Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
- %TEMP%\nsl2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'scnlbqbjzbrvjgrxvqmmyzto' WindowName: 'yrlbolpxcyklukpwpcswhcro'
- ClassName: 'qswvcttjalbqbovrhqardg' WindowName: 'tmzehfgbvkwykynpq'
- ClassName: 'zelnfhhbuvmtrcaplyyhnp' WindowName: 'lsdfpvhlndvqxlnqi'
- ClassName: 'ovcvzsndiovshgckuzcfjwsbgtpbrs' WindowName: 'kowrdkcnmhfiahmbcdjqosjkd'
- ClassName: 'gxknjyqwwpevvvknr' WindowName: 'yyduwfyfskxbdtczseppagnhrqbspcwvb'
- ClassName: 'elktxmsnvmlutaxkrjvtzqe' WindowName: 'egpngrhtiruxozmck'
- ClassName: 'uyflmgicuwtebttxjucthvpdcrctszyh' WindowName: 'xpeonrbtzpxuqct'
- ClassName: 'dkpesompgntdlpfcsd' WindowName: 'plnjphooupbgubscmdofeckpvv'
- ClassName: 'gnmloqjkiiiprszn' WindowName: 'qaxkbbbjgitrwwxyzynsthwuxuaognchqrt'
- ClassName: 'vdyaduqlltlzltlysdtogeyvubmobrf' WindowName: 'zapbrgzjigvvuncxjqdcwup'
- ClassName: 'daldsmbrhbynuqe' WindowName: 'gwerdexlesxvuucdoqjokmhbeo'
- ClassName: 'krvkygeqbjvamkamj' WindowName: 'hfezgnwfyzcyumgepwqnqpsvokbhbkrqog'
- ClassName: 'lebkjkqfstyyyzuhcy' WindowName: 'jlwgelqnftraycivqslgkxzaufnzhboj'
- ClassName: 'pfrmadlfiprxciwekz' WindowName: 'zekwohctfyuhyngycyuflaezzypsax'
- ClassName: 'ielfnfvxkajurukwdcenmbulxqfplcux' WindowName: 'vdwgxoihewmghgfhonrmmivj'
- ClassName: 'mtufkzohqqwjjgdj' WindowName: 'cxczdacardbnyejegbzz'
- ClassName: 'eopjvgueimoanpuojqcjmrbpwgesaqrgqzpf' WindowName: 'yjgoealjqgwnywiqhfwi'
- ClassName: 'njkpfeslmznfceymlhsttnldcvvarxo' WindowName: 'tjscdwhmompihwstgp'
- ClassName: 'safnjiycfngbnswx' WindowName: 'jdhrdykvxqaurtitplzrhiwsojrkdfkkytr'
- ClassName: 'gdurtuhsobknpfjvnirubmtcjwchdwtntdpw' WindowName: 'ffnaskpejmnjppaqjviahabpkmzvxrnrz'
- ClassName: 'beuokupqmftkzkhelgahholomsksczuug' WindowName: 'xgaupihxmeinxeqmt'
- ClassName: 'luhhhydjfrwmraredcsgkfhxckhudawscfgn' WindowName: 'aqxazdapgcsvdaulikokciybn'
- ClassName: 'lgrteqwuyyiljnzgsfqfexhdkeogqyxcmh' WindowName: 'uxfmysbgqdllubguos'
- ClassName: 'wnkisxliiylephxfeewpdfjcakqr' WindowName: 'nxinhsetkmnmddprwvhtvppfuuvor'
- ClassName: 'vmvjemcfsifdrhzkeytqwivgbqpxahhmmerme' WindowName: 'srfuncaomtfnablus'
- ClassName: 'fjggskwvndsnrjthekjcjrglbvcuwsyhw' WindowName: 'tnboxlrzlqejmjbdtqrrksbftj'
- ClassName: 'aschbomtqjqgudzjr' WindowName: 'xhhsoabhyypvuqkpxjcckafpzfdltpj'
- ClassName: 'vmsrirrienjqruvoowsgcmilwgudredb' WindowName: 'dinfjoorvywvfekmjtahb'
- ClassName: 'ckeuxteswcqbfyemgbcafignyknfpkyomcl' WindowName: 'myxaqqcearsahudunbvgzesnmlomzkgfqnd'
- ClassName: 'tmvpdwgpahisyyfcxodroczzozhcqcwrx' WindowName: 'qjdnbbhalwbryswzxerddjxygnrjoqssb'
- ClassName: 'amokczlusbuevvkhmqiadvwsnrjix' WindowName: 'ssbjfeychpvisizdyhmnswtdcativhyoj'
- ClassName: 'dmaadjdjxauyiovbodjstlhvylazooqu' WindowName: 'gctrroxxujiqdxbghrdbhpkba'
- ClassName: 'gtvgikgmwcowtfqaqlcaifhecytjvqresr' WindowName: 'uloqmzrssfhlmcjg'
- ClassName: 'ksfxrgyjpuupwcuhemlfczgdf' WindowName: 'hkbtdpcmlqflhnssp'
- ClassName: 'yuqydfhnhoczlzukozrnexdydwvlkvtx' WindowName: 'hqgxdiibhlwxlxuixtoukczskrlaaix'
- ClassName: 'oejjdefjtqudlkohpejle' WindowName: 'ajzwvrmibnwejpxurfjwpnemvwm'
- ClassName: 'jyrfuztbzsalqlveksjpgmcgiwngy' WindowName: 'ijdmxstwnxvdwdcpej'
- ClassName: 'jpjqneufipwwgiwcgwspkuovvrasag' WindowName: 'uicadohtirfokniqpgwkdyljvlezsqi'
