Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
- %TEMP%\nsn2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'skwlsmnxxmqapmyakalajntag' WindowName: 'yibmzlbdxkzppgdohm'
- ClassName: 'xyqyizusmjpiqhapkxnc' WindowName: 'dybwosuayrifyfyoxmnigdmtml'
- ClassName: 'cjhaabwtxqigzuuafbbkzn' WindowName: 'shpdogkqnualsdmilaiseallxcung'
- ClassName: 'bquidjlpuxccsdapt' WindowName: 'yisuwpuqkkmcsaugcwz'
- ClassName: 'pydouoconfhmycgkxbmgicgagyacvw' WindowName: 'lebenghmrmhvuziktwjwfxlbdhumpn'
- ClassName: 'gxqnpaderrantnpnwnhzdqyjyeurxelvetdy' WindowName: 'knxtvgnvejbpkeamtegb'
- ClassName: 'ghvdoeeuuojqqzuqdcmiglrfu' WindowName: 'qkbldodyhiiprtcakyzjxxqvb'
- ClassName: 'vierjirhsvhwvwclosj' WindowName: 'oxpeljhqqodpwnapyurf'
- ClassName: 'olnupbyrpnpjasapchyxsdokmarpuscqv' WindowName: 'uhykpdltleusaehquoivdicpwpyauoqebdru'
- ClassName: 'hdqiaqfogyhwwikkdeqyondnl' WindowName: 'frvhckpnzoxvknobknngwdppk'
- ClassName: 'gjimcueeiuctbazbzmvqzfmdwc' WindowName: 'mecwsvsgepanexgucpndphtjyugba'
- ClassName: 'uvztavypgmlokuagwjfi' WindowName: 'vjbhylsaumbhxqezardm'
- ClassName: 'ojobsiwkfbkudtl' WindowName: 'jteovdkrienjaxuzl'
- ClassName: 'tiyahfssrfmwxiegphdgsaahlhxtypmzrk' WindowName: 'lzrnpddhfcpvgdk'
- ClassName: 'jolpwousdozqokble' WindowName: 'bqvwuxzichdmzjwexczxocdbxrilstkcfgftdgu'
- ClassName: 'idpxnhzstriysjuavqxbpkznkf' WindowName: 'ehukpoypbynrbrkprbjktbekeq'
- ClassName: 'akujlrrilwepfgwpaw' WindowName: 'wectrycdykbzyhzypozqajdovq'
- ClassName: 'yujbnyvyzxzpnyojqrte' WindowName: 'qjlxetounaeaoxubuyhqizcrtmsglriipuw'
- ClassName: 'ilpkmfpblgezaoe' WindowName: 'flyahykrsewjzfgfpywicfbnqdrsgcshqgs'
- ClassName: 'hoeofrmifiwjwsefwqmyorpzirmgmeshnsx' WindowName: 'jsuokgcratpumiwjlqszankwtaulwskrepxxu'
- ClassName: 'yvyfdckhphywjuhwjozvnivzvlqokkryds' WindowName: 'ctbrbowflxnyacziovmvdxq'
- ClassName: 'ijanwwgrmsclppvg' WindowName: 'zpdpjlsrppdsbxqmfjmxzpnj'
- ClassName: 'xzmmwfjacznkurstqtskuqn' WindowName: 'htmxynbapqvtjihbus'
- ClassName: 'zhnupxiewazfgnyofzxouzqmqpjrvfqc' WindowName: 'cgfvlekmehggccokgdttpmckytwocmqbwl'
- ClassName: 'soeoeoyknklyinllicoltnddebycxdmjqvyuvu' WindowName: 'fjleekralvnpicmahnuibcihzfgihnnzo'
- ClassName: 'gfzuhqqutjncsgnsqcnq' WindowName: 'ejifcpzdogmjrailyaaxqlgzqvasc'
- ClassName: 'ytuzsvsaxgrjxso' WindowName: 'sjgpmdammijpgikulok'
- ClassName: 'ehjlwzkbehaeinvxjghnwtgm' WindowName: 'ojjloygghqwzgbnlqbourjbbefvncnz'
- ClassName: 'tkqjvzxqtabakumqudcwvzkkipilttheqvuzrja' WindowName: 'cyaidaxpwyeytdpmpbqwyeowweztsabuod'
- ClassName: 'dowwcwjfiseaqvddjozaesjndewsoriao' WindowName: 'ihvoxsswwtrgobpcyswn'
- ClassName: 'sewegaqwpqrrgojsdvpjtgkwkcqdzefoqba' WindowName: 'jjvnbydeawjgkxzkowuwznr'
- ClassName: 'gthqnvtjxcijtzjhteijbmlrucpmn' WindowName: 'hqkctnyfakzybmbdwyyhvrslryor'
- ClassName: 'fyassyppkkscpvrjhabdeggjaqrac' WindowName: 'qhohelfzhpmayvzkfrxlurwhmaeaqjvxqzfekep'
- ClassName: 'bdmcjgycadnxxqfdtvvyeevu' WindowName: 'yjxbsdxmbweurtodfkqinbjos'
- ClassName: 'uwnfmtojywhregghohrouxvebuktzmokifuyb' WindowName: 'ipjmmyjnqyiqthxqtxbzhcahsejbqfd'
- ClassName: 'vnddvmhkivmveycsmzm' WindowName: 'mxknjlfzsigybslsqd'
- ClassName: 'qknantmitavxmleflskggmycztmvbupjifoq' WindowName: 'swqrdmtcufhqcbstoop'
- ClassName: 'odceibokvflnprrugslgoztov' WindowName: 'gpaxdcnniwcruorxelbn'
- ClassName: 'hjtmrkjfqmeortcvvpyxrpfk' WindowName: 'adxsgxikovrqozxvv'
- ClassName: 'gmkxxegnrrfrmkaxvuvgvuhf' WindowName: 'ftdiuyfalzwlllxntllxqqicaivjwlwqpbmd'
- ClassName: 'oapowfcptrlgvfnakfxqermb' WindowName: 'sspktrdxoxrxxtydyyownsjcnaned'
- ClassName: 'gvaehquvonppacbjjcdcuzzdqhjd' WindowName: 'gjmptfnhzcjsvbgecvnhkueloi'
- ClassName: 'izlxylqwzmmdzvrvddnvw' WindowName: 'ldazpfxqmqbhklpt'
- ClassName: 'twmaulnweglezsburmsmoahbdkiuog' WindowName: 'wuhxernypncjpavxhph'
- ClassName: 'mcnxcoshuncozjqfhquavkt' WindowName: 'lixqtrpbikokzyyfmwyzxvsspgyocx'
- ClassName: 'bnrgxozimldtchecwfcg' WindowName: 'mijdzfxodnsdzadxzsmooay'
- ClassName: 'sfwvhjckazhdevzesd' WindowName: 'jfiyyuxaysdklmvgiig'
- ClassName: 'idpgminzstcenakydnv' WindowName: 'hckblkwnycgrpstmhslfeewfruyzm'
