Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
- %TEMP%\nsw2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\NSISdl.dll
- %TEMP%\nsw2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'brwlpfutepchkthkmndoypfa' WindowName: 'fvmtnqlqbchdfgsatdnehimxpjswdj'
- ClassName: 'sledcteuujznoqggnvpockecrmqttkfbr' WindowName: 'brcbcyersdznxnoeqlnvdpopujufrfybpxwuc'
- ClassName: 'jnuasmpzhzbldussnv' WindowName: 'iycmrstdyatyhjpuvnf'
- ClassName: 'knltoioplvrvuxkodwkwhzannizvfsyxpdtjdyy' WindowName: 'obmtgschsomcsaies'
- ClassName: 'rxtqqwplrmipimojogpwpo' WindowName: 'dgykayokshbafewx'
- ClassName: 'yzbcqzfqipyghorcojhigexmvsnysrqxmzvl' WindowName: 'orkrowjkyiftfoakypaiaexsthifxyjve'
- ClassName: 'fkjixufxrukzjfttbetnajouzvawfyaujry' WindowName: 'fmzoimbxytdyquxypvkuazo'
- ClassName: 'wjbqnlqrrdwpgqzjjoptmsewyzaskevmmmdr' WindowName: 'xvuypxxdoaeboivxcddexufmsjoffnzpavquib'
- ClassName: 'biamrayuymgkmlktqucg' WindowName: 'lyluxsoyxgpqkipudqkqfycepjmeyxygw'
- ClassName: 'uoiejzrnpjsdnyydywdzbqxnczf' WindowName: 'pmtlvferluebwrnyclcvzl'
- ClassName: 'gpvxvaxymfhbstkyfkccqcaeakbmkleovtomicv' WindowName: 'vylqzssogqdblobadujmeneeio'
- ClassName: 'qkrpyqcknkzvximbkrbiaojxoezfwwnkt' WindowName: 'ktlodcfnkooizrishrviaititlxinu'
- ClassName: 'xasahghmggeyyfpkbmajgmgoka' WindowName: 'ijrnxcnwcquweexkfvltnnnl'
- ClassName: 'vwdoaflkvexotlnbbk' WindowName: 'ibdgmhyzlbxtmoq'
- ClassName: 'wojndqmmuqmhqvnofwfphh' WindowName: 'bpgqefgqcnlrqpglhdyhny'
- ClassName: 'wxukplefkpkyoskpeaivagqjnwplffjaroe' WindowName: 'puwaxwdgtgrcwvcztubikuwsvod'
- ClassName: 'cgqavywyawlouukobpqiyaakddir' WindowName: 'vqhmxdzikoexeyykxkmtlrghaymsoulybxtf'
- ClassName: 'clvjdstrzrdofzwntupbjllpaqjemwtxghgghjm' WindowName: 'dnbkhrbugbpajckzhzwleaa'
- ClassName: 'smlrktboagtgqiovlycsscbfteypj' WindowName: 'usrycykybbowpoacjbscjvnjsllvuyk'
- ClassName: 'strmvrczbviriplpogxxmotigbuz' WindowName: 'dkhtdpkiuiamfekrl'
- ClassName: 'dajzjdlrazecokgwxlutrqzibnhjiuwxdqvdyyw' WindowName: 'zakgoelkgbczlbjtjtdmzaptcmcnsqjhtabxbmd'
- ClassName: 'dqdomubcyrdfbyeiypsdjotosinnbyue' WindowName: 'tnknjiovbpzdmzwaerjyklxlxudnklfnnxhhb'
- ClassName: 'hclamsmluuxqeurvorlbcuojptqibbg' WindowName: 'kpxxnuwvriarioeboeliqqh'
- ClassName: 'ybvdtxuauuhdsugvsmjzkroxplydtnxut' WindowName: 'imwtlddmqqfpdalupcdzwcyunslavehonavvfow'
- ClassName: 'yuwmfjrhelbwvhbzi' WindowName: 'dcuxezuzlltogpqze'
- ClassName: 'nnjtxlinzcsayefwkagcjynwbuuun' WindowName: 'zjgkxyrroscaaykg'
- ClassName: 'sihvuojzehwkxmawbetlzhsekchzrnicmilvftb' WindowName: 'smeatpbibebwemxbsffmbvxozjiydyijnwoyx'
- ClassName: 'jccteyyiaptrpsgwufsocmnffezjc' WindowName: 'daabcrpwdauwgsxobvvuqnunaei'
- ClassName: 'xigibdlthylcavgaaxniyjxzqibquqbmmlfabgb' WindowName: 'zcbinguryxitdiqdxkatrejbotflcgejhouyczv'
- ClassName: 'gcothsssrjaokjpgjno' WindowName: 'thiwiiyookeclopneaxaqvhti'
- ClassName: 'rymjgebbkzitciktmksfwfdrsjaeozwmhzz' WindowName: 'pzmrowuntlkinrqhgds'
- ClassName: 'rdywjgsifpynvogclhttepskrydopqsaoewdxps' WindowName: 'gnjqbgusqtxgxvekoppfvqizyskuulsnmvpxzo'
- ClassName: 'fumdykxyzhcgcjozeqyuscxngorjxvwsxocxz' WindowName: 'twoibxwnybnhrns'
- ClassName: 'xcrqpgpfduqzbizwxtmkkpgiiqn' WindowName: 'hbkgtvrkphqcdwinffcppntwh'
- ClassName: 'vhxspvmmmyiscqimbwxetgpprzpr' WindowName: 'nfwgmlubbjaukzwkrqsehgfqkvcucbhemgmk'
- ClassName: 'yfkpyysrganxbiddhxcopgkwmypyjnsemim' WindowName: 'pogtkbtnrpbytdemwyxiipuvtjbftosboohl'
- ClassName: 'ojlswwthfsgrjmzogkmnxcrfkys' WindowName: 'jnmlzeoqfskbtejaultbdo'
- ClassName: 'snaryqxctwiughpzmwrk' WindowName: 'ozaupsttjozjfixivfmqxujsmdwzdpzyuwen'
- ClassName: 'aihcekxlbnwdqljtsxdfwuyftkvzkeiz' WindowName: 'glxfousmjwjzoftzidwneq'
- ClassName: 'qciuzhokztazqfpzfbhzsuvvxbayg' WindowName: 'ruqjqudbnrdioxflimzvcopsjlwbwbwxxzkdvd'
- ClassName: 'rtbdxplnlfdaizzulensiwtyvyhvjjfne' WindowName: 'yjrxnhdxhekwebllu'
- ClassName: 'aqzwqvlwlndtkgcvblxksxmc' WindowName: 'tdqrgtasqnudsazpxckcrtzptjzgwfdshzoly'
