Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
- %TEMP%\nsh2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\NSISdl.dll
- %TEMP%\nsh2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'jtlrrvxxorfdjieubmuonwahvfgnrkzoqbkovs' WindowName: 'plivwohfsgexoqaijkfueijiprovqvzeerlmiyi'
- ClassName: 'jjakucjcgzxzqccmgfynokleokezmwulo' WindowName: 'kowntkfsmbfjiieadke'
- ClassName: 'ggzhegrvncywdjslproafywgysaixbnbhtphr' WindowName: 'lluuwcmvoqsdwgdalfx'
- ClassName: 'pnfexgvnzwoqhzmgedbpjitipyafrrd' WindowName: 'aiozvhovpkbfmpojeyyemiskw'
- ClassName: 'ldcenbammuglpgyvfoki' WindowName: 'wawspnfujeqempchtztqyah'
- ClassName: 'pltfauyfqxabkrjhwjofgyupda' WindowName: 'vrmduhoniiquvispxdh'
- ClassName: 'jsiwsmkbimewgmbmzrjctzhrpvkyjsareytccdx' WindowName: 'iglzyetqbmqoptzpbzugqcixjtdjmvnlvfyuq'
- ClassName: 'qknwavzxjiamkmjfkhiagtylp' WindowName: 'arxukqcvymhulpethzjaidbmhjge'
- ClassName: 'nioticmsehunecthvzwydkqjqavwjhknciorc' WindowName: 'znansgcravlvdamkzcgudsqkmnpfosvyhskaxbr'
- ClassName: 'kaxdruozetyeecjpldaihclq' WindowName: 'rjmpfznmjecybrnweamfimhvwh'
- ClassName: 'gbypvgwisaszcsxuklremiintzfein' WindowName: 'fdvijyucgpwcnxydnaryfhoqsrdztltgqcltst'
- ClassName: 'kubtcpgwrsvndtnmyujvqavswtkolvjijrudyrv' WindowName: 'gjkfrgxfdecgrlojazrugytuiqz'
- ClassName: 'jffogmwmymvbrqxuvsvnbiykb' WindowName: 'ucbvqhgjuazqxmfoyb'
- ClassName: 'zyyaofreqqbemseoozzojbsp' WindowName: 'adjuvlzrbnszzkreitcxfhtpp'
- ClassName: 'woprcvljxmkiiqaxh' WindowName: 'kvasvgblsabflrnxotytefcmagobs'
- ClassName: 'ssblwdzqbyeienxktotydjfuvaodq' WindowName: 'kkdlxyfkqztmzpdyonqif'
- ClassName: 'vevdrfukqaqbzrtltorhakahbvckbth' WindowName: 'pgqvcgddpctvhgwrrdelmhtoli'
- ClassName: 'cafjpssdymsanwizzsuztebzfz' WindowName: 'wnvnubvggscsxpyjojisf'
- ClassName: 'khanamvwefwfoeuloiacmkzydpfnuph' WindowName: 'bolwpzouuszgdhipqbxrjqwokghmmbuhejxbg'
- ClassName: 'fjfzombvvtbevlgscohdmxwxzenrmdczkyc' WindowName: 'xcjglyelbfiekyciuaczmfbihvuklncz'
- ClassName: 'adcizcpxjwjcmvgjjehlnief' WindowName: 'rnnxcufulnoughxytb'
- ClassName: 'ykrbghajulplonnzsxuoohppnddnhvxg' WindowName: 'siuhsouftbjelscxiwj'
- ClassName: 'iaobiaorvcocxkhheswqxgsgcfspdkxzhwh' WindowName: 'gkancopsyqdutwxqtedmsf'
- ClassName: 'gxheiwztqtfqzxuwa' WindowName: 'euvrdlajnqjdkhprzlbcnrqdgpfimple'
- ClassName: 'kogaizreqdvpttpikszk' WindowName: 'taieovzmlgavkuwpdwsnmtytgcrpnobfrwrbzq'
- ClassName: 'tfjjrxuikmvtqlgtabcuusewbvxfzy' WindowName: 'uqdqidymlegdrjtqqnpipkwmwdgmhiqypwjkg'
- ClassName: 'jqntdqukhwxkhykjqzcoqtp' WindowName: 'ubkzphfqpuknqcfmzoowqfwkuwiknghsi'
- ClassName: 'nhdxflnsgjsntcrasryivkapjwtputqivbbs' WindowName: 'hfirnwkxjxxkzdrimblmeckdmdxjxevhfnjsx'
- ClassName: 'qbjtttycpazpuucalcv' WindowName: 'mqitxzqwaiccnchjcpsnkaghcgtchrtqx'
- ClassName: 'ljofqgcdoatoyuinpynaosjxczjnjj' WindowName: 'lzwbhhshhmshliwuawmlmishcq'
- ClassName: 'kzpxofcexzqamnrzpyshpoyvcafdamy' WindowName: 'qldqxulvtnxcovcfhproqvhpxxnuokugmq'
- ClassName: 'ifsmiuobagvfuham' WindowName: 'hetmlxfrpvxwhbzuoqiozdxqha'
- ClassName: 'xfbqxszodwjfrhdccygpac' WindowName: 'vjgaljqjtyybeftidhvunnfnv'
- ClassName: 'omgrakmyjpckpgzpouoqhorucovgixv' WindowName: 'uhcvukiezscoqgmmdcrxmhfdexw'
- ClassName: 'lqogdmgypguxrbnak' WindowName: 'zkzbmhljkatbdwceawagulcp'
