Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'scjiphyljjhyrjpereypanhhk' WindowName: 'deuschembhvmwhxkwvi'
- ClassName: 'dgaazsdepmndiwnzfwyyjphkio' WindowName: 'lleuciabwqqmelovb'
- ClassName: 'vnzxdeqfdfxxtzqxhngkkillljnyujrksja' WindowName: 'liecndvnmftygbvugqjbweptj'
- ClassName: 'qzpcfmnrjdgkckubqflicmvcksuhqdoozbygi' WindowName: 'ybhmhbjxppyjvbrqrvamjcvdv'
- ClassName: 'cvsylwrfdecoltqhlnwckyblvlwgkzhrjuaysec' WindowName: 'crqqbcpvqfenadmilrewxggrgyspuvaste'
- ClassName: 'qhegxphifkhybxutcrxjkqwvuoxc' WindowName: 'deihiiycejbgpikhoztjwjwqjzgggsaibgylxj'
- ClassName: 'oabvkmmdjpibwklmdbdewfdyltsgamekcb' WindowName: 'wrycfpwfdykrkutxqihtwkbcju'
- ClassName: 'hiqmblynhrcixjqfwzjv' WindowName: 'uxmhtdnxdegmsigxnkmsjpg'
- ClassName: 'fmbqyymylxqkavqtndjlolewqxnzjxpyq' WindowName: 'onwnwowqcblgyaonn'
- ClassName: 'twveqvjqoejlhrzf' WindowName: 'bxxucgqkdadticvrsphidqxbosntqwwjoqgdes'
- ClassName: 'iaogwrqbmqcciwmfjkbqmamltdjhgqsgmk' WindowName: 'vqtwpqcdllxyenhhro'
- ClassName: 'tsacwskntnnmqqujzzhhyuyjvdrgt' WindowName: 'idcaquqaoqxfyocnuoskiwagaoq'
- ClassName: 'dvbgzmzajlpryjcjtgjjjqedkuzwezvzs' WindowName: 'zibsdzasrqlztsuuvtikqeaafayosae'
- ClassName: 'axjenvahewmxwztpfo' WindowName: 'creewixmcriichjwoppggcpqe'
- ClassName: 'ecpwwnqxaxjhplittmythatqalexs' WindowName: 'ombsqcaniqrougissgtojti'
- ClassName: 'ibamfruavronuxru' WindowName: 'yidudbigglpliwtgjiif'
- ClassName: 'ledzfepmgqhbrfinvwcmhjrxeygebjf' WindowName: 'abxuihozxvpipxpekbklfxcrryhcu'
- ClassName: 'qdpjhwcrjquemvziigruxnq' WindowName: 'uhttrvplibxiydtfmhyrueniyfln'
- ClassName: 'ewohmzlfsaggwefxymqghhkjho' WindowName: 'ruzojxeijjyocry'
- ClassName: 'ufzjxvsddwujyeklkbyt' WindowName: 'ufskeeevemxsuofrqn'
- ClassName: 'yqkdqvxkuhljjbdf' WindowName: 'clltfwudjmzdmebmicmm'
- ClassName: 'ieiriodohwbdspzogkdo' WindowName: 'tjkfqmivbiajqryvzxrf'
- ClassName: 'mbdpxqmaueuvyotyvowfphaenhiyqcweuyh' WindowName: 'wfsszwzquzpyyaqzwnbdfli'
- ClassName: 'wwcgswpxbkcejyzrsjxblcrquguidsayrjfmm' WindowName: 'uqvnvyptaglphmhwcvmtlrtpqbhogtdystqwb'
- ClassName: 'cgnbnzoapntcxtchxfxideased' WindowName: 'acdtnswfyqdhhhhlszs'
- ClassName: 'nrdandehsuhutntnfwfemifewdouuciaeydxg' WindowName: 'fmydkrhohhtwltdoejwhlehh'
- ClassName: 'nqybuyxxbccoxxezw' WindowName: 'jgkqfiihpmugejtyhmltkvwlihgrklfnleeb'
- ClassName: 'wdzmnbneajzpwyoxcc' WindowName: 'smmxvxpjzfktdhbolyiezhylccslko'
- ClassName: 'mibnyxkyxsggfapyuzctvonn' WindowName: 'fjnxyippxpoeljvikp'
- ClassName: 'svdobqopcqwwtwdtlqlxhouer' WindowName: 'ohfxqistplwbdbdktiaylh'
- ClassName: 'epdtryuvauikpjbepujzbocjfrbocqzfde' WindowName: 'gwseodjkherwdayxyobhckrmfemjjmwgjz'
- ClassName: 'ntnrfxudsdjrkgp' WindowName: 'uooxrvqsxwtlhlgirsrv'
- ClassName: 'skypdhwzqauedvlwsmcxcgpjkyqrus' WindowName: 'mfhbtwybdemoometzavze'
- ClassName: 'ojjkhruixxqvuklrlccqsorpdxjwoe' WindowName: 'dqcueqbegulwzktqdwdnenjbnogyjtpdxn'
- ClassName: 'vsrcoqlagngxhdvcghmotevagufzvuuickxvdet' WindowName: 'qtaqnuibsgeqtagoq'
- ClassName: 'acjudswwngniszcye' WindowName: 'ffiizkbzylufctgfasuumuxpfvo'
- ClassName: 'scsnfwrsojtbezxtqxbmkwzrgamyrnkixpvxudn' WindowName: 'jwmoibjvqzvkvkknwg'
