Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\InetLoad.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\InetLoad.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dqcizuyiruspzscpzldadrtceykaus' WindowName: 'wziieylphkumybko'
- ClassName: 'jsqtrvrfwrfylvsgim' WindowName: 'caasrnzuxqripqlat'
- ClassName: 'enbnnapptqacemr' WindowName: 'nuflorhpcdpdxgtpimuzxlvhavmbupvvfbqzrsa'
- ClassName: 'zytqlwcdbtyctxvhkuofsujmrtxcfui' WindowName: 'ptnhcvxllvmbwshkrptux'
- ClassName: 'vshndppdqkonuxylhsc' WindowName: 'wjlakxzaambjndernmxidujcqjpzxmtrstdqk'
- ClassName: 'dwwndewjvucuroukgonedkqplqkuxirpsmi' WindowName: 'vxyglosqqlivsbzdqcqdxalnbpzyxei'
- ClassName: 'bbufaymxyoxxhqwifopq' WindowName: 'iwjnwuthneampztmovmzbyizxzmcz'
- ClassName: 'yetvejewbqxrlvtcbspg' WindowName: 'ecxwonqlnkshrbkcjhxhhyzshitaiihbyqioje'
- ClassName: 'ryhdhdjosjuoeroiuhhkbggjidqota' WindowName: 'pqgelixclakehzyyleektfrpsmwppaudf'
- ClassName: 'yohzskdvvttltxeyydzwbrexrkycuubkgpfp' WindowName: 'mlqaqnbdrwgdtqildqzlg'
- ClassName: 'dmqprciyzbfctmhvnuqjygviyblgxdgwepkzq' WindowName: 'ujpcaubcrylrospwgmncvuwfhxraklgffkuu'
- ClassName: 'hanqdsbwfjdtahzxjlmkwdvivyamm' WindowName: 'kdjixauzbwlmbiiyjvwfnmwbbvwixbenx'
- ClassName: 'lrfkirqahxghedcfodlcmaaf' WindowName: 'bynmkiipvbjuhxmwumttrbinovph'
- ClassName: 'wjhludgqrpbpemtxbwfchib' WindowName: 'ibswgdtcoagumvftgzifrnlqfss'
- ClassName: 'wegeewgfgpuijwarppti' WindowName: 'hxuqifgtrnzzetoipm'
- ClassName: 'cfwyxshywftwhogztuikzgk' WindowName: 'rgzdkamyeesawcgnbwkraycudghx'
- ClassName: 'kowswltnxosgorbxjfjhatrm' WindowName: 'eydpnazkipaonpnlfphh'
- ClassName: 'yfzxjjifkacqtehpikvkmpqutwxmtqorpxw' WindowName: 'ucmdqdzzrwnwlgloanhyjtmlrcngonvrrm'
- ClassName: 'hejytnobqiyboyfawddcks' WindowName: 'dwpnprgjuwdyaxxgbjwywfhxxmxudcawhcndxe'
- ClassName: 'wqyicbgwfzernyivyje' WindowName: 'wvolbtpugosagqjcb'
- ClassName: 'osojssjnsljatwdizkeibrhuxyodhihcikhuq' WindowName: 'jdnwiszzplwlxjrxmezneqhwdcxvvaxsvxsanjn'
- ClassName: 'lubgbbjalpqkquleezquitjwhqiopikhbd' WindowName: 'tjeeztxeqcnwsaqcdccuvnxbzrwupj'
- ClassName: 'atbirfkyvcmilfyjcldkvxowgsfvukyqgslxjd' WindowName: 'hgfwmqtbvippulgpudntvbinbxddtdlnrfo'
- ClassName: 'wysxyoojvnjtfqnw' WindowName: 'hgrtmjwoyexwriigggrguucihhhhua'
- ClassName: 'rtrektakwzwprbvnhmccow' WindowName: 'qthyfhetzxaliyeawtwugmf'
- ClassName: 'jlgiceqqzvpmbgsrqyuxgqyovvmf' WindowName: 'rdhuptinmtnsxgm'
- ClassName: 'bfyuzcsvyfndkhsjuduenifgcuts' WindowName: 'knpfwubvhjkeqpetwoxuwehrgpke'
- ClassName: 'ooewtrwpqtzanpdwgxfb' WindowName: 'tjxhlvsjzzdcaqhbxoudoqnaxobebcucdizciw'
- ClassName: 'ceriefpwzkqyxcywxtsqsxnsgwdx' WindowName: 'ufkzpmvmncxqyjzyenbpmfdqzpv'
- ClassName: 'hczxipkdfswfhhxgttsszgssxc' WindowName: 'jslatfnppkxlmudkmwwnquqgh'
- ClassName: 'rvrrtknfwkbzfzlyrgncaabtfuxnxvtlmyt' WindowName: 'ehdorehwogkodnkd'
- ClassName: 'lisjbjnjrordumfgb' WindowName: 'zshwvesioyidqhtzh'
- ClassName: 'ywigehszvaietwpgx' WindowName: 'zatnlfnhyofbakrdtsijpin'
- ClassName: 'nojsfofgbwyftnfploskzzdginwkspeg' WindowName: 'uhsehqechflcuqoogavwbyjjndzsg'
- ClassName: 'ccioqfxhjcrchnczojstpvsqwmmhn' WindowName: 'dbtosvomeeerfkxytakmswtgjjtvalyxi'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'dyubpetxoyrrjwzvyltkasbgfnlsflf' WindowName: 'atdhyeflragohaifgzsqwc'
- ClassName: 'qwtjncydpjhatcgxwjk' WindowName: 'yehvgnumuigizaoycjctevc'
- ClassName: 'hnzgkpymemirxxwcpelzvipoxumjwk' WindowName: 'yzudybaccbdskkbttpjtvtebonctjzmybacjl'
- ClassName: 'alcqthskmqznqishivmrkajqseu' WindowName: 'axbtazseiernajsvtbdqvrfdzzueiqwlshyeeq'
- ClassName: 'yhyuiydyuygapvffvxzukdrevzyyq' WindowName: 'jbbmjrjuusyhdljnv'
- ClassName: 'rpyzybjrktiuvneutnumvtl' WindowName: 'xahipiaaooanbdskfnkxaxw'
- ClassName: 'nfgdnlwojozupvoz' WindowName: 'vxaadnbainfcadcyrikplggjgkniwagvqviv'
- ClassName: 'cvwfyjeprljyjkrhduhubynsdu' WindowName: 'cuathyopbxytrbiuztpbzqjwbjcakmlrigvmznh'
