Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsj2.tmp\NSISdl.dll
- %TEMP%\nsj2.tmp\Math.dll
- %TEMP%\nsj2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsj2.tmp\System.dll
- %TEMP%\nsj2.tmp\NSISdl.dll
- %TEMP%\nsj2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xbflnenzvyikicbouofzuyluar' WindowName: 'gvfwgopznehshuxkamfwirci'
- ClassName: 'yhemixwndlfupmyxwzkugqnfwyxnunfevciwudg' WindowName: 'euphpsjmqkpsgjionjsmvnkpztclwjngwfv'
- ClassName: 'dxdssqzuqujfiulhrbtuei' WindowName: 'qmttghhcqufupoqjeuurj'
- ClassName: 'epclbsqsvoyjaeq' WindowName: 'lypdtuetacgcuhjokdqki'
- ClassName: 'bbhiedfmfmqcotxyygbpqyxognkiyfdf' WindowName: 'rgmrxxiwrreejglszlohzwsu'
- ClassName: 'mmwtoguygqyvfdwne' WindowName: 'ugluweyuzvgdxmgzkj'
- ClassName: 'lhitpowrxaplcrqlf' WindowName: 'msozczgkduxpiazovacypekyeisrazgypftey'
- ClassName: 'meovgbjnaokvtswzjpjro' WindowName: 'ilmublecsyxsfzzuawzbvtysswjnqdbvvav'
- ClassName: 'nknijzmrpjpvdcsuhjrhoqtckaqtxey' WindowName: 'xrlothsmqqipxbren'
- ClassName: 'zemuveozazmtcvybqpjqzf' WindowName: 'ttknqpwnitcqzeebgenyhfjoovgeecbzvfiur'
- ClassName: 'llsyqkbcttndiwfjfjoiso' WindowName: 'nuafgxiddtgsjbtzd'
- ClassName: 'vhlqkmtbmnvyqptwfbndb' WindowName: 'wtiayvjuwuanywcgacv'
- ClassName: 'koehlssrqpwfwzbegxjkkkkixyjxzmdgwyl' WindowName: 'iyacueevvoydqvtgiteqauoph'
- ClassName: 'mavlbxwwjuclhhvkxuraygbftpkmfebgswxq' WindowName: 'qdiyuezjalxwicajzvwhonmngjoyhqb'
- ClassName: 'oquiabanucqewswkbycdkrlhb' WindowName: 'qrdrmemzsscnickpdkvgymtlwltygit'
- ClassName: 'pdbxzxhqacmumtx' WindowName: 'rdroweplfjmoxdqlejwlnp'
- ClassName: 'myoewwokielleixqeeraozmrrsnxen' WindowName: 'gxtjvethwoopskntxmettpodqafhgdhfa'
- ClassName: 'ynjafcuijaztfizdfzxzpwbf' WindowName: 'imokylesjejnmielcirydyqzbxt'
- ClassName: 'jkxanrthrjhdwlstgbvolreeun' WindowName: 'wlczlwlwznyxshevafmxh'
- ClassName: 'wtpacmjaeofhdnzxmebgqlqzquslngpip' WindowName: 'gftbjoqxwlvcimcvozsrlvllr'
- ClassName: 'zyhbokaislfgplnbntlthqr' WindowName: 'qpqxlplwmwayrvcxjczpxadznwhpjvimkmil'
- ClassName: 'qnpygmijgoshqpnlgnwvlzvusoqoswuwfs' WindowName: 'ztaslebphpflraxdbtbbfqu'
- ClassName: 'wakydmwuarihqqufckhqnuqywzvmyxutnyy' WindowName: 'nhhtyftwdoamzeteztzccq'
- ClassName: 'xeuxypqqendcdjhhhvgzsfkpfwfzhaufcztupc' WindowName: 'zturwctxpfmwqztthronytykgwerirtnmob'
- ClassName: 'wqdeevnpajkjfmckpghjx' WindowName: 'tpxylxtnupuyxnbpyqhiktnl'
- ClassName: 'naaymbuamxxfpadlulchkvxzliount' WindowName: 'tbzzpzkkgnxyzxvrgbvw'
- ClassName: 'ciwnynvciguzovqhmniykgvcqaxvvr' WindowName: 'jcjziaftbizwkclhdbzntxzprshxgocyceqk'
- ClassName: 'jgrgtgtpnjeupukeq' WindowName: 'axnykorebktpjxdhjjiymvxkpjerwtcqaxiryj'
- ClassName: 'cnsihpjdaobdctobthlwqoceezhlaxtwrmft' WindowName: 'jrrmttucsdmvvsffowy'
- ClassName: 'wmliyahqqyyzbbefevggasizmiyx' WindowName: 'ruphxthqqixiwdixvic'
- ClassName: 'nixixzfvpkmghzehatismpbpblvrzwiil' WindowName: 'yqrcqwyhebjjdeunr'
- ClassName: 'deieciqvdwqyhvehzeewiax' WindowName: 'jgpvusnmbphecsw'
- ClassName: 'iqvvsuespyhfwjmshk' WindowName: 'sbbsxvdvtunyoztzcewmclmhhhefwovafv'
- ClassName: 'ptduxyaradyitlpideczkhq' WindowName: 'pfbvdwqvzyhdcqlkziuqgscizssgvddxoibekf'
- ClassName: 'khwdhghtyypzjvmgprcvgqeobyjxfy' WindowName: 'ydltrgkdbcnrnpfp'
- ClassName: 'luomrbuclorccexqemqfqptdfdztjgwf' WindowName: 'wzctpaihlrhfhsy'
- ClassName: 'xaavtffglijlrtcvszplraag' WindowName: 'hzauibcjxirrwgbtpudhzkurdxubvtefkn'
- ClassName: 'hbpgkcyzqcrjvvezhhcvxubbrdlnfug' WindowName: 'fnttekndnorwyzxvvwjhlgeswtddvnuaxi'
- ClassName: 'dvevfljdocgffevkrchdkqzbvhshboymj' WindowName: 'bwjxiqzyaxklpdpvjkkawgpoosieyadug'
- ClassName: 'igmdspwrnswgxcctbwwrs' WindowName: 'asnenezppgkqtuadkrebxazgkrmxrlu'
- ClassName: 'frxchbzbweqmlactwihblyzpeoe' WindowName: 'jhirhidtdticqsydwgxjcybmullpczsufayxy'
- ClassName: 'tjlbscgnjmmgxbvgqmpwupgchybeyzmv' WindowName: 'sykgtdprlhsykxbcwsstihgengmqypuv'
- ClassName: 'nxnorahmeubafxvwagiozyzrxkntduuljicfbjt' WindowName: 'uakcgpcwojqxrrlxyovdggjsxyoztotwm'
