhecukrlpde'
- ClassName: 'ozozqugahvyxuxlwify' WindowName: 'amwyqvygymyqmagfzp'
- ClassName: 'ktqxmgzqaoztsjvodfwreswdsm' WindowName: 'tzabclilnbbnbaexfzjtbtkqdgphpbhsmf'
- ClassName: 'vdythafmigjodwdixoaszpztasgnfanpap' WindowName: 'idogvxgjrntroqribo'
- ClassName: 'zdkiwykneienvjiizgkz' WindowName: 'sdhlxyzwhlprzucauqdpxsnyobwo'
- ClassName: 'beepncgzuyfjddhzqhnhewtkavasztolpajkn' WindowName: 'otbatkbqdvonzguxynllihonsayd'
- ClassName: 'rpelggavnibztytibnx' WindowName: 'vuwaoanqpwkcggdffchhuicofjglfpuxyvpski'
- ClassName: 'gexkxfnvygmdzxgfyyotdire' WindowName: 'xsautfidtjittaqlzouqh'
- ClassName: 'ffpidzzxszfxcxbxnuncsyvcmql' WindowName: 'szikznlzhslrsleimkpczlglanzmwkylvbnh'
- ClassName: 'qyupsvhiwnxgqflhuaexcgclp' WindowName: 'gtsvgdlogaqvytyldjztaz'
- ClassName: 'gsvwmyqufnsahwsppk' WindowName: 'ybtvrdwdpyqnpmvug'
- ClassName: 'ujwnexdmwswglatrhtapucazuefndtkjjn' WindowName: 'gafmmybmxcjeovdirszswjzb'
- ClassName: 'pidkzxklkignuhlfwhqlruqqpoevvlfxrtqx' WindowName: 'uooajqdmlnaptuxjvhxabrxtetayy'
- ClassName: 'luuegbzfsfifnixzsxeijnntkoueewzsytvqk' WindowName: 'ahunnjqoeapoxklxjxunicftbdjbsfj'
- ClassName: 'mdiwkwsmmxgvxqxo' WindowName: 'crvewamgeyhrtprrzahawhdtop'
- ClassName: 'wllrrjcjxtcqjxw' WindowName: 'ujopgoifusapdopuzrpuzwujlvco'
- ClassName: 'epsbwopumwqwrytmkynpvjw' WindowName: 'clpifqizmzmbcxwvsvbri'
- ClassName: 'mrxgalvtcesieryrnnhlcyxwvtkovhxqmeqh' WindowName: 'ajgwvjqvahzcbbgxuusns'
- ClassName: 'ybxgghsldurzlglwsfot' WindowName: 'udtwowvtnfstmkrzxfcpopduizyfuwxzafzgxxg'
- ClassName: 'eyejvunfxhrxvdvikhcyizgbmlhvwbox' WindowName: 'trtwvzyhphlmvicxgnlgcbrmiauaznlwwqrw'
- ClassName: 'lgpkczjvccaqxpsjngchrqsfontlbnp' WindowName: 'zbcwubhjgwnthjprnhztbkffumrysyoolbbuaj'
- ClassName: 'llvsqoblzxzlyftddqlxfi' WindowName: 'nvugnarhkttiqlpprrmbrljegcfxnw'
- ClassName: 'trxfjqtnmipnsrktkmibvzeikd' WindowName: 'ukootyofehywkcwudarwemyspvimyixzjhnsv'
- ClassName: 'mcvijcgvyheqazgqjxfpxsxzcisr' WindowName: 'mbqjcdpehyytrtzwczcajrcgkmksvecazhpixcl'
- ClassName: 'dokdypdukqwvzpubjmtrrrnycjaprbehvn' WindowName: 'wjaqalfyuppfdtxgrztzhkjqpdaxxv'
- ClassName: 'sffybzhibegbbhcf' WindowName: 'gbweyhceeiszjvwcybajcktzpjg'
- ClassName: 'psmyidnbgtpymeqsdieh' WindowName: 'japabdjbpurumraowjuw'
- ClassName: 'isakfjgavwgmvjoepaxduqbzfwpmijhvr' WindowName: 'qgnobdpeyrbumjvgnhrjpxmy'
- ClassName: 'ypdejgjuxlyggzoelkhekaakjdbfqkmwp' WindowName: 'vbrjtlovljzbfuilclvyhsywjjlzw'
- ClassName: 'hvzeuytmamknwybkzrgutmzc' WindowName: 'iclzqenlgcgnkfrqvdj'
- ClassName: 'cccphicnnlronosfwcpwleustgahf' WindowName: 'qpfemjakyjsxibdvhrvekjixgwyghhthmqp'
- ClassName: 'syvxvvknnexuscfzmonjqcktjvy' WindowName: 'kvqmpqwivjrcntfhryxpqrwcbuutkwe'
- ClassName: 'gkognknltyrakrbuljfckvzonrdiqommhajpm' WindowName: 'qznhfqurougjugxzsfegkp'
- ClassName: 'cdcetgdenpayjcdqegxhnkhzii' WindowName: 'kvgdcitntnvwosyffi'
- ClassName: 'ijeujsfzcblzwbrpvbtkvfzwkbfjrnopsswb' WindowName: 'rxzlvxmycmgdawqevwzwob'
- ClassName: 'qewbmwrixbduuojbblarvmaukor' WindowName: 'iarbzekpglijrnbebyrlujo'
