Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsf2.tmp\NSISdl.dll
- %TEMP%\nsf2.tmp\Math.dll
- %TEMP%\nsf2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsf2.tmp\System.dll
- %TEMP%\nsf2.tmp\NSISdl.dll
- %TEMP%\nsf2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'rrocjttuhfdraajepnljtzts' WindowName: 'smhnucbfumsqnwdvttnkibuq'
- ClassName: 'juznykqbkapnamjgilqyuxgua' WindowName: 'ssnjjalfkugqlzhxmhdvl'
- ClassName: 'ynjiagwpdtcalrlhqupagdgzzewnisgowtt' WindowName: 'utevzmqrizqtxdeovpdvmhpdmdxf'
- ClassName: 'busrzblkjwbxylyjvzqyerejvnkj' WindowName: 'bvxuvfdndhikhikojpksrwwlvrycfqcrphlphk'
- ClassName: 'fpbcphubciapgcbbxwjngmkfpqjqafhmjnb' WindowName: 'tsplystmlyvwpedngiexdsihoyqtgiqx'
- ClassName: 'xvatilejxhipvcdsrckdefzooxzdfdeaefblqsg' WindowName: 'nfaiadxtwpbutzxhvvntirmhjogydzkq'
- ClassName: 'qtsjvilirngmrzalfsle' WindowName: 'yrvkvzoeskratzl'
- ClassName: 'bnpuztbusfwtannmqkguftnqmzzmb' WindowName: 'jbnozlmcvycipntjbuikfjgmzlul'
- ClassName: 'sbyyydxrnmaspqvegsmxtgxvxqlissdqyfrly' WindowName: 'bhkochrcmqgkzdtqgyuaytxfiqs'
- ClassName: 'bmtnsocnpgnuuhjesvdrxiz' WindowName: 'gdqnesetqngdeprrlcqwlfucpwsvdzk'
- ClassName: 'obhvgzxlquiygggbeoescwv' WindowName: 'ztiubjgtxepzdgacscucujdfyzk'
- ClassName: 'yenigeoufvmvngtvgyhcipnywtmqgjypxrne' WindowName: 'xheeciwuycvkwzeivv'
- ClassName: 'uczihbyysqfpduckt' WindowName: 'rxtgdiuyajaocavpmrunjzay'
- ClassName: 'syhsadqiygvrzwigfoypqemfzekjquvjmbfgbek' WindowName: 'uunfocamaaledoprrcdwgstxtloy'
- ClassName: 'cwepjlxxndzakvcwht' WindowName: 'aizrnwcbqvztzgtuejdsyynivpaymtw'
- ClassName: 'qdujyhvdxagzpnoijp' WindowName: 'xoghpazvtaqrltq'
- ClassName: 'ubotalflywrftsivhss' WindowName: 'agujnfyshmuiatkfokvrsmytszurp'
- ClassName: 'npaacpxaaugslatfebppuisxxnyvtohe' WindowName: 'ggndrnsncxskujftaufuvpudjnqmvyoxzydftoz'
- ClassName: 'hpdjzegorcefhqkm' WindowName: 'zcsrgqrgowcdwqekpxyadpxxgimkpaqylt'
- ClassName: 'kacolcbzluqlgsdpk' WindowName: 'yobykxuiujuvjhxdmuoejohkzfb'
- ClassName: 'lepaygzfsxcqojuruzbgngvtyortasphfqxg' WindowName: 'bkgbhdrphbftgffzfoukpoma'
- ClassName: 'zxyjiwerzxnsceeoeqetlpbs' WindowName: 'xfgahwuztawgmkddbzefmumbxk'
- ClassName: 'rdtdfsttoudnvhcfjdwsfyq' WindowName: 'fzrtxpxqrxxwmljdv'
- ClassName: 'giimbbfvqsrkjfbypxilxmbxigrxktwhwxhp' WindowName: 'zfruyedgtxdcqlcrneyelrvfy'
- ClassName: 'hhunzcdvcaggiswraeceawpzoipgevftltuhpx' WindowName: 'nmawbixkwkdvymewvgqjncqoccltcbkzc'
- ClassName: 'vmacqbobbwqiefvivdmsshddctbdzbfym' WindowName: 'lsmxlxvpcgalzsuqkqqvvmhzkhzgsunexl'
- ClassName: 'uxanhcziencfsgks' WindowName: 'bzqlcdznasklgsbcbbevwcacnlb'
- ClassName: 'xemswuakupvsgxgbinvvuwhkxt' WindowName: 'llwbjrsuyszoxrdkbpapbsruuznufjuvzdvukd'
- ClassName: 'beqllnaoazppwgr' WindowName: 'kgaspehjqykdugqppaqrfwr'
- ClassName: 'orheyimzmpwjavmfediwspsbcpbxjfisij' WindowName: 'olixxjaitklguucbcqnxpnvifefxiivn'
- ClassName: 'nwhexmcsmsevkpbceentfwiyuzt' WindowName: 'luyuzyevhlsnluvfdoptbmaecqy'
- ClassName: 'xvzwdenqtbzxtcqlxddkrmdxoqfdilwpxllkp' WindowName: 'eeowobgkxkfyvstwwprrkvot'
- ClassName: 'axspfkoltxadlgyikgapaxvqpfkkrtbouegpzc' WindowName: 'tvylbdugmatexghhhfmyuqnczu'
- ClassName: 'xuhavelzkabwmkgxihqbggxpbpz' WindowName: 'olfbcoxznxxvpbgzmwewnraxusld'
- ClassName: 'llpqsnaflgvuewdkualjxfdviias' WindowName: 'dikmrtyorfcerwteeewsqhgpkqeamheojsnu'
- ClassName: 'xksqotmnsvcwpkllxrfvgcpim' WindowName: 'sulagtjqctkonvpasvuajzm'
- ClassName: 'ajdyzbimvwsetuacjxfxsoj' WindowName: 'iydzgbvdpmiiekx'
- ClassName: 'fzvssvuosxrzykqfrorbvvha' WindowName: 'hzllcapehayqzjxi'
- ClassName: 'iqivmhdazwzyvvumtzxsyoiolmghataff' WindowName: 'cmvgwzkpqfdmbjejdlvrmbproxbxukfnk'
- ClassName: 'ptbtgiwhyjnyytdxhexwrvjvygxyteqnwf' WindowName: 'tivwfuqobdcibqivlqkkzfdaokwoqkizayh'
- ClassName: 'iwrynuzmmlsmaryootbvlakn' WindowName: 'hlcdhwmfvptonaxynhu'
- ClassName: 'erjbyqztebhgmdungebejxftpnpngoylznce' WindowName: 'xavabzlxkdtswlbuxgjtpjzavcajvcxvhzqo'
- ClassName: 'odtpnyljymswjshtvxcalvs' WindowName: 'ealbzipyplpkdeknoxfwyjkbpu'
