Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'prwxcbrwiyofpdaundcqteesuflotjxoivvtx' WindowName: 'dsetownizzpxghttdulpmhocavueg'
- ClassName: 'emvbbdkctyuvlptgodwa' WindowName: 'yarmtmdcvubbypprwzaygxxzg'
- ClassName: 'rajhoypkldsrdpniyeeeokvfqh' WindowName: 'ugieqlggjnqckbp'
- ClassName: 'rdlfdljeoajxewmdydegdmhepehxap' WindowName: 'antsflpirftodpb'
- ClassName: 'bpwgmkipqnznawarvvcfkqyn' WindowName: 'eadqmyvjhithhinmkfgfmoveu'
- ClassName: 'cildfswzwmmpbzcoyelafpxrfggkafgkyd' WindowName: 'cyzwhgovdvtalrozrzfgdbiaewfv'
- ClassName: 'podbexammzeboqkjs' WindowName: 'clkgbafpwbhvzkoyzyitropmwzlkrbamndoznm'
- ClassName: 'kadmwrhgsxafoqwxygbfcsozadw' WindowName: 'tvydoigcwbnujxxcanbxnhfjg'
- ClassName: 'bzfchqmyftytacwkjuwnscliizvpr' WindowName: 'meluwwzgirzkfkfhritkkrtxwmlsimqd'
- ClassName: 'skitakrltvlutqbnydklaiwmy' WindowName: 'zxxnfjhieyduegfwuaijcpacoziibsepxjc'
- ClassName: 'lifmgofqknyjlyknrjzdyahbuzckiph' WindowName: 'ywrgpdwapzlezsbchlb'
- ClassName: 'fkjoyeqrrbxowhevkpekrqh' WindowName: 'vxxpgfrdaabaupwqyfdtaanvrq'
- ClassName: 'ajycemsdcwkavkgvcxabhupueztbagy' WindowName: 'zhkfxczpsriofmzofokkowjigssrqzyvrm'
- ClassName: 'jxvbgrzbmtgfogdoawortprybmqraic' WindowName: 'jfrfigtpcuucljxlpiraavfgredw'
- ClassName: 'kfzgailbrekkrtrivknxnlqmikjjabjkpc' WindowName: 'tosuhbzuivlvpsarmqszchokbloiia'
- ClassName: 'ojghpsxasdxbrmmmypwsodjkelgppem' WindowName: 'wuvrjakgzisyflc'
- ClassName: 'eqztlyofipkjpqiy' WindowName: 'wdpyicwnzxvrklurnrevvmbgxlbaeazoac'
- ClassName: 'aobdltbpenfyefttzuzfvflekokvm' WindowName: 'ekrlgprrxlxftgqpmepcxhaex'
- ClassName: 'ngppdbxrthronjfmofibrcvrelthgaxs' WindowName: 'zwmccrtxmvgnajxgkvnsifeucbvvcdzsjfkv'
- ClassName: 'qppnrlxzvhxojqvzkatlnectycotncuhyvjyrdm' WindowName: 'bgdzywlahdticcqaddbyebjhgqkhyucncgkmkp'
- ClassName: 'qqzhqlnvfisxbwwlcapwcocnlmvfcg' WindowName: 'ozbkbgrpvgogizupnmlu'
- ClassName: 'bwycuqhlkjzqvbggyizwddwjonf' WindowName: 'bvemimdiugeucjsvaezo'
- ClassName: 'qwbbdmrugohwgjeadpzhvptzorlkoadrex' WindowName: 'kegzdnivdaparbpfghss'
- ClassName: 'npxmbxvyxsoofyeqmnzzfrparhjzmig' WindowName: 'wfamrdlfmnfhriurbixhidygq'
- ClassName: 'esvvnozafsjouaqgxtjydxiksnuepatrt' WindowName: 'ofsoxintrdqhlmqsimnoiwzhknnrsscoisrvh'
- ClassName: 'spnwyqhriadiijrxnheviroogvybfnlwybskx' WindowName: 'ikmvzzsnhbjifhaehfaagybtxxzmyu'
- ClassName: 'zlsjdbvjtichodrwxjsxjagqy' WindowName: 'ijgwxzdajyfsjqwxjshnyioxpcazbktocgecp'
- ClassName: 'wmctkomrbxadvfqguaohgylprgeswagkh' WindowName: 'ohvhoattcbdyzwznhvlqvcfqg'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ndbpbuolleqgkufkz' WindowName: 'ghijhlkekkxlqkjsmjeiscfjcigf'
- ClassName: 'kdqatrivezgkojfffkbnrd' WindowName: 'zicvfgqxdaiisyaigklgpccqzerdsaprxpkfsg'
- ClassName: 'tbybngwxgjrnqflzlltgpkurvuqjrmlt' WindowName: 'ciyhttixhpzuintcggqnbktgom'
- ClassName: 'glipdwuwxijculiiswvyhykkzmez' WindowName: 'vsojneiedliurmvxbypfmmxaqcfylyns'
- ClassName: 'ywbiuucbiojacoqsa' WindowName: 'mqctvfpntathnuvcmrxhcmfojbhoavkvul'
- ClassName: 'yqehbhbwaaubsmlfzjhuczfgqsu' WindowName: 'nnikjjqhtezuhcfsaoywbbqxcajvjqasm'
- ClassName: 'ktqavecxquyqjbiuhruu' WindowName: 'wlzdpnodckmezjcfkubsbmgukrtth'
- ClassName: 'rndnvzbcyvdavbuujkdvmsmydpnogjjdmsbehu' WindowName: 'yltdjzpjzjduhmmpalcxvili'
