Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'bluzfavpkmmrpocpduwk' WindowName: 'dytaxvcbavctmbnyevze'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'lkultgfuqbxtwehmzkvhzorgvmfi' WindowName: 'ibzdhwvbsqkuhcxrbeolfta'
- ClassName: 'apzlrpskdgdroyw' WindowName: 'jdfrdumevrtqdmjlkzthnibaqpj'
- ClassName: 'ycuuzoesiussrcgwhxlznhtsnof' WindowName: 'xseprjryjclvzbwxwrhubrirmluayxzldib'
- ClassName: 'rcwemfyxbawtjzorirhur' WindowName: 'cybhlelhodfieuzxujcilboyjuxgxspzuqepgh'
- ClassName: 'gbtoenvjcslfafdjxmoufyfqexkjtxvkjbz' WindowName: 'hboichnadblpxwtovgadetesisnapjy'
- ClassName: 'fhawutwuwpxfrrnglvluo' WindowName: 'qtxwhozjgrstcrnykxcijdyjqle'
- ClassName: 'gflojengdmnihckrqzvbrhwihqbtbicdftxcpne' WindowName: 'molgksdgumhblpfjbelrbah'
- ClassName: 'wthqnxwenwvvfobhi' WindowName: 'qfmbikezkoypwnzcinpxjzxbjsqdrksesh'
- ClassName: 'aepxxuyrukcsqeq' WindowName: 'cbchjsqgntshhvghfetjkubynuptoifhkmpy'
- ClassName: 'iygeegyzksupcttjtmwfarmjpzuasvzvawul' WindowName: 'denipytsxzwdhrdjetzsj'
- ClassName: 'tuwpsxwldgvxipnsixkouwffpiihcqkohdnkdn' WindowName: 'cztloyntedsbzudximyczmswxpthtvdiemxs'
- ClassName: 'qaosqurpdevqgqrmcxjgaibjhti' WindowName: 'wpnolbjjhadyevnwpensbugrehrkrzlo'
- ClassName: 'mdyucrfbcuahxyhazoxnb' WindowName: 'yuukwryhoffjesupffqtemuyabrvfzqopyq'
- ClassName: 'tuuuufypvjszzyaumjjnrnj' WindowName: 'ztcrpsdasjcixyndtiqqor'
- ClassName: 'qfvfjjsnjmslavhqjfbfgqwh' WindowName: 'fblhjsqgtdfjdtkbrzgcdpxhaupgkuhy'
- ClassName: 'abcxzjgihvxduwcmmancttsoc' WindowName: 'ccnjmutxxeihyrvalietzafji'
- ClassName: 'lbroxtghpjxgyvefglexmeznoynxizfeu' WindowName: 'pkcxjzzfcryeyxudkgfwooqwzyahc'
- ClassName: 'yakblatzedgvdmehpqmnvkmxtxnfplemlbswdj' WindowName: 'ctlykzopbzmrudbzwlpbibioefbuvuiftd'
- ClassName: 'seduspqnyuyksbyihzdteawmw' WindowName: 'siqvygykwlkrtsckpdgvrbjhicsipv'
- ClassName: 'ooxtprevhxkxjoycbnzomego' WindowName: 'oogatbcliidhtiosvtubjtfsgkpdecuwjfdaawo'
- ClassName: 'wlrbznnkmkhazpjbtjojfotanvvwlxhvyn' WindowName: 'tahgeqqwlxnmnzk'
- ClassName: 'gtxcpqkbuppmvmesvprbqmfcouvvprpo' WindowName: 'rbgdjcniioqocgywwmyaddstsmkav'
- ClassName: 'vsksosvuqakkbeqvnzktlwrqklhl' WindowName: 'kbgdnoyfxbgzajsrdkfuyjn'
- ClassName: 'stxvxodbjftwtyffjvgrjayxddqmviqbcp' WindowName: 'gystpradsqzqfscnnaqp'
- ClassName: 'ktavytimxaiitkwhlfjoikbzwmzyccs' WindowName: 'mxyugzvgngoxysevjafo'
- ClassName: 'ubngawawoylvwqkoirfl' WindowName: 'rvxgetmkgnbrdzlhjfzmqpm'
- ClassName: 'rgsgievylvsrlsepdcvgxqwzhchftivtijetsm' WindowName: 'kaelcdwpuxpzvyqgopudddpystepb'
- ClassName: 'ybexesmmicnhmraslgnzutlvllkagq' WindowName: 'xcxdebboctpijyiyziklrpbhqhorqjb'
- ClassName: 'tqcrcigrqrtsvqfimgyvfanpqqjtopjb' WindowName: 'ijjsezvampipdaoxqwxzxhoslsrydqwp'
- ClassName: 'fcyjiocfxhuvingkdqdjdbuppvuepd' WindowName: 'pmpbqcesqxwtrwrajzghicrfomx'
- ClassName: 'safzypjzzfiovdumamtwavzhrpfcwmlmh' WindowName: 'pqggncpazzzvuplhdzbvxhphrlb'
- ClassName: 'bjfnjlpqjaghcoa' WindowName: 'pvyfyzdudydgeftxl'
- ClassName: 'lypajmppmehhrqobuvacnm' WindowName: 'barifvbamyfqekiytkalegmkicmb'
- ClassName: 'rqeijjtqkjuhsmg' WindowName: 'xgtrzzakvcobuqhfwvbdendv'
- ClassName: 'fgypidvxfywmnwxhulwysv' WindowName: 'rmljhqkluhtybugqsowsjrqrj'
- ClassName: 'renxoepxabzgjqxenjfacpbwonxo' WindowName: 'bvxojnlgmijjztafwwtv'
- ClassName: 'oysixigztkhreamrimsvbvbeyyfb' WindowName: 'rxjzrzqaxylftsclxwmucwdtiyeaxitjk'
- ClassName: 'urukcececpnfmvjwfgfrikj' WindowName: 'hopkzisebnzqtloiijqvguafjprhoqbjhnl'
