Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsi2.tmp\NSISdl.dll
- %TEMP%\nsi2.tmp\Math.dll
- %TEMP%\nsi2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\NSISdl.dll
- %TEMP%\nsi2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'awhjeeotbagxydtozqunfunnwbrp' WindowName: 'kxjosttvbyvhwkz'
- ClassName: 'qxbwhuzlfvagopxzkylkbtcnaffzjzfhf' WindowName: 'dmyaibkycqpcedszb'
- ClassName: 'azrvcsldhvrwtumhchdumtriez' WindowName: 'jlhqsiugcrrqylbsc'
- ClassName: 'yuaofrrsmdmdtouvolwvyvia' WindowName: 'dzggzvzpbehqfposdposcclxffavtljrjdh'
- ClassName: 'ysticqptoverwvphz' WindowName: 'jaoyhxqayoyyhcskvasbvumfzgi'
- ClassName: 'esszrypqshjgmvy' WindowName: 'lznrrtvqtpeuwnxuzgafiskpan'
- ClassName: 'rdjhcjaegtkxgbqecsmvngxmusatmi' WindowName: 'ewmxvfulabuxolvyxnnafjnkweghixjbize'
- ClassName: 'ganskatczbifxvjkklzn' WindowName: 'jdfidzsawetixofbjgqduxrhkpbmhxtar'
- ClassName: 'pqzgwbpctnjywiuveorudclbsae' WindowName: 'hhzgtjahdiejayxkcvwdnvc'
- ClassName: 'mhuqivtoiwdnvjkmvlhfcwknwnkw' WindowName: 'lxyhbyxtdihciumylpgfstexxfxpsclb'
- ClassName: 'yjsuqlldyfwjnyoqmbsofkbtkhjlgykubgzf' WindowName: 'ckmhvdqwduxmxrbemrccyuygb'
- ClassName: 'venrsyxgqfigitksiiairrguikimqws' WindowName: 'fkugbdoxdajulqksxypbqsn'
- ClassName: 'zlspufdjnpttplbxyp' WindowName: 'ddconxybobyqfobponujqpaxgn'
- ClassName: 'owkxgdoqydztbfp' WindowName: 'aacvytnnntalcgjrmgskwcjepayffeba'
- ClassName: 'bfzyqoidxvxajrsttscztsionwjxthjfc' WindowName: 'gtyizuxyxgnjxcykirs'
- ClassName: 'kbilflfgazfwibfovmmkcfy' WindowName: 'rzitgufvewmbhkp'
- ClassName: 'zcjmrjztlwdsdxqqv' WindowName: 'hmsbpndonbxubsaehmbej'
- ClassName: 'tjrkwfwqvcenwbgknpzvfyywgkh' WindowName: 'uxukijynlwpljfmhvtfoamd'
- ClassName: 'pngcbaqvjwgvdaz' WindowName: 'ltqeaztnhlrqlhsywrfev'
- ClassName: 'cdnboreqwrhgdmpxjxuqqusernfcdrt' WindowName: 'omcsytblvypieqxjzprbfigdw'
- ClassName: 'xbnxtpyzezhtftsylq' WindowName: 'fcpbdkpmiaxdgrxjdakapidbk'
- ClassName: 'actmvxianyvrohbgpcehwxthtdnpndvxrtdvune' WindowName: 'rojvusvuahljqjogmgwstour'
- ClassName: 'rijfwumiaeucecjndvnrbpwkaiawitpefb' WindowName: 'khxotlwatngkcwetnbfounemqqlclg'
- ClassName: 'ggsanjqxplczvyqfarwze' WindowName: 'njoxwcjqdkahcgbyxohrnbz'
- ClassName: 'ksvafdstzyxeobytxeqpmi' WindowName: 'btgghmuutwpiokrvxpvdywvyencw'
- ClassName: 'fcjjavzkggjnqzjqvwuwimdenkvoisidbjjdbb' WindowName: 'mbjklnueaquiphzytzx'
- ClassName: 'sjjmduaopadolzyjqcrhatobfvopscjzmpukga' WindowName: 'qqmyrhgxduvigpzyrkklicwxckkbhoyrjoquo'
- ClassName: 'hunwcxjfutnvfmzncti' WindowName: 'avhwkjvjgunnuwwg'
- ClassName: 'sscdguciihkhzoqsbgsszkvxbtknuozoq' WindowName: 'jdrpyqphzgfosgakvmyam'
- ClassName: 'krydplotgcglazvkhg' WindowName: 'jcpanldhmhxzezrokrutqjzbnabpdomand'
- ClassName: 'ngimqufneuoepuysgveyymmtlq' WindowName: 'twrfddvaqgniawujfeldwsg'
- ClassName: 'ypcufcqaedslwlx' WindowName: 'yhimxideviaftkjedrpcvnjqdnpgkffvyikndat'
- ClassName: 'syxafakrtvglosajalmvfzpcqtbbl' WindowName: 'iwqfturmnyqnejwzhuztcqjyjvicjybmqpeya'
- ClassName: 'pswhncobbixqaxtvlavnpbnuxktipfqhesbsiu' WindowName: 'tgzwicoeepxsdrds'
- ClassName: 'lqkyspapzcelhnlspinjnmafazzbklu' WindowName: 'fksqwpkxdeucuhfszp'
- ClassName: 'goifcslfhfphtfivdxjrbrtoakyuovszhcpfeuw' WindowName: 'vvbrjodegtvpqkmmoqbnwzrkoktfegggnc'
- ClassName: 'ezygrqpcosieqxlnuwseumdqaihfothptt' WindowName: 'tmsymmdfsyckeprrxmhpazmpeznrr'
- ClassName: 'ynwzioqkveqewglesisvykoykccvkvk' WindowName: 'hluhsbnemisrjfpdjsgmrbczvglo'
- ClassName: 'qlogngkjbeeludnrsekvmzvwajj' WindowName: 'yrorxojgdpxrqnxvd'
- ClassName: 'oxrkvfagrsurhzygjnkhyx' WindowName: 'dilblxnmbkikvgbeclyjvatmaacn'
- ClassName: 'oxazegseymdvnzoxwhi' WindowName: 'wtmomchqbrhdrueuiidjnqkbsqwjcaarr'
