Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
- %TEMP%\nse2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\NSISdl.dll
- %TEMP%\nse2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'mwkmpvunrocddpvneajbdqb' WindowName: 'ycmycesycbazhfzwqmo'
- ClassName: 'wposbxfdrwlysmbcheloubj' WindowName: 'xhbyrlebcjfznbatmgkmjn'
- ClassName: 'umypkpndyjhccboodwrmuenrbccjflujvl' WindowName: 'tbishlaimuqtmsdappklcdlieh'
- ClassName: 'hdiyhxzffpmhlkbgzpnajtgzfkshqhusvj' WindowName: 'wqqvenkiozfnowfdsorsbuiihjabuawayjra'
- ClassName: 'vozvjrtvwwlbepthjghwnevozcgddul' WindowName: 'lrvjrrksyplvnxeoiswmnarcmaoxzpur'
- ClassName: 'irblwqyiqmelcutwqhehtcowbfw' WindowName: 'ggrbyuarwfwglhuouhjcptaaxdjmssihlwuftj'
- ClassName: 'zzpgkivivojabsfk' WindowName: 'xqkjvsvgvxcgpkumaxdilcyqlwfqgsegc'
- ClassName: 'srffarltdiarxtcifsusvuqrown' WindowName: 'yhiepbfhsnfzzlckbbslqmaumgqrsivad'
- ClassName: 'bhjzlifnedgzoawgivkqjfufn' WindowName: 'qfyssnchbqhymtjydfyqeazkgecf'
- ClassName: 'iauxoxlapgrucfhcjcubgswbr' WindowName: 'qbidsxvzndpxzmjesbyltuka'
- ClassName: 'bnfbomulrcgaodyiygqpngwgsuk' WindowName: 'rochtypoejunuhekbizaucizcljewiej'
- ClassName: 'wqolejaxdqavvfhvufwogprtlrhfzzrxl' WindowName: 'vvzqwwpbiwblyqbakasyqzprmjechp'
- ClassName: 'ftdvjrvavjzmbrykxq' WindowName: 'glzoulghhhtigztykllsau'
- ClassName: 'bqpohkurckijwidmahkpjvk' WindowName: 'ywcxobqywmhapybjkr'
- ClassName: 'vkcqmcwnzrzqjigwzxhktvfunycxjsoxjexy' WindowName: 'cxeqlhcgqvatwrlpbrqbgjq'
- ClassName: 'rvnpfxsfhxxfqfopzcrthxobpus' WindowName: 'lfjabdvtsolpslyhclwildqzihuii'
- ClassName: 'qxxjmmitpgrzhvmpwjsfiuz' WindowName: 'anpdbnbpoywnsqqphqjehngvxsytqksfj'
- ClassName: 'ehexuucqfogtsekybubawrljqoqowxa' WindowName: 'wlulnodhezdawfrmixgbakvjsfk'
- ClassName: 'vbotnaxhismwjnaqtudpfijaukckmxkfufa' WindowName: 'tddpwqhtyyawxfnvubduvjcwejg'
- ClassName: 'uvrehpuutsvdmqkvloyqyozomvqamzxmgkodu' WindowName: 'bvqajpxaufbvduphzx'
- ClassName: 'jagdqclqzfthlrsaficto' WindowName: 'tmzbfrvyxnbgiobueibrtt'
- ClassName: 'zqffrcvqelysiwuzdcpbqwdm' WindowName: 'omiljauxijsvwggbbzqavubmqythzheqqnwbt'
- ClassName: 'daigmksfpgzhjdvdgmypgyxinsyilmklmmavx' WindowName: 'nfxbzdzxjsqmyjxpbxjfhnce'
- ClassName: 'kwzhydifbkevkge' WindowName: 'luykcyzsxwckgcfasnuzygyehwdfxnayyhxiui'
- ClassName: 'vnekesmmqzvhcwdmyws' WindowName: 'viqsnukubhjiiircppsodqxidpsixsfrefh'
- ClassName: 'zxfacaygbnpcpktpwfeyabofdktbigciwaqstvp' WindowName: 'xqnszruuvvcbmjajmfvhldiyanezqdrhntfokde'
- ClassName: 'ytybvtcmigjmxgwzufuhnfp' WindowName: 'teifmnpbjtbgiwvbmueu'
- ClassName: 'daxxfbhfczpxplfa' WindowName: 'ihafjlbkjqcodexarpwfsikzlfnidq'
- ClassName: 'jietkerzfjmzhxtbffyxmbqgfcbebcarws' WindowName: 'xdkathpmryiupfcoifloswntvhzqcg'
- ClassName: 'kvwbbztgqclzbkhtyunndqabkziepayhjqx' WindowName: 'ioiaooilgwmdhelofcibfuujvxrmhiqoanjz'
- ClassName: 'soohtuxkjqteppryalcffpwmfsaiw' WindowName: 'zgmpbprjvngrdtcxojtbtqiscdmqbyukpcwbusb'
- ClassName: 'ookawpnervrbyyrepanykt' WindowName: 'wmdfkqhrbiuihzebfrs'
- ClassName: 'glfkzeqprunggbavggxcycbtdendwbnjvvowtw' WindowName: 'mddlvufmbenzmpocwlkpwvgyoyqsshdxuh'
