Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'hyorxxszoygxyxqrwavpzun' WindowName: 'adnrlhuosaohzgudqfirwecwdctiouiup'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsq2.tmp\InetLoad.dll
- %TEMP%\nsq2.tmp\NSISdl.dll
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\nsq2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsq2.tmp\NSISdl.dll
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\nsq2.tmp\InetLoad.dll
- %TEMP%\nsq2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ndregnaeqkkbtdkiorxpuuoaebfysz' WindowName: 'shtmtpsfrcluvgcwqjcmoxqqkcruvwzp'
- ClassName: 'razmtvbwvdepnqvlpzcyocjxjvkie' WindowName: 'tibjlymydnlwtczbtlaqka'
- ClassName: 'umlhzpvdcfkirdmgfeu' WindowName: 'pkhmhyayquitbvxxooimtczrscdcgcsy'
- ClassName: 'xvrrzzceiurbrxdbhsdafeyanpovnulo' WindowName: 'fcugjainxcnrwmrlthzydlezfhszofyczdcybkx'
- ClassName: 'ggzrfyjwrfctcmvydvjtljrqvksqyuuuesn' WindowName: 'usrxjguokntxzjgf'
- ClassName: 'vcsauoreifyevybhjdlqovtzitezokwecdjymr' WindowName: 'cyszbhilbceiunmks'
- ClassName: 'smiptvwwiftytfizlouqzyzaaxqwhvl' WindowName: 'ljbtkuoifoxeckmnvuuhkrarhon'
- ClassName: 'ckosvkvymuktazegdd' WindowName: 'cdyqwrhaxhtvndevxonjgowpujlbglyjbfbjfoc'
- ClassName: 'boraerhnqircezpcy' WindowName: 'jgpifrjxmdfyfxwwjqdptekros'
- ClassName: 'cpzdukqbiafuqseftxeaalmcqotdqghbdptb' WindowName: 'svasutwaulayxhxw'
- ClassName: 'sfpackvlirafptgsvoadjxdo' WindowName: 'uddzhfbzmlquhlkjfc'
- ClassName: 'vsiusjidlfkceoxyaiwajvoarvpao' WindowName: 'ebgxrqmlzfiggwkobjerjygsqknzv'
- ClassName: 'hiwgjvzeiyydzdjixpilrotbpxvspabs' WindowName: 'kmjaulohlgchzecmclvfvgnoxjfag'
- ClassName: 'vxlgecnhqppeqdqg' WindowName: 'giripzhbypdyyzcslksoyxhehodib'
- ClassName: 'cfeugcqrlyqrkydyjgkeqbxbisjwydwticiz' WindowName: 'izadoctgpnrwvtkalfdtskvyicfekiosobejae'
- ClassName: 'ucjevwiassrgaqbzpltdqfxirqp' WindowName: 'mefizhyieplshtixhcegtmirjf'
- ClassName: 'yqzwfwraldiopwttzpqqoqgohvndoqpyrdv' WindowName: 'gnrqcnypzqafoazjnueuinfzknzdopdcviuhla'
- ClassName: 'tagirxzhzahiicepmyhdajkivicf' WindowName: 'sdhctgqpcsbooguneeybaj'
- ClassName: 'efrxykzmfzhgfrlaaiyaftparqyaccggkm' WindowName: 'bctmshcivyodkplavnxljws'
- ClassName: 'vpghhyspjlcmfqqyaqpkqyjlikrleuqc' WindowName: 'xkyemfdznytrbjdjokprqxdx'
- ClassName: 'dqzphmmrfahngzixhokwtbraobkqgymdetmwpy' WindowName: 'lghevplsbljripzhsrpst'
- ClassName: 'frncyoslhpstzwnfetbqnsizdnzbjiksvvqorg' WindowName: 'ajvscgcowkzvtob'
- ClassName: 'cmjczciaicarvajlolioezbntstbuihhxachk' WindowName: 'lyqwoxrlqdyzhfwcumkax'
- ClassName: 'tfbcximbsjhbbjauyoacdftojem' WindowName: 'knlxtbokgdmqwbdilel'
- ClassName: 'gptjeeiiwgjmncaluewfrpscpppf' WindowName: 'rlnkypuecvesmcydvy'
- ClassName: 'voshvouequbtiollgceiipe' WindowName: 'qgmjhyxzyqyfpkewbq'
- ClassName: 'qjlzurbcaxucfywfwvcsv' WindowName: 'fuwzokfgitatbrkrlznbegtyqrcswjllkwpi'
- ClassName: 'xxbysnebofllkxrmdphkgf' WindowName: 'lzmbnjmcbwkzhuefpfskfftjgsin'
- ClassName: 'zdjqaxowtvzgawvgsehltuddxu' WindowName: 'axcmoyxhajbcdsdlcp'
- ClassName: 'rjanbiarutsqlhdxvblx' WindowName: 'jtivdacirtsnjfvgdsixc'
- ClassName: 'bfqknzvbofriexwhxdetrpdbuimz' WindowName: 'apnphulzcwwadwsfiuhonemgvusslw'
- ClassName: 'uimdfhwwftutaev' WindowName: 'wcsmpuwhoatknwjlpswbfckabijahfdqhcaqww'
- ClassName: 'bzpncsrpmjafptabyucfbysapk' WindowName: 'litofrbnkvwrubegfcpnrfkapmjvqmywxndg'
- ClassName: 'lztqwemceaqnlqnfrvxececpiyhdelv' WindowName: 'prwfotxeffxpkkvwkr'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
