Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'reuatunayykslledyztdovxcfs' WindowName: 'hxckstglyrzbeqjl'
- ClassName: 'zmtgdyqrezjrggmuffoglvcrpepmsyzupnu' WindowName: 'ytkfxvfbyczuezklwzlddnpstnpaxihcw'
- ClassName: 'ghqmqselurswunqmkjnmuudfssmx' WindowName: 'cyfcvcsicprvdovmlzvbd'
- ClassName: 'fguivexcastezghctcedfpedqau' WindowName: 'mmdvzeaulqkbbtddrfvsofpspitti'
- ClassName: 'bkjtowedfdxrnkmsevnd' WindowName: 'nahmgmrutgzzhgnpghlpue'
- ClassName: 'uerwpzpjmebqnwdefbffkivaipuaikvcbcb' WindowName: 'cfvfomooajsvrpjevgnsfpzjwsirtasjcdza'
- ClassName: 'zvsaqdvnvheotyxatwwfskuioeigxeuwfznddu' WindowName: 'ffkosnwjkosxublrmnpuqckxdjfeu'
- ClassName: 'vuampqoqsjftsemqjafchcvjmu' WindowName: 'kpuiiovbzmozpbphufkgtkx'
- ClassName: 'hzsxmcsrfjlaxqm' WindowName: 'ejvxijldwboeedrmihzcpahn'
- ClassName: 'ffxbcsnpxsheuwrknmunok' WindowName: 'ntcpjeffphdoyybcvuwrxsvbuvogznibigg'
- ClassName: 'jocfpxwyoaftejnsfkmahmdurwjmbt' WindowName: 'pyotwdufbjjjctvadpqhumf'
- ClassName: 'ofjbqmbacvrncifjteyfapcoceaoddgi' WindowName: 'kchivpjvcvuawzwhivyclmwmycq'
- ClassName: 'yglzzbmtjtuelwcjtrvngntekenhcpdj' WindowName: 'vpkbxlyivqrltgnpqasacjvqipkmvkrhegvjdl'
- ClassName: 'abekeqbfurucgkdvozyfuqmqvuges' WindowName: 'hdlqdcczunjazjppm'
- ClassName: 'rrzfvktdrzswtafonkp' WindowName: 'hlgzivxkpqhbxcgjhdqrbslfiwpfkfuloykt'
- ClassName: 'gorqkybczjumbvgtz' WindowName: 'oyjxeqwqblhcwcfhdofveyoovkedrviy'
- ClassName: 'jkhitnadoxmfjolpsdjatvh' WindowName: 'oihfdibrjuaqsjgotuhtyadpvqwzdutguqsbixo'
- ClassName: 'pqpwxqphiddsnzzom' WindowName: 'iwamjripougkazvt'
- ClassName: 'injeypxohlptsjck' WindowName: 'vqhvgzmgyvfozmjl'
- ClassName: 'wanxszycgpognqdi' WindowName: 'yxyhuabxbpycybypooczec'
- ClassName: 'ogookrksfgonvsfj' WindowName: 'gidjwxxazlycfiloymbhituomyituaxom'
- ClassName: 'krdrpabxbivggeicrntqepz' WindowName: 'dkwondmnqeeevqv'
- ClassName: 'xvhckexijjvlqeuv' WindowName: 'nutqqnpzrzphusdchazpfdvttg'
- ClassName: 'reefoumdmxikagioudkuuyi' WindowName: 'xwkxiewbemivcpuirmtntofkejjthfh'
- ClassName: 'jomcwvoiponjnlpjl' WindowName: 'nxlfukqklniwvswguzcpjwirbdgfmbqsjzxkts'
- ClassName: 'mildikfbavxzeamvhbxkypubdk' WindowName: 'odikonxczwbytrarbfifwlaojeiv'
- ClassName: 'lpjoptygfpnsfzpsecdmninkxaqysaal' WindowName: 'oprlzumivaattttvfkumpli'
- ClassName: 'lkqkipnfmdnmtmjlikykbwdnydafnuhgke' WindowName: 'maezuoyhsslzdkaymxwsnvafixrbnaworyub'
- ClassName: 'rzlyeahoixouolnnxprniuwabaikaudpwsu' WindowName: 'lbynxzikfhifoluahrjtrkshini'
- ClassName: 'jucseqxlqwtfbrdwvsokhgdrmmfaaiah' WindowName: 'kfvwxjsycrzcoam'
- ClassName: 'dhpdowtgbfswraqetzycfl' WindowName: 'betzqrfbvcktvmvazgbvoppvgabgdiwzxxge'
- ClassName: 'hkasbtgzihkqssnf' WindowName: 'skyousdrzjlloqkchicgkrzgdquihw'
- ClassName: 'gktlpjooniswjfngpeozonzdxpdzwtmizmoxg' WindowName: 'ghwokwpngduioxp'
- ClassName: 'mblqyqqtwyszeuosypkoko' WindowName: 'ooonbvrmfsidfbpddodtjynltinzhadfiehgqaz'
- ClassName: 'jrlaspqwmupffhzrajwkipeu' WindowName: 'pfdohizhmxzidcyziqverfgizwrzrdnukndu'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'lyokkuxyzddvnekllqwhxsrqevxxvwlrikbeaz' WindowName: 'rgbbasavfzvtczmjfmapegjavolwnnxeizrqef'
- ClassName: 'mimdbqfwmucxqhfosxgrirvwsapvgdqhn' WindowName: 'jeonmjcxoclkiekutdrywbrecczizjyi'
- ClassName: 'esykmltxuvzukrkxcsmpqvokfqijimvspuvjpjv' WindowName: 'eqcxwgntkqqsnbaxolcafiehdfal'
- ClassName: 'obcbkgorjqyrtxt' WindowName: 'jndkggbhcmyyorwdnkvzynqzsvzcagnt'
- ClassName: 'nvfzsqyacjfsetlewsyspkazuomfznafkc' WindowName: 'ptfzdulfsduhwpriky'
