Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsz2.tmp\NSISdl.dll
- %TEMP%\nsz2.tmp\Math.dll
- %TEMP%\nsz2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\NSISdl.dll
- %TEMP%\nsz2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dywuntcrufeibiewihiyumdkjpnydqpiafifein' WindowName: 'xjorfscophfqyepomdtqsxrhm'
- ClassName: 'yitlcprmyftkylrajujmfjcynvzmc' WindowName: 'izispbdylyuxuaahwtav'
- ClassName: 'chjisedlnjexexxeukksco' WindowName: 'ikcjccghqfvloxfkvioywsbsddukkqrxin'
- ClassName: 'bphxrqgnpssloanjnfwizwgivsxxoqck' WindowName: 'qacmfwiusqxbritkfktvhg'
- ClassName: 'thigfexmopgconclwpg' WindowName: 'kjmbxztaaxzluhduylknqejtogt'
- ClassName: 'ksdgeeqzyedcmrisbat' WindowName: 'xuhgiwedzsojbzkwprxfb'
- ClassName: 'uraypxwoxqasonwefejxomguxstdwvdunh' WindowName: 'memuwkntehuqkzzvstefhjz'
- ClassName: 'osqetmigfitclbo' WindowName: 'kiflstggjzmrvahianvglivhmvwgumgwjja'
- ClassName: 'sbqpjpcgvdzplpfropocchetsoo' WindowName: 'hdjyyeanpbjmfhmstyoa'
- ClassName: 'mlxbzypifwqwqlmdppgufgvgodrsuvnirnl' WindowName: 'jowjnqkejbutwmishaemaxtzemf'
- ClassName: 'yfhqyimsrbuyuukwsvnydhhabpbssrwd' WindowName: 'wibshmxhvobklztioxlawndxuyq'
- ClassName: 'fpmhivtoxigoyhlg' WindowName: 'aogqsvozprrwvmubwxbwgv'
- ClassName: 'uxbufpzbhynaodggyi' WindowName: 'apuqufwdbfvcjbbxuyflynftvclqf'
- ClassName: 'akgilcbqmkktimhvpqqcedsgbaohnz' WindowName: 'ixnvkinllqgbtdudeeryqzltahczmfs'
- ClassName: 'bhlasfxadpmzfgvaylluepyuyoskicfsbnbq' WindowName: 'vzljyuuhlbqbfwfkcoyjbk'
- ClassName: 'xfwguilftlmmtwnudfaneqck' WindowName: 'hodadyuzobwdxvhauwyzxvhmhh'
- ClassName: 'myypsbfzaerpmnewmkiwccjpybysadjrvntbq' WindowName: 'qptrwyovssspuorzxzqbxwajnxy'
- ClassName: 'lkvqlogkpdmglpdqvdxlzgusx' WindowName: 'ohbelgagjoatzkdjtnmwjoccjtgnxoudf'
- ClassName: 'hsswoymvqgwtdbhayjxgdoeicwfpxvjdwpzrcg' WindowName: 'grsefkckgejpqapuc'
- ClassName: 'turfkurwoswsbypbscjbwajmxxg' WindowName: 'cxxypvpzfhkaanzxbwajndkuahdq'
- ClassName: 'nywwvribriiymerbwp' WindowName: 'ilttvbdpxbgyalgvkavihvumpcwfdlktmnasw'
- ClassName: 'amlvthwmfxtlpsw' WindowName: 'mpuaruzbuugdrndmn'
- ClassName: 'nmomivkfxvtfrpmehpuogzaqvrjgpgkkoggz' WindowName: 'hpyarcojeugfttiuhkpyqljkyipinqfjx'
- ClassName: 'fnmfqfyxbmtpxolk' WindowName: 'pkbojptjxeiyvkzenyguegggvpmqmqhny'
- ClassName: 'vmziviszculfhxn' WindowName: 'hgoshlyxqlbhlhnlivmjt'
- ClassName: 'zmtuxrcqxvdgtjlqpzflcjrdvgkfhfuujbybyat' WindowName: 'cnhfplgxkrhykndsdom'
- ClassName: 'qvevsewjlajmhratqcbhuiegjoxvxn' WindowName: 'wluaawvodnxtxatofbiifi'
- ClassName: 'esmvnilkwutyiavefxwmiqku' WindowName: 'ctcwschlpandcywkjqsozzywlda'
- ClassName: 'zqfylikwjqvsllwbgkzkclprp' WindowName: 'ugnywgxewlhxzttlmssktzfvs'
- ClassName: 'geodnosdyhkrweidzuciproqqxjwzhiwlq' WindowName: 'cxfpiddrkdraunzcddvhaheqefvleg'
- ClassName: 'czktfrjrfnqaynccexlw' WindowName: 'jcjizjmejjsqcccuevyovd'
- ClassName: 'fhzdhglvcgrzjthhuqkhse' WindowName: 'spdxnlwoopdyjyefnrbvsjwrfjhdppbkw'
- ClassName: 'jvqlpnclwcqeyrtrpsuy' WindowName: 'aouvqyjowctnwvazdpjzfzyoz'
- ClassName: 'ezbvjnwhmupbfpwvheykmmstehce' WindowName: 'qqjuqwzexbrysvuiythsnop'
- ClassName: 'pfljqwdtsjxlokddgeybuh' WindowName: 'kycyjurczowdtnyuklkdussm'
- ClassName: 'klmxdlhcimltaxbhulpbothmojzasbljmai' WindowName: 'jzmzgpdbbzqvfhideondbhrprhzv'
- ClassName: 'cybzzfwfseppyhcmaslalrgnzkl' WindowName: 'brjebdbynfteijvwrvfmk'
- ClassName: 'akucbzsbmyrbvevrguwffdkxbxr' WindowName: 'pammoxgvpvgsybiucranmpvtcmlo'
- ClassName: 'ouepqcxzjtcschbpctkdnveuzkiny' WindowName: 'fqcrcwmtruycczyigtlyi'
- ClassName: 'ltzzgvbvspamfhjust' WindowName: 'fakumxeouevwmkvwkqqiuzn'
- ClassName: 'jruwffikzceldkoifgwnaubiu' WindowName: 'cydfyebvzjmdjtbewyzvupwtyl'
- ClassName: 'bcrsrzlvgzfutxfmgybvdg' WindowName: 'oksffbleqsfupmi'
- ClassName: 'flfbbidmufzptgbmathjysqmfrxwy' WindowName: 'ikovtbbctkndhiirqiyqljpoz'
