Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\NSISdl.dll
- %TEMP%\nsp2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'yffwjdpymnnbswgpqihirrfspjiejikuv' WindowName: 'vbpholeuxotdazmsnpxihgdqpphmjonfre'
- ClassName: 'vthnyxubwvpxnigsy' WindowName: 'kgvmhjdvqechetm'
- ClassName: 'gxurrtfdbyzlgfipvxxbu' WindowName: 'xhcetksafwpjzikmnxjrqdkfdnyu'
- ClassName: 'xduhwxvikeizzhuembbhdglxjmmauzq' WindowName: 'dgekvznlekraokziggsmfxvk'
- ClassName: 'xlvcyhugqsjjdovjlpjjzxgtqgevxqq' WindowName: 'lrradxsupxjokzebmvs'
- ClassName: 'vgbjubtbbquadxujfslrgxuwnrjwnifxvfbg' WindowName: 'gaymrfpqikemdyebtykwlmbrdi'
- ClassName: 'jvcporasbsknqobvasudptttjqdpvzvsqrt' WindowName: 'kfkwzehuljrsicsidi'
- ClassName: 'mghcsoygsssmdfqytjbjdyjmndtzs' WindowName: 'rzizzphdbtjvouqdffom'
- ClassName: 'aszklfwohutngdfrgolfqgbartz' WindowName: 'qmktbtnuksavelbihmu'
- ClassName: 'eqjmwumjxypltaipewqppuphwk' WindowName: 'yxgaudonamcolmvgcdulivntyzdoddkrerueuge'
- ClassName: 'gfcdvezdobzchfc' WindowName: 'fzucfbezltvairvsslrtn'
- ClassName: 'wigwutoamfohnnmcnk' WindowName: 'slquxnxldvzyvhmrwkovfrsaxqdeqshfpdw'
- ClassName: 'znrruhjsexhtzcturpqahkwnqqxzgy' WindowName: 'nwdmufjbdwsneeatnvgl'
- ClassName: 'bffxwokoirztfuovcnguumgrxouwjfxqqwxsd' WindowName: 'gvqzmeibtlycmvhfmg'
- ClassName: 'pszphezfaaunrli' WindowName: 'xvmncalqdxalvlipgzxtyrvgzwaaljvntot'
- ClassName: 'rbuwmezmjxskbqsyvyfag' WindowName: 'itkgswgzuoahpdocuevlrqpsjqnjaxdq'
- ClassName: 'bhyoxrnvsxbczjjyqoxducwpyuvy' WindowName: 'bbrtqnlxqwhufchyfikactouhammots'
- ClassName: 'rzngttufujjqqremwjhgmdah' WindowName: 'xpjjosknmtzpttnmpgarxzxr'
- ClassName: 'lguwcsaoicrsbycyyvtwymuavyrykjtpecpwgx' WindowName: 'mfjqzipurxksdrdofklclqwzcdygzefvpzgugcw'
- ClassName: 'ogagwmvmszkhbobenpdgnlolxkunrolol' WindowName: 'scsowaziuvhwbczedd'
- ClassName: 'injehrtsbketyzvhwgmkqjussmgdysy' WindowName: 'sryokluxtszjvmrishmmyj'
- ClassName: 'rhozluoyufqrjgblvywufeqytdhkrtjznftzt' WindowName: 'kjsrojemizysgjuesbamcwpove'
- ClassName: 'fofpulhksxncfvvwnqxvetfajwldipqs' WindowName: 'bakfnkctjszotftosdiwvqlpkii'
- ClassName: 'dsiwtbhywemvvzstgyoxfkqqzkisksswokfqeg' WindowName: 'sjyqtujfmlzgprbczwujwy'
- ClassName: 'phpwypnmfrvbnij' WindowName: 'lkqemvvxohoapzpuwpykiyrw'
- ClassName: 'adudwiwfeyrzvaoyqeqibuxutmx' WindowName: 'ongacwpeyregldasox'
- ClassName: 'gprlldoxlsorpjdwdautonwespgtvxfruwz' WindowName: 'lbxsxtfdocpsdlfwlxzrjxdfkrfujlioudj'
- ClassName: 'lzlrjwusegenawniamftbfzyebswubcbyazt' WindowName: 'czzbpdairwdyrekj'
- ClassName: 'hsvetggrupzcfrqy' WindowName: 'qszbhnjcbzuzathdqqgw'
- ClassName: 'xyypymvkuyqovamqdybwceybgon' WindowName: 'mzlvpebksacyojgbfamr'
- ClassName: 'badbaoiozosyukrggvhiqshtuiawstoxyaalm' WindowName: 'fbriblfblmbmpcxwtdbpbslyuc'
- ClassName: 'odpczdwzopluwxdkhqxulhknbbmijbygzmgvd' WindowName: 'rlrwcjxlnfscilxpgujfykceypapetvedoguby'
- ClassName: 'orzoupftwrwrkvxhiwqv' WindowName: 'jzskwmottdoyojb'
- ClassName: 'kctpbunqbdtduadddigmkatbn' WindowName: 'xfyuomlwyreditmkalwjprchhqle'
- ClassName: 'nhmyjplgdxnarbnmlcivgq' WindowName: 'zrevxdrtfoniahjprdnij'
- ClassName: 'jmdztxlkjffphnwdguvijwnijqlqdtesqivm' WindowName: 'hyqizikkzcnmlyvdultdnxyoqx'
- ClassName: 'yywjhdzpucebxqdftarjldwnnhgt' WindowName: 'grksiqflcauepgkhzfzikfviusxfet'
- ClassName: 'baoamystixusybfyvcuoflcpxvgvnhlbubp' WindowName: 'xxzngwiobsdyvbgmhggxxtxv'
