Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mjrdiavgpvfqyury' WindowName: 'pzqdgvuldaefheqtvfikocysjcczd'
- ClassName: 'yvxdfelthedutvazvjxkdh' WindowName: 'tslmycruvbleltrmeyaesknncnrms'
- ClassName: 'nbqfwwclpfuxcfxu' WindowName: 'dhobssxxvvenfklovt'
- ClassName: 'sjapzwosyplklxkjormdoqcvqsapzs' WindowName: 'pbgxcfuzivksvvhnwgvvvhprvjpfue'
- ClassName: 'gpgmrhthuwndmgsjokmxihjmzxyqimfoxozmzd' WindowName: 'mnuevxwfesknhfjoa'
- ClassName: 'xcywxeehhaqwdxpnqzocdjikkeemmtxrpttiw' WindowName: 'yzjpibkunkpcwbbdvqigtjl'
- ClassName: 'ejlyxmcufqhxccdtjjobeoggmfkcttwowg' WindowName: 'vsrzfdunqgnqtxmdlmdbhxfjbebrlolgkykqd'
- ClassName: 'mqwsljgbndyvqmoxdlyuwquejtpgibihmdkbt' WindowName: 'spgdesgmmgmjoylpvfgqspgisnyhtdgx'
- ClassName: 'wcikhmnrgkzbbrhmtspjal' WindowName: 'odrnjcztztkmdjcwwmdfldkdshd'
- ClassName: 'zkewiqdbxrumgnerivncynrmlfvbm' WindowName: 'kvigaqqberrdekztamekly'
- ClassName: 'ndlwkekzbftnjljsnwmngkqjwqd' WindowName: 'fodntcogjkcqqon'
- ClassName: 'zwxwwfhzjnececctwipuxzis' WindowName: 'fwsqtkvrwbjfxfchoqzozreblkcxzshmqyre'
- ClassName: 'rdknueuuwqntdxtuyegxokbpvlta' WindowName: 'xnpfdsyqqpgipzjlpuzwkff'
- ClassName: 'peflqrmlnvxlvrhr' WindowName: 'sjaltootmtqmsbfpuufrqvbmkr'
- ClassName: 'beyomqxcbgskulptnnrwntpbyzsknsdoyojhvaf' WindowName: 'vjpivvrxvqzdciomw'
- ClassName: 'hgmktbynunvdvowtqqjnt' WindowName: 'axszsmoduplaauwqxjvpdruskazztsnjmrmq'
- ClassName: 'bppgfzsqwzovnmlbflhvbehccweceszwqn' WindowName: 'zqgaboerhvnbbcgdsejggwmaqof'
- ClassName: 'ljhdeovoctffnwsjpgbhpejxdqiawiwvt' WindowName: 'zabczvpgbtpdusqlqbj'
- ClassName: 'izyjmwpsdfpooflzm' WindowName: 'ylzsqlwdowkvqok'
- ClassName: 'jqumwxfcmcczrhwygcrwoffycnvlmpxkuin' WindowName: 'eztvoidizmmupfgqgobntiasyhrtoxqetaxs'
- ClassName: 'xqnshbusbmbkfwcmiiuswhkphjlyvsjhza' WindowName: 'gegnwggjnjurjqtsrago'
- ClassName: 'uubtagoxuuxvlqsqslbmvfsczzxaed' WindowName: 'gbnosjndwpoevyg'
- ClassName: 'xrvhzbbvmfnecuniczplinjnotigbhniumcysz' WindowName: 'bariuossffvbfgeddqvomi'
- ClassName: 'qhjawlejcrxvslztcrdotrpjkmitnaoenkdju' WindowName: 'gwpwbeiqidhrmcjqwfnkhekzyaqibkuewhfowm'
- ClassName: 'suzlnamztrfdsvkshkjwrsr' WindowName: 'rkipbauaosydoluaayjqqpryhlkzcfkskn'
- ClassName: 'xbihntkdzivaoxhcs' WindowName: 'qtjqjfysgqkbfuwhnujasrttu'
- ClassName: 'jxjrodrdqoalsbcwstx' WindowName: 'cdxaipfstqvjqvlzspdutsefkcatrqkayhcmhg'
- ClassName: 'chckcjdteghbkgccinmifparlkzpmianvwdzlwo' WindowName: 'kjywqvvtgasnophdy'
- ClassName: 'cpbjpqewkdnqsudzqkfxldolrjfneeecipihw' WindowName: 'qutqahwzgeveguwtimazfrdrztptjbnqwrq'
- ClassName: 'hizdyglntmwxoygx' WindowName: 'xbvvsasfbreuguweuaohxcvsnrepotbhasa'
- ClassName: 'txcyddlypewvedzwdbwevaaezamndjjvneanh' WindowName: 'pabrkzgewtlpvyvxrtwldoyfmggeejegbx'
- ClassName: 'tvsojktlunfyzvhnoaoasjxsooufjot' WindowName: 'papkzeozsfnxqxoadgeiaebhjonw'
- ClassName: 'fixwghlumqmcewyugaaabhzphtx' WindowName: 'gzlcoitqibepafecg'
- ClassName: 'acpcoklortsuululdoumnlcarwzgsjqhgnjs' WindowName: 'lzlxacxazgnrfusyzkcqvhyfhacqz'
- ClassName: 'wrjdpsndwqedilqfkhfqfn' WindowName: 'hygydxvqbyywynudvldflw'
- ClassName: 'qvtipwbbzgxlfgmiunjlqnohce' WindowName: 'tojxlodzrmnioqopcienx'
- ClassName: 'ruxfsmahzsgtkgnohzualtygdwcdqctlubnftl' WindowName: 'xkgdoyehlamypepdegss'
- ClassName: 'fafyqrquhuwigqhoeymnlzdhxalbqfbuhfqalbv' WindowName: 'cgtsprroclwinauixexrmctmjtlbgqlbtjaukc'
- ClassName: 'quihnzegruwvqcvxaow' WindowName: 'zxmbsobwqjwwvjrrwhsogftwzfiywypzv'
