Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\InetLoad.dll
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\NSISdl.dll
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\InetLoad.dll
- %TEMP%\nsl2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hazexrmkjqxqaixqecfgamfajgew' WindowName: 'epfwfpavmmjmettrddk'
- ClassName: 'xkycfwxzprnmeqwkmelozg' WindowName: 'hfmifgaletigrfoieybpgsvzbwpjki'
- ClassName: 'bqlplctnskamftdcjcqswokrvswetrs' WindowName: 'cmyitlfmhlhqwlaercafnzuroopsi'
- ClassName: 'hrbhnzssxebsxdupufgxikqqygolinnghghhpg' WindowName: 'qohneuifhznnilvx'
- ClassName: 'octcipchyujfjptfdqxgasvkyeaqvojwuadkjd' WindowName: 'ixtkpdqypkqijxsyqsfpccvoerrbuzdhtge'
- ClassName: 'sygxtybkufctnovpaydzfihze' WindowName: 'hocbufeklfujuwsm'
- ClassName: 'nsvablpgaemmcdso' WindowName: 'vbrchglxxljfxkkodylmtxkljgb'
- ClassName: 'kkearoqrbgnvdgmasqrdnxfrrpsjmldknqt' WindowName: 'jzeqexwphquffwczkxtrclrdgiawpcdvgiv'
- ClassName: 'zqvbavbaafcohzsjkrgmslsgnswqy' WindowName: 'pvfvbwgkiadmfgvrtwtzpeubwyluvqbq'
- ClassName: 'whjnompaxzscdsgrmiorqxjpydtedlqpbecaj' WindowName: 'ewiiukekzhwrmvqquujvmjdwfashgjanhsltjvo'
- ClassName: 'rczmgntmcmkcfquvxdmmwapqzkvkwmitwmulle' WindowName: 'biuvxmmvdgifqssttisiuquyek'
- ClassName: 'fuoomgpnirfczxbliqxcugelidraby' WindowName: 'nxkgqcrifcnhoamkwze'
- ClassName: 'sldmpmlspgttnnjtcnozemjnmqjjddd' WindowName: 'ybrolcufhnntewjnshhgueggkcrytrmsmdu'
- ClassName: 'wbpynbmjirblnvrbsugjqpsmzsj' WindowName: 'yauzajshmskuapltqlggktvawtrswxkh'
- ClassName: 'cehmpdqjkutgutrmdrefbqricgthnnskzyq' WindowName: 'nktqplhukrsccxwuogzmtmgfwpbrd'
- ClassName: 'elvaupoogupqfnpfoqesoeqpyd' WindowName: 'nqclydtfyjiskquxhjzlgvdiwa'
- ClassName: 'nmiexsxlyqkrtshtrwkyfeizdryootphusc' WindowName: 'hpfdwwmlhylyqnyjakw'
- ClassName: 'mobxkwamuadrkqvflbkulqydxxaump' WindowName: 'hvbxuywbxxbkkrwcv'
- ClassName: 'kxftusjfrglzykbivpwfcmrxytkfcbhejz' WindowName: 'efapusnaueicukoidyxmpgvsyiyogparlmzd'
- ClassName: 'esfhlmcawofduloyaobdudgrunilsyjsvb' WindowName: 'xxfmsdoixxclwvajrhaevydhjqqocnetmvopf'
- ClassName: 'xanvnznjeccafslgkvywybfzrewxlsztdvwnbvc' WindowName: 'mwobsudnbgitbdnnjnmxejv'
- ClassName: 'ccvpcgjtyiulsilaqfgsbp' WindowName: 'urjxwngnzgujywwmumnwozjnjy'
- ClassName: 'yndsrqpuqzsxpqafgynhkehwdpuewtvp' WindowName: 'xttovqctwieroqvaniogwhsgnguddwnhcligrmf'
- ClassName: 'rxnnjydxvbsasxsmalaabfiiziqemyxaooacedu' WindowName: 'xyfdudicxkyzdhoudjppxnojvedzlzqim'
- ClassName: 'lcceikkwqjlayuxfwxrpaotndijrnpfxtx' WindowName: 'cbukbkqcoyrevviqxk'
- ClassName: 'tycgvnnfkveizkuhspksgtpdf' WindowName: 'edkohtbmafueoefsfcfgp'
- ClassName: 'feamadiljmbzauakzsboqxjsaowifxaggm' WindowName: 'mjilldkxhrmuzsukuickaxtpicvx'
- ClassName: 'kibtjncgmljzudbwzlejomlugurnxbub' WindowName: 'csziesxyydsvddrqc'
- ClassName: 'pzbfjvspmrjqzujwxsqjbszhjlbsfrjnvun' WindowName: 'rxlrhovwwuqlzkgyxpioibq'
- ClassName: 'zmcmobltlyoncaxlwy' WindowName: 'eggdbgalqniimidivrkopio'
- ClassName: 'uxqbipkylhptljtgitoateecepqm' WindowName: 'sjqbzihlqcwdlsjjryzfaklhi'
- ClassName: 'daidopyiauarynzkfvzdwsrywqpeeyignpqdyxs' WindowName: 'tmdqxepsbigkisznizsdkwp'
- ClassName: 'uiupamqifhhaduhoabvyl' WindowName: 'hjlbpkfrenaskagqmm'
- ClassName: 'adheqapwityvtvejapdfefrvmsgks' WindowName: 'xjkybeeahrddbfjxtepdarhqzckav'
- ClassName: 'dovibnlkuwdgkpsvpecwdmoaggynklymbcxbdw' WindowName: 'ppeqvayhrkuzclrnmvhqoqcbauz'
- ClassName: 'jtzfivkjfgqhutdecbtepull' WindowName: 'wgoezjswuswmetgduczremnshb'
- ClassName: 'hjrgzfqkmwcctoylno' WindowName: 'ubwbqpavvaohwbingfkstqfehiowjm'
- ClassName: 'ijeciwclzjahzyukidaymegkrukwmkeynbshqax' WindowName: 'mpojhtctosbqefzaejwabk'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'cxkqtstcpuqyjknfydcdyvqvsawwph' WindowName: 'lnqgunvqugrnbepbkmfjikvzywwsvorydr'
