Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'esqiaqlayaaidbrbeqbk' WindowName: 'iyacsjdfzscbxvpjjrwsyzeyrnkophxj'
- ClassName: 'zysuxgdkivmlqibqhxvw' WindowName: 'kgfwjzcijzfhuhewnwbwu'
- ClassName: 'abqlfejeruqjzydynkfawdrf' WindowName: 'tbiscfxcgurxxnbn'
- ClassName: 'umcjbxssvylvozumwqawbejct' WindowName: 'dmibhuwejnkhhoupmypbjpgjlellypnu'
- ClassName: 'jpilkbmvfalyuxoqledeplvyta' WindowName: 'wvrhchomjmumhxuvb'
- ClassName: 'gnkstucmkmmehjnojdikjxybxwxmn' WindowName: 'gjzrsllvsjgocggxgexxekezpd'
- ClassName: 'blphmyichuhbminngybhgqaf' WindowName: 'iozxtwwdandbhgylhccuubdlmj'
- ClassName: 'hzhprtgqealwliykdmhvuyzwewdcbh' WindowName: 'bycnjzmbndvkqtyldlopeicziglcfsx'
- ClassName: 'klxsijgokxlmeprmlmbjdwzxkfmxj' WindowName: 'sqhwrfbfxssofohidwletcf'
- ClassName: 'jsqmiqgfarhygrlvbskchreozomocdhaeahaw' WindowName: 'vkwskosaqcwjdvszhamlhfzcvv'
- ClassName: 'yotdukjyxsoztlxolrcek' WindowName: 'mbnsfkbdckrepysqpkredjqltpqskc'
- ClassName: 'hmexiouypxypqfmxlrkrjoaqfysyhha' WindowName: 'gwsjfpylsvoumsbyt'
- ClassName: 'fdsytgubqanglysrkqfvfnhpbzjzvnkalyafj' WindowName: 'ihbhgszburzkdmqkzznvngyl'
- ClassName: 'swjsawuxqolsxcixlhv' WindowName: 'glqcbxcdurgrrlhjdhgilkkc'
- ClassName: 'yrkvphgnhjwmgltrfwahbcrtvmljfk' WindowName: 'kndckjkzcjvfmxfhnddcsmhiqkurbtvaczetyoy'
- ClassName: 'odwzmymamlodelgvaed' WindowName: 'skputgnsipblwzgohyfwygvszqulmviiqdhdote'
- ClassName: 'jyfbqsikkjaosfdehhtnsgzzmhyvfnxiewkzcxe' WindowName: 'hwubnkmvafgcqcvgjpswgyhaffxlgdmxpr'
- ClassName: 'lylznihfdklknvgjmyqwnwibaxr' WindowName: 'jopbygjjxnrrfofjljopp'
- ClassName: 'cjulrhjondnxqtqmuxjpataabbvsxwnqdr' WindowName: 'jddaawjdspwlzyzzumfxvvwnazuicenjbjpif'
- ClassName: 'lhzreqxwkaarmyaiyljlobrcluh' WindowName: 'pgpgszkbzkfbqctkzlbomlhlario'
- ClassName: 'cgclxiqkthrmcawmvowmfinyhgdlzx' WindowName: 'wxoihnhkjdtgastefnqqilgrbfoes'
- ClassName: 'ivtzwrwbvbzxdkm' WindowName: 'kbnrabgxybscwscsziboljvmfzozx'
- ClassName: 'unxybvmihfdvfivgwrvijtwm' WindowName: 'txkdirenqzhkitfp'
- ClassName: 'yvbspaxlixdybwoopuvhftbchrdljsmifzt' WindowName: 'kkihkkskosinkwaiznmyei'
- ClassName: 'bbitlmdlirwtqpzghorjpwexbx' WindowName: 'pqgwoomwizpkvrl'
- ClassName: 'ykfvskebggshchrsarbardvaknbnlvzcvwnbjx' WindowName: 'bwcymekmerhfyqpivji'
- ClassName: 'djnaebbudlbbxwzidnftveohrnncajcysjnj' WindowName: 'jvtvnrwvxrytvvyqnfij'
- ClassName: 'pxwwsxgafqypdnjpmwlaltnjavvpx' WindowName: 'qlnkgjqzvniuqfdmcfckopobsbggpq'
- ClassName: 'njexvvzblomtplrwfyqg' WindowName: 'oocscmvinygcmjwykykgucbzdctswre'
- ClassName: 'dcceswhwckzddpclxz' WindowName: 'lnzzwluwrlndeyahgmr'
- ClassName: 'xmbbemozqztxqocmgkjuifdvuwwm' WindowName: 'hocqubrhrvaeicirgddetfabo'
- ClassName: 'voqfupinvjikhhgwkictgpkjfinyiyysxclrvsc' WindowName: 'ituhhcgczsnnqzgooxrsassphppgclkgpxxgtn'
- ClassName: 'ekkkaykxccjyaowespagxbxh' WindowName: 'yngtlfevaiskgewnzwglq'
- ClassName: 'fosauwqejxyqyavzcparlssfwx' WindowName: 'qrmgfwrhltfgsplovqz'
- ClassName: 'ijdtcnzmimcfipwieiuwle' WindowName: 'gmnsiusteyeatqaerxdjmrhrtkboaullanu'
- ClassName: 'omdgxfwbmldllnzommxtkoixonpjcs' WindowName: 'tolhfoluwgyidcmrvnlkrcwrpyann'
- ClassName: 'ouoegeavcxctlzzxbdqewzun' WindowName: 'wsucazfdzupksekmrnqxsaajvzc'
- ClassName: 'yolzeivamkmyfbmuxmsmltbehqkdtmrrm' WindowName: 'kxmavyzeqyqldkqpfkakjnqxxuhjwcmkjpgsd'
- ClassName: 'ipiooohswimeounqmd' WindowName: 'phdujonuomlwytkytkxazvftdvgat'
- ClassName: 'lvldmscbrjnirwectzzxijmmldkhuzbcf' WindowName: 'xchaborzzxlelph'
