Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- <SYSTEM32>\PerfStringBackup.TMP
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'nmznrnktonrhrfuibenlivfqkoksuayufwobyy' WindowName: 'twvgnpjwovlokojrhslzigjzdjdshkbf'
- ClassName: 'wkfzgstkitvdhdzrlabcrk' WindowName: 'vlpvkjmbnammwfhysmzzjiwpccrg'
- ClassName: 'swdlrfbonqlsuxlmxrnrmjenaov' WindowName: 'lqzcumjfhfxnvmydkvhqufc'
- ClassName: 'qphhbjykqqhkytyhkzqsszzqwkykg' WindowName: 'iwirvejdxgghqhmzutwqxhsdvavtbekk'
- ClassName: 'jzieiqmnacplnuphb' WindowName: 'fpjushpppkqdkvxoej'
- ClassName: 'hkvpgvrnhdxxena' WindowName: 'fgjtrbrphaybhlj'
- ClassName: 'zldtyfvqyvfrlrbnerrypposy' WindowName: 'fjnsdwdmqnsbylku'
- ClassName: 'yxingknohszhggamqtbbsysbazx' WindowName: 'klzhjpzoucmhqaguqeblhbnreqfwlg'
- ClassName: 'blczpittpwiokqxisviyiebuhaahsnq' WindowName: 'flohkpyhglaupkierzmkafzfd'
- ClassName: 'cjhsprfkacqaexg' WindowName: 'keznbamksgmljeyirmsykpamxiobmvfzoz'
- ClassName: 'jkqxnisilwqwpyrxruzfdnamcwc' WindowName: 'hsmkwoinswszmfztdzhgaaelzpp'
- ClassName: 'pujmgavyavuehkcmhwrvdbka' WindowName: 'monbtdzettvhmgenccrymcgkvjfxgxmllek'
- ClassName: 'raiipkfunzusemceyjtqivwbqwaltwzz' WindowName: 'fkrsftbpulmcjxywtboehaxinqavrajz'
- ClassName: 'zixijnpdjfttprxxmzhyvovmciddgf' WindowName: 'mlfqxqwuffjgouonjxaj'
- ClassName: 'wnobsekiuylufevrpsnklyxqst' WindowName: 'kifrxlipsnnfvzfmguohhkbf'
- ClassName: 'lbtddvoyoeyvoxib' WindowName: 'xfutfucfabmuqdzxrcayswgbbwfbinxkzmziwpm'
- ClassName: 'xqpgduzhiwiuhfwsxwrjo' WindowName: 'wuidlcrruyjhyjevnczorenrlsfhxgkpagwry'
- ClassName: 'uiokezlaneauwwxyahzzz' WindowName: 'kocnwijhszgqjhexlwpqpknvtcef'
- ClassName: 'uxysjbkwrpxcwjvhjuhakiasevbsyujxq' WindowName: 'hyqqmpdvakxuhmg'
- ClassName: 'nhlxkqdcxyviqosphhusnm' WindowName: 'icuenrkoknkiiebq'
- ClassName: 'yudfrmjyebcddgnbdjxuvffwabbeevzpsz' WindowName: 'ocynpakjzaotiqupiiewst'
- ClassName: 'iwvrjpafmvprkawqlxwwyerlzmzhbjjtn' WindowName: 'njwfgplfpiuxerviaawyugwwvbggaoscki'
- ClassName: 'orxvtdlpbnfzzpoplvfaqknqlfoyipujxwaf' WindowName: 'vnhafujygbwxztrxcgwxkajmgw'
- ClassName: 'exrjkmlyumskgzidwzmfzxfzsnt' WindowName: 'qmvwuiclzullpxabqltxqtlmruxxemermayrsch'
- ClassName: 'vdvslngeotmwyfmvxhgxtxvkp' WindowName: 'sprvlpmfvyuuxnphrlujbddoajfpa'
- ClassName: 'qrdzuizuwlbiwhzhmgi' WindowName: 'szszfbvtrtecdrozdxvstcej'
- ClassName: 'pxihwzmaaicvrerqgyttxwgurgnzmvtcrplw' WindowName: 'jylfmftikqysqtleshiwfdk'
- ClassName: 'dbttgmmhtnuhlchyjjwzhkrohvdnvlrgiasefja' WindowName: 'grghopzgbixmceshybfjoxouavwxv'
- ClassName: 'ozmllgldzqtcdvwnknmdrerhvqnbb' WindowName: 'oxchbdzzyunyzjdufkbblwcmhjoezrejn'
- ClassName: 'txwgzulwnqcszwukosnjaltszvkzcmjxccupej' WindowName: 'tocjikdjmjajxasrixijf'
- ClassName: 'hfwbxduzdufulfcvvodusylgmnbsvitcievn' WindowName: 'bhetimduuloupfunoze'
- ClassName: 'pucuawtijxekymp' WindowName: 'oxguhprvywltwbfbeoqbxmtkmllitrweewmtzem'
- ClassName: 'oreojhtvnykhsfapksu' WindowName: 'tepndlmsayllmfgnvwpxqaeecaibk'
- ClassName: 'lkgrrtlcugbhdpobvjhejpnffvuyl' WindowName: 'kpsumjbvagljwmuzekjdebinljadjsgpy'
- ClassName: 'upgnsvsmjonkjzjqgeooytiimeglh' WindowName: 'uvamjzbalqjpsgwlkdadzorxbxy'
- ClassName: 'ankftgaybknbilc' WindowName: 'nerercmcnmufdpqjlrj'
- ClassName: 'qzrsoapmwozqbhayqlebigppnhevzwazgiznxl' WindowName: 'ljeyzidsjjzqtbfugncgmvi'
- ClassName: 'ofpnvzmfyskmnpmgsymagibtch' WindowName: 'tsgeymzlzpbefchummwobosbai'
- ClassName: 'aqvnhfytpslzhwbfdfdwucyiaozwniaeabck' WindowName: 'nkdqvopmaylhvjbtzlgxjgkbyxufw'
