Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ktmvrpltukvjrxzwrkrklsoiarugckbgcrxik' WindowName: 'tvtudgwgutsprquauvwadtjikhuhlwybxth'
- ClassName: 'bpwxtefkubcbbtczel' WindowName: 'hosiylorzoaxpkjfcwdylxrluwzpeqkxs'
- ClassName: 'yyxsvgnehovwubuidplukfcvdqc' WindowName: 'bqqzuhqpnobvkrfdexokuqxado'
- ClassName: 'ouioivacimwlcusswy' WindowName: 'voixnasyqnnloupsqxcuupoibjmoiqcytsmpw'
- ClassName: 'wzpyborfnvdxvsideacq' WindowName: 'xrafcwikrggrktpwxmbonwmbyivqmf'
- ClassName: 'bksuilqsepiabxcda' WindowName: 'llnwcwgtdslnogusmvugm'
- ClassName: 'vnothhqjqaxnjmcctfiayobxgamotu' WindowName: 'yhbmmscqgenhwmoyhfd'
- ClassName: 'pampuoikxfyktoxpduxrvcaqnwgttmkqpgplsm' WindowName: 'fkawllknwrwxezmsmbkkaazoepvmstzfeyyre'
- ClassName: 'ntrrxvktnyodwbq' WindowName: 'ommmsqgqegfjktdnknmlijkuotakgwol'
- ClassName: 'gqhblcusijqjwdamdexrnktusz' WindowName: 'blvixqtttrhfbhxdierqfjrcjbo'
- ClassName: 'gvlxboayppbrtwucppnjjbw' WindowName: 'vdaesdqgdxgsgqaaqiravbc'
- ClassName: 'rwzpfgrbpbvpycvqy' WindowName: 'hxmwutwcxhwvvibkno'
- ClassName: 'ollvjultlhzczkbz' WindowName: 'rwzjxckyrhmolao'
- ClassName: 'ehqtonebptfvkrvfhsmateqngvnirarcd' WindowName: 'uuklnqtqvfvmynfbjnrqoswxppsj'
- ClassName: 'mutvhbotewvmxkhpxdfc' WindowName: 'ypznyoeilfenvrurzxkmwnnvksaxiwzyievigz'
- ClassName: 'npisxtdstoxbngpajqbgufdul' WindowName: 'pxxaqnkurgwqgntuovbjgvbk'
- ClassName: 'zsyiozaaqnhysmzeqjisiyceqivdcuwyzv' WindowName: 'lcketlxjvdyyypukuylme'
- ClassName: 'qhsiqsqhbccuvyqzz' WindowName: 'cgpdsjdgezvvanhuiqemtoorrjltew'
- ClassName: 'pgnqtdzjrmfyonirakgbyxvtishu' WindowName: 'roepekpdkmwrfjbamp'
- ClassName: 'mvjzouuflfnzkyqjrb' WindowName: 'wrjirjiwzmbecnxmcopcutycmbzp'
- ClassName: 'hnzqdbzfwxcszuzapafeyvdvefzpxdsm' WindowName: 'mfiimnkapjyouniagbumdwj'
- ClassName: 'xhotxmwcfztrhajlnsfemlahkxqu' WindowName: 'htdyhzmlpwwtmvuhlmwf'
- ClassName: 'lolatjyiqvnxgiqiagrl' WindowName: 'twjdpxvqtfnvyqfucumchezxatieoytdc'
- ClassName: 'qsrcxbgopnipenkgf' WindowName: 'puafwxyfggqklzzqdlzbfkrjif'
- ClassName: 'zhsecwiujdgdepstwtshloazsfzwkpfvth' WindowName: 'qtixawqiypikfbynfijisf'
- ClassName: 'utwyqwfqjyyczpvhfxnrdpdtcxegprbmi' WindowName: 'iqcqbyxevievkyt'
- ClassName: 'lyejacmmagvdlfwrogwnvynritgae' WindowName: 'jqylhsoluizlrdudabbbbse'
- ClassName: 'fvprvyfuxsrqigeieczxcxl' WindowName: 'sdjhmueyoyuuydb'
- ClassName: 'mkhiiqkhgireyazood' WindowName: 'zgxgnfkgibavirmbakvkjwwaeogwiqfy'
- ClassName: 'potxkxgzivstaexpjfxgqbsid' WindowName: 'htbfzlerezetreyflyauqshbys'
- ClassName: 'hlstzirklsxanqhajmvgulbayoapcobig' WindowName: 'qrciovsllbmowitfsbaiuwcjjyltvdgqxhp'
- ClassName: 'agrgkufzdmkmjfso' WindowName: 'zofwqovztccpbfq'
- ClassName: 'uhwaosusylxppxcekvvbemuzxliyauh' WindowName: 'irbffgwizlibruiplyrpzdngijeqnflqujurzrq'
- ClassName: 'tobttmucfplmcttpeprbncxo' WindowName: 'mkwfchqyvgwpplsprscjeogsbrvb'
- ClassName: 'efgpzmyziqbmhdfkckzbv' WindowName: 'kbneacqzaqpwlwmj'
- ClassName: 'yfiqncvomvcelbkwbuonilaafafncsvdzpq' WindowName: 'mfyfuxtwzhqbalvywxkavptcbfnsxskg'
- ClassName: 'tjjfmoazsykthvpmerkszlcj' WindowName: 'eepkgqwcfrbqjpxweytjkwqvsvssttbktzerj'
- ClassName: 'jcnbsnjdnvqbwyjfrwiskqpcrteu' WindowName: 'jubtbbtzpxxkqfsxkaegtgpbkltrowvbbdkk'
- ClassName: 'gcvovcmfafqbsuhaxcnbvu' WindowName: 'rufngsgcfgcqgntoawcumk'
- ClassName: 'krzqhgnakqxtsoyxchkncfri' WindowName: 'xndwalmsccubmcopnjgwzepxwfpigzbkfpkbaio'
- ClassName: 'eqyeicrwmzidibmebsxawydgcepfpqdl' WindowName: 'jbruotjfixpdnuljgajehlozaegiprr'
- ClassName: 'yqdcdemfebzldjp' WindowName: 'znajwtayckpitaiqaleqrfrivansi'
