Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'pxchevuajcfmxgelmmgqvdyku' WindowName: 'dixqckolhympacgvsmotbuhfrapku'
- ClassName: 'jrrytetbdilvngqejjzdayhbwyywccrdzqtrkx' WindowName: 'eswvulxfyegjvusqvwqsobpmyedcfhpniu'
- ClassName: 'yvaoqmtjhzojyll' WindowName: 'llyeqgmotdpxiviypgmfcrcvmtzghw'
- ClassName: 'ogzgbrcgaribivgjhxoamoeos' WindowName: 'cvemljnfxrtabpdjcsmwnodbtgrluevdvrde'
- ClassName: 'fueypmymzbpubkwwotnyhymhk' WindowName: 'dgnxdxjixrdopdkjk'
- ClassName: 'zidbqegotmumznuxcgvn' WindowName: 'vyypznqfzkdducsa'
- ClassName: 'bfurcreozxuougfrtueiluinbwmoawemvthoqty' WindowName: 'ypxtdrdfqbkkrpev'
- ClassName: 'ibyyksuncqtlgeebxpwmyhrmhbdohijfinj' WindowName: 'rjtxloxmduzmowhkez'
- ClassName: 'gkssodtivbaantt' WindowName: 'eqsgftjejlkqpcixrbfhklgorgvnzdsxy'
- ClassName: 'makygqplwadblzvrzhnzmjtmxhlfs' WindowName: 'ujxmeyfcfoqgyotlsuodwwztkpfitcl'
- ClassName: 'lsesjpqlhwhjxiymdud' WindowName: 'rnvvyhthpksegymruaudkxxellmhmyaekb'
- ClassName: 'ysouyktzupcjbptmrutbfixzj' WindowName: 'jpwvqvhvtkxsttdettzqxkm'
- ClassName: 'rkcjdqyneyaknkcfmcbnsjcqdbx' WindowName: 'attekinggunlzhurkavnil'
- ClassName: 'ovahcdclhsqnmgtmmmgbgkudhhqxbjil' WindowName: 'qszemsyudbqhultaonqqwytzfyletpnkrr'
- ClassName: 'ztwfleqigfkwawr' WindowName: 'ckxpxdbpqzvxblrhbpicatyuhe'
- ClassName: 'wxkjbcfvycleegcyajbwbkrcuv' WindowName: 'agtvfzswtgwgcowvlgadhlmwag'
- ClassName: 'rcohexvvmcvcijxwowamlhyxvwgguxdtglxjj' WindowName: 'ltwrnwqgzxbqztcgmtefbgzfc'
- ClassName: 'jsvrirhyklfphypwfssjacjhskhwfib' WindowName: 'btcdlanjhflhvnopvmelcdcvfwckilqpx'
- ClassName: 'oughmczmqpmnngtnumnflmwighfdoothb' WindowName: 'egjqdogoozuhpzezttmljxzmtgvhngpmtbtmk'
- ClassName: 'gjrsiujvprhuptgpemoqsjq' WindowName: 'gewbqnbfufufxcrphedtaqnybrhotnuiiutoufo'
- ClassName: 'ninlbcgbyuqtzeqmqisxjenvoyoecjtth' WindowName: 'btceykieodishppknygebbwphvxdpd'
- ClassName: 'ohvzytehmtxxghb' WindowName: 'lcqjzchfumxripxrgnaedm'
- ClassName: 'odijpmcdtarhmyjokdgqotrqetn' WindowName: 'mmlxroexkfwrclxkdenwamjyhvzdoxtwsuyxva'
- ClassName: 'lvzoxxcxvagljtgtnoh' WindowName: 'dgbbrgwokiugklt'
- ClassName: 'yoraqephngyircqudqcqi' WindowName: 'dhyjmotccoxvxihcmykseedpddyywoytpojiir'
- ClassName: 'qmntwmrxncrtxvyjcweisbjrlnjnujmzojoh' WindowName: 'gstvcanzngmykfxtglcjcwpcrriem'
- ClassName: 'zytoeqeqlbhzqmevxl' WindowName: 'nikxckqqjfmsmsail'
- ClassName: 'abyypsbsmtjznxkdsuqzubmvjodlsfvv' WindowName: 'lhuorhtxdmdqiatmocgyhqmhqxejyl'
- ClassName: 'ozuezxrnwwbupkkpxzd' WindowName: 'fbyzlvibpwsxijjheperrbhmz'
- ClassName: 'gzbjbmwzsfnnqyisffnylovqeruoxubjy' WindowName: 'dvwntbwdjsohqlbtcobhi'
- ClassName: 'smeoijllezfuayu' WindowName: 'cphsnbufrmxeviytxtrctknozwbfaggxkwoc'
- ClassName: 'qesumryjzcjfpvwvrxjspxukytjanj' WindowName: 'xkowioqicpkxocqfjzncd'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'udjckbqhiaolwyt' WindowName: 'ptowrbjeslvivgsrzlgnqvopgq'
- ClassName: 'kqrqehvpfazrwkorpibjplvxsxujurlvw' WindowName: 'htosrokhrarknpymmmmf'
- ClassName: 'ayiqqkmnfixrchpusfhgygtpxnrowmzlcsnp' WindowName: 'sxjjtpbyvdbaqhyqtkycndpjgrhffy'
- ClassName: 'xhcrtdksloutzmikhvmipnxlzce' WindowName: 'avctqlphwnvblbvtdct'
- ClassName: 'bkxvzfeoxhzjpssbahjl' WindowName: 'saumfovyurgpgwfzyyptekqqqjqjpdo'
