Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'wkuuqontbjsdocyjktfugj' WindowName: 'uihyzobbcimjbbcwdrghsatgtauxvhcgih'
- ClassName: 'ulvozqzkxwuahsykjuoh' WindowName: 'qladehxikluzktafksijaiofbgfumsqjrp'
- ClassName: 'bvhtdjxuxyljbzvvgocsperleiekcoofmjnxj' WindowName: 'bphqatvzsjzevwlryupjgsjzdbnlssooylfwbu'
- ClassName: 'ocxbsmkcayerstr' WindowName: 'qryaekvwqdfrysinqarngqyshto'
- ClassName: 'zwrkooatdlaomiqcbmgrropzyysokz' WindowName: 'qrksphodbzeutzkizawoqbnppdrradwdae'
- ClassName: 'hxytiwmzvmeikfgzxrnyfzatyev' WindowName: 'nofepskcbcssptkolvrn'
- ClassName: 'vfkakxauadwqaiifghecq' WindowName: 'vhppiqforvwnvzmxdkrtajvnbbtnvsrjxsdwek'
- ClassName: 'kbpktyjtfcizgfuseohoslbvurrwdxumie' WindowName: 'slhkhtzfswwrphrabqcasgkanrxrjcli'
- ClassName: 'kyeztripgaybihjvnohd' WindowName: 'mqdimpmvjdrjwsqcfx'
- ClassName: 'spwyowqjobakzfsfhmoxeqxlbhhpoagdqeeatuo' WindowName: 'jpvgdmdrdxhlrmmqmpqmskd'
- ClassName: 'avhpmzmwyvcmghmwxvddddwye' WindowName: 'yzescykigcmbgyetcjvulxpagf'
- ClassName: 'yiqtalyjcanimclszxukqnuxnitjyje' WindowName: 'xttolnzdivoznzjnwtdchbsbmcabmbocxo'
- ClassName: 'xbihlqvkfsqukaztgepskebqszrdovnmaqro' WindowName: 'hvwpmvcoyhcczevshernbtc'
- ClassName: 'pitjzpjrdehzpmumxvnmydzqolzrtfixoufwg' WindowName: 'iahpnmdvcislennchxq'
- ClassName: 'haqwlkjzfnqyzswwmyud' WindowName: 'aqedpjettmofleuvamqxhdzlicpxvuzhsbub'
- ClassName: 'aedumxdcjtdsjwyusufcegcjgdkk' WindowName: 'zfciedvxoxloqelhjbdxutsyvfcn'
- ClassName: 'aoidhyfhxieusyefzccdqxtdx' WindowName: 'jrckliodhyfemhmzkeflnwu'
- ClassName: 'atalzjjbuozwocicxyqqytoljypiaaxfd' WindowName: 'rsqkvsrhbysxuovlaxndcqzstibftglnqhaxbd'
- ClassName: 'gefarglbyyisptregezmwiuohofvj' WindowName: 'bypxrgkqjffohfyudkoioze'
- ClassName: 'vjwbnftarbhlgfxoaoacncjdpmkug' WindowName: 'ycirrzyqbabhduzhemwosnrdy'
- ClassName: 'cpawamfxlrntpjrhvaaphukek' WindowName: 'cdyswwametplatlnzsdlezjxirbuvkr'
- ClassName: 'dyfbydepxlyinlxty' WindowName: 'zemtbgujcfvjsqoszyumxvarsvtzulpygnewx'
- ClassName: 'grmpqduknrtiiegcpsnsssgmlzlhixzjqi' WindowName: 'hvotqqkelsjauhxsfw'
- ClassName: 'fqkcuzteebwfokrehln' WindowName: 'osrkrqkuedhsowfpbgnmbxwycokwapnzghisic'
- ClassName: 'pisqslcgruoztwqegxjwazkfu' WindowName: 'jxuzpprszgylhoiq'
- ClassName: 'leawqvskbxdbmjrbxdkenlndtfdazn' WindowName: 'ydmwpvojcniqrkzsqtkp'
- ClassName: 'yksfxedhimpydeujgtqkmnzrsqlzmft' WindowName: 'gkqnnjhxncypcmifztpltjkgkfxkbjazatlbb'
- ClassName: 'tdgvxsijbspxozxwbcpyakjqhewlcrvxdz' WindowName: 'sjiyfxbkzuishqhxjtzm'
- ClassName: 'phpwysxpimdglgopmtxblnkqrtigtuzwgow' WindowName: 'srhuwrcqjxbvzacnckebqjwwwnajfg'
- ClassName: 'pbvwvhwvnynuafuknkwveifbcphcgo' WindowName: 'muzvcenhswwvirrthhveubcpvhkiorytfuomt'
- ClassName: 'hmxcawojgpfxbeipjankcvgfmtjjggyuwqub' WindowName: 'wkltzvshqlrlvzdhs'
- ClassName: 'whouwclpfojmcqtyofwuqargeyrtoqf' WindowName: 'ljdrrrbnhqbhliqbjwqkouk'
- ClassName: 'hrmgfjzaqcyizyxbwxyvxwxpxkskbkx' WindowName: 'ipcqjschutqoihlearpkfgnr'
- ClassName: 'uiykxmspyrdfzrssbqrobxbxpjonkvtkmftw' WindowName: 'yfklxdxqtfilfhh'
- ClassName: 'ojmyanmmssbrbvebxlu' WindowName: 'aihmyrrxgjuerwwopoafxbocj'
