Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dcyqhilkcefaeepombiqyczbswmoyfxiztz' WindowName: 'ankuqlxrjzbomlbrxbyejiun'
- ClassName: 'tuojxxyqkafvrellm' WindowName: 'bnbtlukdvosxeipqtlhrkwqntvqtinzonssk'
- ClassName: 'zbrxzsskzkirmqhxinjbamenia' WindowName: 'ydrmypjlqukalljxnucaveazfahdajcr'
- ClassName: 'wysaqulukjdsfbb' WindowName: 'qstekwaptkunrqavcbtuwwecrbukuyztva'
- ClassName: 'ybqearxrxmcpwyuwwbmrpvwujjgzergjemzoih' WindowName: 'xqbczuwwfumbnbytctibvredxankqhtnsycjex'
- ClassName: 'mfiiqrfaykuajgehsmezhckfbuineqtzqpxatc' WindowName: 'wyuiksdzddyoyjpwninmxinwhwuqow'
- ClassName: 'vlydblapzuqcbrjlxw' WindowName: 'kktwzazyinnyjkujc'
- ClassName: 'enhidjyjnieocsdbppvlkulwiygqvfjcrbkrc' WindowName: 'fhwcphuwvbqegxmwtjsfbm'
- ClassName: 'ezbqxtcjfzrrkgqzynryezgogcumrszvmmm' WindowName: 'siacmcaeegoxnvskzhsu'
- ClassName: 'yvvifvkscymxyhevgvenh' WindowName: 'jwbmkkqjanbddugdvj'
- ClassName: 'rvosyisnobhxzjlkpdmwgskpeha' WindowName: 'xprlszlsdsvezwtwvbwpugdmzrgeeiqpupp'
- ClassName: 'ltzimjottsmguwacdbnwj' WindowName: 'dadqrrnrrcidyqms'
- ClassName: 'mhwmujgaenucloybdrmloldonom' WindowName: 'kjmahodmxbaxnpbdmlsk'
- ClassName: 'flsfkttpqgczpiklomkfsdtpibunillx' WindowName: 'ywqbfuauswmjflrtrugv'
- ClassName: 'ssszjrfqxjbfkvofdm' WindowName: 'wjuftbbtgjchuqbeqocwyv'
- ClassName: 'yvmrumlwppqhavmshcsvxfutk' WindowName: 'garkvibmksfhvzeltxqptfwmahtbvn'
- ClassName: 'fuzufhpkrbkowqhfrnldva' WindowName: 'blictkpblnruvxecyz'
- ClassName: 'zkjqdikaabhqhglyjurlsdaxnzjungm' WindowName: 'zxwpqqhkfvlsioueszllifabcombn'
- ClassName: 'lgfqqqempkyavbmgzfzwwohlkaaixbeyq' WindowName: 'uggtkldpijttkloowhmjghjbhngdzvncjt'
- ClassName: 'pcjeczopfdcwgpbnwclzfuiwaweoxvgbhnayao' WindowName: 'wpobftxrvfnymuergbxnjiacbvkyqamvj'
- ClassName: 'gxhdcakhotayjjsnlcrckqmegjzilavkaeeyqgw' WindowName: 'ltyenfxxzlfhswvnjerkerwfgujpjrttkyothew'
- ClassName: 'zqsuwjcocxdjeypgsybwjkphagyyr' WindowName: 'htnotglaxgzlzknzjnvmapelqdgfmawrpspiqec'
- ClassName: 'mhjqizeknzgjbuyemyctrdswpyxwiu' WindowName: 'itubbsuyokynscaixgf'
- ClassName: 'schqdbtbxjfxjducwjhxsosjf' WindowName: 'kdnkymdncbeaqsboltbqcor'
- ClassName: 'fvslgwcluczgbsqwarcgngrcjqklllsv' WindowName: 'zezpzvoqfqffjbacmjdawbaevpaqg'
- ClassName: 'nlwsymenefswvofozndttddcpydgtknlpl' WindowName: 'xhaueouzulzddvuyknmvsm'
- ClassName: 'ejodalazndostqqsfcuqplopfxvgnq' WindowName: 'fdcjzweiniplohrmlsmdvtifbxccnodrwfk'
- ClassName: 'dleewzsqeliggiltrkpfcqhdsjpvwtii' WindowName: 'kglqtchugnahkryrwou'
- ClassName: 'mcvrsiganqbydpnogjlgqaydzgfifeabopclg' WindowName: 'xwjyjkmbqdujsnzxzclkplafglloyjknwciie'
- ClassName: 'pzspaldazxukirloxhjgfnfvnumwco' WindowName: 'zitvfpsmzhdaqsqedednqpoiwztlwekxwfvji'
- ClassName: 'bkqewxpqzgrufkyfdauoinumeeqphfdiudhshvv' WindowName: 'mxftwvpldgexuyhvgjyxvbpenh'
- ClassName: 'xsitiaxiltnkraznkqb' WindowName: 'qwyudiutpbmcagjsralkfrmpstengcvqizkza'
- ClassName: 'emrvnjbscpokrzd' WindowName: 'ccrvwkyavefnkdgidckg'
- ClassName: 'nwwamwkooqwqpzrtonaqhi' WindowName: 'kdyyjzqlspadjmgrixjqynlonma'
- ClassName: 'ymptrjrzrnevpxwhoqahydrtayomxeodr' WindowName: 'voljkzbuxsvdxrqlcvoddzwn'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'davblzzbqvduclndyhdjbjzcrtbfnslxitbxgut' WindowName: 'vswwhxotrroamrsddiyqlyqnvpwfteobazhk'
- ClassName: 'cwgaahuhazxwagbobsvxkmklawmxytudyc' WindowName: 'zkodsuzkdmlqajbalancubls'
- ClassName: 'omtfkmtkrodifdrqfpkwnpcnidelkaa' WindowName: 'bwmssrirgnglmxos'
- ClassName: 'lmtoyqhoxpggpdcnmbyyxfzfhffdayb' WindowName: 'axboumgltlsfzoxdknoqujuj'
- ClassName: 'toppsrkjjgdqsapajhdush' WindowName: 'cjbcrzwjeesahnsmtwcv'
- ClassName: 'fmohuiwelbkwgythnvzuasv' WindowName: 'ycxqieulmrgopoymcrxbpswshkapjztguqdlfj'
- ClassName: 'oozfrjeuiktflsazijs' WindowName: 'ilookcnylxyxzqlm'
