Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsb2.tmp\InetLoad.dll
- %TEMP%\nsb2.tmp\NSISdl.dll
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsb2.tmp\NSISdl.dll
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\InetLoad.dll
- %TEMP%\nsb2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mpryxfvldateyelopogafrrkffghtdbeeoopf' WindowName: 'rysybqvxtgqvamhrdyezttpm'
- ClassName: 'lkvvmdzyusxysvbztjrxoijacamcyihyiuiov' WindowName: 'noyxgpidqyydkkn'
- ClassName: 'eqhcevigtsqaxglezjwxipjkax' WindowName: 'qvbeetktjkweeyrrijlaqqlxtrf'
- ClassName: 'ommveysdxorlhnxjyjbgcaycladmafh' WindowName: 'fzawcvmmuwimrlquqxuejrqnemgfvu'
- ClassName: 'hkpndqrejlzsshvutturfdnuknhgu' WindowName: 'ajmiyllpsuzlluwnwhxvkkftybhpwthawnafv'
- ClassName: 'tttlbjlwznqfmpyazqxxuie' WindowName: 'lbubrethnxyygqfccvugqldjrseswvppg'
- ClassName: 'graeenryociclblwaxecmnzbmwxaxdxkscjeg' WindowName: 'fxacqvsptpgmmlkyupm'
- ClassName: 'wiudvewoxxvksyqtjklia' WindowName: 'wjgxqeecyouvxqwueavfdoxuprxiqxhkicy'
- ClassName: 'fqhmbixggvgmnfrrvyrsth' WindowName: 'gcqkkmnrzvhbuiuuhvnmtnpgvnowvcjfwz'
- ClassName: 'iuhxgizhcvcjzrtbhlkjlypohbothiva' WindowName: 'lszzinxsdlyngrixr'
- ClassName: 'wddjrltlkvbftdkbvuyy' WindowName: 'owjqmseddhthzyggwflutvv'
- ClassName: 'ldolqvkafedjoegdsniohtciq' WindowName: 'znuwmfejuojvkxuztcpffjrcjleikgpzd'
- ClassName: 'yngficoaslnagvxoauzhfpzaxvvcplgkvdomzn' WindowName: 'nsnsvdvszscrrwvfcinlrdplthboezdss'
- ClassName: 'fqpvspzvuvopwchuchdhloqaoukua' WindowName: 'ijaltqvlyspcywcfvvxprgrgpiqajlwpcng'
- ClassName: 'uttuaiysqrnkzpvssavhjvypxo' WindowName: 'fxintmxjzmxputwdayajprvy'
- ClassName: 'eryyfwhbfbloumpf' WindowName: 'scnnajiyzekqrqplzznnhjxqehd'
- ClassName: 'erntfqoospilrxuxjanjojnmddgep' WindowName: 'iyejsittdtjcazeq'
- ClassName: 'ncktokeqzzjjdiwrfyrilnrboovbrl' WindowName: 'cvubiutivkirrqbnrgkvxmcqvjvbyogmqw'
- ClassName: 'cakqalyukxmbjgqzl' WindowName: 'maapwazlgvzxpncxzkoqhbcucuprbfzza'
- ClassName: 'rhhbwactdinnwiwhhp' WindowName: 'shkntcxxnlmzzqofntcsu'
- ClassName: 'tcgonilczqtdxxwawcxaamvwk' WindowName: 'suipjignwdypipaxltg'
- ClassName: 'qahcksioftsqevjgglnpyvzmonzh' WindowName: 'paohlmxmvxozyuchcqccksncchmnztff'
- ClassName: 'wxooqyaeyvtfquegylsmfjizxxtwvosscqovqp' WindowName: 'mryhekbwtnzjpoynrolcfp'
- ClassName: 'vhzaacreuugvdylpkwwfohuwhvbmw' WindowName: 'vlxsvtcnsqhsqnvp'
- ClassName: 'qdyvvwmhvhnjlqftclvcvmniwqjlfngbircbk' WindowName: 'rzcjqffrlirnlgjnpzjseozyof'
- ClassName: 'aaningvqthwqcjnmoudspellwmgolpbq' WindowName: 'iirvozmbtlkdhdzbwog'
- ClassName: 'rjrhyycsbqynutdvqufnlgbnclaqpv' WindowName: 'gpdyhzjragskkisspdxoqeq'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'wskstacocoiphubbhaehjzo' WindowName: 'nppaedptwjolqgiaegsmpqwlpvltxebthp'
- ClassName: 'tsthdvakvmqpsrnxjfiuceyzndadyiiyw' WindowName: 'tptgsqrqhrbdclhtafvpvtnoydui'
- ClassName: 'dgtgvtjmhrioyuuuaa' WindowName: 'xfhkfowsbacxpsemcyqbnzascjqfhgryrjtn'
- ClassName: 'gsuwleyfalmfkdmqhtznsec' WindowName: 'inuwlqkcniqgxqnvo'
- ClassName: 'nbhwnfikbvzfedmqyqhbdxtos' WindowName: 'hhglzegycxsooaydv'
- ClassName: 'thqqooelthclnmvowkyqtzvrajgsfvwrni' WindowName: 'foqqeuzmgrjredpdfiykypvvzobadshcbktvm'
- ClassName: 'sykqrmxfdwjbsiodjpzywrchwvkjclozmx' WindowName: 'gmawvwryhmcosepdfmqrc'
