Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hzgeekmeeqbhuexjdluxywkiztee' WindowName: 'hkkkzdauzqaoafrmsbs'
- ClassName: 'gnolkanvrdphwlyjopdhorslzldqenbkotd' WindowName: 'wwtciyklirnyxmchgniltoeehlljatb'
- ClassName: 'rtfozuvmhtheucdywm' WindowName: 'oeobentqmowsiwwggbbslsbsffdzx'
- ClassName: 'ftejlwzgtydngwe' WindowName: 'xflgqwfnfpvylaxxnxdexcqixvowoftdk'
- ClassName: 'prhfyeuaehkznmwzjwckdbkksdkdrccgyakh' WindowName: 'mglzewrxuguetekmbjafb'
- ClassName: 'fkhduxojqwpgsudwrwuuvgqsomfyeamvujs' WindowName: 'xnzmzstxrlmmqfyvtflncsnwtpbzirvby'
- ClassName: 'wykidbbvwscymkgyjenwylsknhgin' WindowName: 'poknkseyrczlyuucpsukazp'
- ClassName: 'ihyuyzakjwycntszvomkiaalivuhjmjaw' WindowName: 'geutbeutjkuesvjldyvnlfbjlhdwyisx'
- ClassName: 'kjjoacankoffgnuqjo' WindowName: 'ngtclbxpxxyjedyrtbglppxjxudeunm'
- ClassName: 'wqzszybmfrcfkjlifkafjzamfdfzg' WindowName: 'lhwqlmdrmocexgipuebpsr'
- ClassName: 'eepantqpncgsxsjwgxmdlybbbooxrostcescqg' WindowName: 'xxclvyuxruecidckwukpcroktgbrxqptaxty'
- ClassName: 'thngjnabdctjrkbugnknbcfeltr' WindowName: 'lfpmnzytcfjsdvjuyarrkhvczoiolqoc'
- ClassName: 'vzorftmbzqpdtcylank' WindowName: 'etzewhryobzlpgsryapkofswjskcslleyp'
- ClassName: 'dlokpiktxxwkvsxkekbzmhqkstaohzjqeykwjmr' WindowName: 'trnrjdehtucvkjityjxgwsgwqyeywbhhstw'
- ClassName: 'uzsmkscoeggdtbjugxviavvxnefnaexkcespvpo' WindowName: 'oajdjoqhqmgcrhsptjbxglzbfhb'
- ClassName: 'qriegqswbkiiciubmtgeofbt' WindowName: 'scdosonvimklhhqswektuzjvwgiilgdihgkcf'
- ClassName: 'ypitqcvpksxyqfcmmgqo' WindowName: 'ckbvustcoubsvcwaddjwudoltsgym'
- ClassName: 'mxzuoqawnzdkxcscqujfophsjmepzsqbshlgw' WindowName: 'klkhjydwrqsayapqxwrubwwgqckxdcmzmsb'
- ClassName: 'afdjgxprkfisvykkrcripmrbcuncxz' WindowName: 'ehapcpgbkfqhubi'
- ClassName: 'frpakqixltjoqvqgotykd' WindowName: 'lgnmtwjxhvszujrqxjomxkkhxvzgcdziqn'
- ClassName: 'qislxzufeqnvbbphdpechmembxetysfcgv' WindowName: 'mjbxxflpycvuvvtmafuedsmhhmzasm'
- ClassName: 'gurzgooqwoqntenbcrvtuxomuqdelteizc' WindowName: 'eczyyzhujoveawmjivagfzbzrlblckpsk'
- ClassName: 'xhfrwuintpiaapsdggmekxnsqpjsgwehvunaoih' WindowName: 'oadkppnbogqrpaqwqgofoklgaviaxgap'
- ClassName: 'wjnkfevtalbuhrves' WindowName: 'mxkeivezovlltvblalbnrkjijbpawdoensdqvz'
- ClassName: 'hxffrddkckohliikpozzz' WindowName: 'ztjhrkerrimyxhavpaamodypqgnxletm'
- ClassName: 'nwmxdkxncwbtykaaqjpi' WindowName: 'mbwaeyyjatrdzajvskbnazcbrusneu'
- ClassName: 'ttaywdxqsgcsislhydefxkgians' WindowName: 'toicwtnoopyfonbtrxvvzrlqyqgfmaukweohym'
- ClassName: 'gbntltlxovtfmyqewiodorjottkglrndbwhqa' WindowName: 'mwkwfnjttoebukyipntqgefulnx'
- ClassName: 'yddzdlyzdnzycqgeqcffjkt' WindowName: 'wtpqeqhwetvohmjqg'
- ClassName: 'vmkdhlalhbkelxmizkdibtojhfipqgenlhuxggj' WindowName: 'yppkpltsuawowzrtaoyv'
- ClassName: 'lhrozypxfkupolkihplrphfpisereqvfsiirt' WindowName: 'rcidbnxyleepcovdehcfbpswli'
- ClassName: 'yqfkmcbvwixnypynpmlyzk' WindowName: 'rxoqrkbzieiejdtctbnectuhwx'
- ClassName: 'cgbtjsvzneuiitwfekeqjrvgfqwn' WindowName: 'rkqbneprsmxfyzllvadgqw'
- ClassName: 'scculmbewayiscffksydqdurdfrz' WindowName: 'shimhaxbllbqpuiilkiq'
- ClassName: 'tmqhbvsmzlqhmbtaljcvc' WindowName: 'fjqpefewymjewbzrgzugbpasijt'
- ClassName: 'lhnbqdowepivnrlj' WindowName: 'ieblevifppzyadnwcaplpsnjw'
- ClassName: 'kigkmeplpjsoyyrroyzzotnabvuvp' WindowName: 'nwucxarunexeqnweaaqrpuivhqoptrk'
- ClassName: 'fzbhacpmdsgqbylhwrhjripkjzwkwmwiakwdn' WindowName: 'htftsfnewnwnahszpda'
- ClassName: 'uopcuawqxkpeobivuftonpomrkbyw' WindowName: 'ffptzkgyzeyqqzxowwswttwje'
- ClassName: 'tzijpstwnlaeobeyvslhxs' WindowName: 'avljeypinhleoxqmiximuyicoafkvncxdmmu'
- ClassName: 'gibuezbfusvwxpruayg' WindowName: 'rlibzvntwraqyekymkpwqtkkyfgszn'
- ClassName: 'fsxgbbblfkycfdqhtnofndijfogawflwusmwyrv' WindowName: 'wxffydtoxywrekywunlkgvsxcmzejm'
