Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsx2.tmp\InetLoad.dll
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsx2.tmp\NSISdl.dll
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\InetLoad.dll
- %TEMP%\nsx2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'gumdopbgtkxcqfpwuppuputqsgjdsq' WindowName: 'epfnfitwzwlbsgvfvhafsncuzmzx'
- ClassName: 'rkxvwzkktrevzppmipyearuwggabrtt' WindowName: 'mcekknuutgpxtkloysdfaprypxfdztik'
- ClassName: 'fnbxyajmudhmmzeyetkpaiyu' WindowName: 'guujvccypwmygkvocunhzljmwzsshqohgihc'
- ClassName: 'xcmmkdmzczkgdchvidxhddy' WindowName: 'nkfpcqvsclnsxtzuu'
- ClassName: 'hvzmpomykjrwezx' WindowName: 'hiabwjjxbmbogujfiaddpu'
- ClassName: 'gczhbflymvodtrmxaiomeqkzqvwywyklnkojb' WindowName: 'gzsnzftltsncctzirfesqehyfhik'
- ClassName: 'dujwmlcachvjprogl' WindowName: 'msrcytwqmrfigfwvbtyjcekripbvosfcweu'
- ClassName: 'zwtivauumdmlqoghtkjyzcmgwkbftok' WindowName: 'mcnmkjqlrtgjmtgaxdbvgsflvkpen'
- ClassName: 'ixnqhlghnovmulh' WindowName: 'lzljjabebjkxhqddcsxhqhqxhtzq'
- ClassName: 'bvkxhdbbmvdokzzpcpe' WindowName: 'zvoheuldjcfzktxbnrnahayf'
- ClassName: 'jlupuqyjbyycciqacdlkwousm' WindowName: 'znkxjogrequgceaxcnhrvjujbczorewdob'
- ClassName: 'bmgqcpwetcltmikzlqeiqdfleloahuguvsqxnz' WindowName: 'avvpgrjigycfkatqzkmkiwtftnctzlu'
- ClassName: 'ltodnkffrcoiodsfxtveyolwhvlxycweq' WindowName: 'wiqrwbodvbfstkiowtlaafpouspadm'
- ClassName: 'inhxdkqljhlyqsvpkuvsnhhhccivmrbnv' WindowName: 'thphldjzmynraulsejxgdthprzulbiimy'
- ClassName: 'rxowxgvaswacdqqyhtgbxrboxabhbu' WindowName: 'hskvcwvtiunmqwtkfnsrgfdpz'
- ClassName: 'upeocohyjrgoxtpby' WindowName: 'mwjnzqimtvrmtmnsibmesryyaqqffgfs'
- ClassName: 'jxaflaqgktufyksizulnjfvmnyckoifwuqfdq' WindowName: 'vurcbfpllpcnnjsauivvgqqsqqsraduu'
- ClassName: 'zeoxpvahagqxxqwgqm' WindowName: 'knopvwtxcdlqmstufyuripqvterrcmglxzyioub'
- ClassName: 'nnwkupokexfbgcjxtv' WindowName: 'mdzplcrosaoactmxfy'
- ClassName: 'sewfidayrlmyzpz' WindowName: 'sjvqunqrhbrbekayhaseqz'
- ClassName: 'qaqycodciqsrfenpklgoayqtenixl' WindowName: 'nipqivnkioorsjxsohk'
- ClassName: 'haoeuqacrfonwfumgoab' WindowName: 'cbltnktmcmqbhboetgpmlhexdmhcmo'
- ClassName: 'wqfkmtxzmerklrzmpvlugqassjcucalxbxyov' WindowName: 'hkkkclxktxeottyiirwixcozawpujdlibbjdyfv'
- ClassName: 'muuqosltppzyfyyiwtviti' WindowName: 'rdyuasbmsaczjarokzftthjaaruj'
- ClassName: 'orcxrdpldleenxcojohnpurhwfpxrhhrlwdoz' WindowName: 'kcudyrrfbohawifknykykepoyphe'
- ClassName: 'kxewrcuqfllryrwddmztfzdhbntrexwjjfex' WindowName: 'vslxlbjzjhcyrebtugj'
- ClassName: 'jafqqwfvxbvqzgppsndte' WindowName: 'wqzcdvandbbjxvajpwhqprrix'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'hhibnopgmizilmdjtqjwhjmycebuubqfzbpli' WindowName: 'edwyfzmxnxdndbwgemrp'
- ClassName: 'knruqsxsqzcheig' WindowName: 'bnabaqiitysuxcglbazjugjvbvyca'
- ClassName: 'qhcxbojqtmmeyexfthxjljoyofgy' WindowName: 'pucfcqkcqhxxleworpkzbocpxneouhyh'
