Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'tjsgxeszadnfdfavpkzboiwpzlmim' WindowName: 'ruvvgwxrsuuxaiflclvbycvmdgkfcggo'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
- %TEMP%\nsd2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsd2.tmp\System.dll
- %TEMP%\nsd2.tmp\NSISdl.dll
- %TEMP%\nsd2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'qqbvpagkniebectowraxgutyaers' WindowName: 'orgxudirtchdmjtcyumnyoczenqjsmwfz'
- ClassName: 'orsikeudclikejryr' WindowName: 'cstijmfdhsmijizpctnqxgowonkfxzqlnjepm'
- ClassName: 'xrtctzufwqrbsvcdndcvpea' WindowName: 'mhssxlgwjrpyekovucebumknskxmhosy'
- ClassName: 'ytivzsixymehjpagwjrwe' WindowName: 'pypxpkngrscmdztwwnubdbndwcbqo'
- ClassName: 'ifbbolqybatczzxjmcltgcc' WindowName: 'mvrwcskqrqrytxsodfqoksbagngkrcwdcyubwv'
- ClassName: 'wgrmclupevwuslgjekkqciunsvlejuavoptfpga' WindowName: 'pquemhkvcqflfvnfvraregoqvhkv'
- ClassName: 'kdbtkbdmkscmxrutviewrzxctgjyz' WindowName: 'ahwsdkblaqwlqcxn'
- ClassName: 'lvmdlqljiodyfalbydyrmpwjrba' WindowName: 'iyghcamahdeditkcdhlxrlfmntchrnbkksx'
- ClassName: 'sanxvfnffxksdapvwwiqywa' WindowName: 'auqdxujvcwdnalubaredsisepteqsqinmpehxt'
- ClassName: 'phlxgtzkryqggrismxzpyaoajwtaund' WindowName: 'fxbnbekpiezvnoubjemzlhmuqclwcb'
- ClassName: 'xyptjowhmwtmtbezdmjyxe' WindowName: 'shynqsfmrfcokwdallgpcixdqjjklmd'
- ClassName: 'hbkdrbydgclysamyvsb' WindowName: 'zprygkcmrbprnkt'
- ClassName: 'tgvthhuphxulznyvmuayjbucmbbtidfy' WindowName: 'rdnytsdtkdcbzdignn'
- ClassName: 'wrpqlgfxsqtexiimzhxeoux' WindowName: 'hpxkxzlfnhjwnnbrqznfhljnvmpzja'
- ClassName: 'wzrtztbwhifcnjvq' WindowName: 'fmslassirdtyugknzgrggjdrcwjbejybqek'
- ClassName: 'dplyegguavlrubsatvts' WindowName: 'tgmhmvsfxgrebyt'
- ClassName: 'jzbhbmpghdwtnrbbjpuxdgheviuvmnpplkszn' WindowName: 'bcovssgfdtzbxpcgpfdh'
- ClassName: 'zlbkwofnlgmvxlqfc' WindowName: 'torxaurxljwigndytai'
- ClassName: 'awvcwllxuimngxcbrqpwbdpvzpdamyd' WindowName: 'yskrynkicyzvgaoy'
- ClassName: 'eemoshpgvcxckbvclgmjydhlscbzpgpuplbyump' WindowName: 'rchpoxbkluctwdmjczmj'
- ClassName: 'pnesvkpqwgksrqafaxrqtyzfvivmctxixzncgl' WindowName: 'jlosggtaaltmkthubxzbysffetobwgsefseils'
- ClassName: 'lzvwnsfovuxtrjtfwqhlcpkanbigrqfoecrl' WindowName: 'rdpsivepmmgqhacjmycyqjnyfz'
- ClassName: 'eqzfkzppalpdcshvrzkdqtkoyjnzbrkx' WindowName: 'jxmnwfsmkfachffpaqanbdrajabxohowf'
- ClassName: 'kntiwielwcdsqbdoxsv' WindowName: 'ecfkivejovdicoykhce'
- ClassName: 'qchkndvjofgmmyofzsk' WindowName: 'ittepdsvccazwutxbrqbobvulervrzgroc'
- ClassName: 'ziulbzoeyoqgallbwvmxzliiesfrrudirvjeqh' WindowName: 'tmtvouigynenkqfhvbijamogh'
- ClassName: 'bicsiisfmvoxdluwggnbdfjeob' WindowName: 'obbzzgacdwthbhsdhqzbhpylfu'
- ClassName: 'nzbuofbuychbaqghe' WindowName: 'vexvqexmhwwszfixcroronwtyzi'
- ClassName: 'gdrcymadksbaaeutebokxubnrnaupyzgmucwaor' WindowName: 'xfqpwmwvdcktjdxabd'
- ClassName: 'fknqbvogvldjukktpzjzyng' WindowName: 'ldjbygpfaokfevrzrrcc'
- ClassName: 'rjtrfhyvuursxnmbkbdcybaemsinm' WindowName: 'dlsbeltitmuwzrysy'
- ClassName: 'rrwvojckqmulwkyeglkwnmrinrhhkkpa' WindowName: 'rvmdwswmwispustukhrgdtmkqanztzt'
- ClassName: 'afgdjcawmkosxupxsfxyzjbnofipcuv' WindowName: 'nvtwneqackgmlcrrcqkxyeqeswxurur'
- ClassName: 'qxguwwklwwixblrjqlxxxne' WindowName: 'zgxyzoakdjyxnpjlvqdxsijxyvmquzeeiakxron'
- ClassName: 'fdvntjcgazewpqaojzamzgewkubjhkovm' WindowName: 'iveckjokdlqpsrzqcwqj'
- ClassName: 'zbjcpribuwpdgbryx' WindowName: 'counwfeplcutoed'
- ClassName: 'wwkfjbmxnqrawsoiypaqghmzbbkdvw' WindowName: 'cstzrnsvrzsrofvenlpypawxrtfnazlhwv'
- ClassName: 'zrhijhnnwaosrlfc' WindowName: 'ltcntlfrclznxuwgt'
- ClassName: 'uwiyqrzguwfuhrsounsjruucb' WindowName: 'ciuicmiwubamurrfuazypiqmkbvmc'
