Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'gbrfpadymqsdgbfaakecbcus' WindowName: 'vvrhcakfwvbraduse'
- ClassName: 'nmdtlzvdjpxcinupieygvcnka' WindowName: 'ifsewydtbobbckfkdsekdogvj'
- ClassName: 'sowztyicqrlmvjxuzl' WindowName: 'wjydrqbaohwmtwclusekwgcunzmewbbs'
- ClassName: 'zafwuunnsbaxsclqcosfikabupmdumuwr' WindowName: 'srgugilrresqirvajxo'
- ClassName: 'qgcfcxcxjpnehnyebnsaoszihuiwye' WindowName: 'hjhsyhzzpjjqfxadouflxpqfhwsxaojyhch'
- ClassName: 'dzauowwuihkzdxvzrjkzbnftxzziucffkeekll' WindowName: 'lgysuwemgtshlaptqglnaomikhez'
- ClassName: 'ahrbaolgisrdanosanzphyywdtlwjauryamrftg' WindowName: 'lvjsoawsychofwpxpvpyifleyjlpv'
- ClassName: 'sgkhxsjrhxasvavocohungojpdzdmhyvkyknmq' WindowName: 'qgrxsxwdrqwbwayxvqffxicotuwt'
- ClassName: 'sralhfymkksmdouciazwymijskp' WindowName: 'cusbqqlgwtttaqvjxrjnnzfvslaadsktgxzq'
- ClassName: 'adzqxtopciuosbqh' WindowName: 'kgxlcdxfrksiyxovn'
- ClassName: 'mtyftrzoaoljugyzszngknmxyssqm' WindowName: 'vgzegsmfflqagsvyfasmlctcrttijhvqjdv'
- ClassName: 'fyqnvnuwphedvedcbkmzbjwquucmniry' WindowName: 'mlukouxsqbzkatgjubkvetlu'
- ClassName: 'gqtxabmxnhxuaupn' WindowName: 'hdktuflbccjakmagiuefbsbr'
- ClassName: 'zhodklplfvdevtghmbjzjky' WindowName: 'sfnpvyuqordnzqrajgkbdomufb'
- ClassName: 'quukoovllbgbkbbpfggyafshstkz' WindowName: 'hjjrnptivajrjylhyqdlclpyaazmukgpvzjyzw'
- ClassName: 'beaqijvlcyzeycqsvnpylqfyo' WindowName: 'syatibxmzrpunuiivxum'
- ClassName: 'rqsyeyymmeqcevxaoylehayxfsvdtnegei' WindowName: 'fxfnnzuqlridfllyykh'
- ClassName: 'aoarbxlfitfejvstqvksyt' WindowName: 'jzqilfzposljabzwxzmw'
- ClassName: 'oigccsikbdmvqdsu' WindowName: 'rxsehihwlgehjjtuih'
- ClassName: 'xsifanfscqxqxxfovarqfq' WindowName: 'ncljewutclxlrlf'
- ClassName: 'bnlqsozucbshayiyuggcwuxjrvevqmlcqhu' WindowName: 'ksekpufdrlxzlshomckemsrewlyfxlo'
- ClassName: 'fxevcuutwrgusmgncpgdkwyntv' WindowName: 'fqkgqxahfpesmvpslwpelugshrncxbpzjjvvr'
- ClassName: 'ekgttcbtoovztpza' WindowName: 'izjdzjubgbujuqyokofgmckdsjnwqfyhihqgval'
- ClassName: 'whvinccjfqidfhjhxgusials' WindowName: 'bjpggjnkzcooarteo'
- ClassName: 'drqybelqwoylxvyjwipmjd' WindowName: 'isxzxvhwxxlwyfncboglotp'
- ClassName: 'gvjluesgztxnhbzqqsllydty' WindowName: 'wuugllxjqlvqjexnvttqkdkmosoopjdkknl'
- ClassName: 'uaaxqgxmrrzxfyvzdgkjwcu' WindowName: 'vfuhuhscsefuprou'
- ClassName: 'gemcrnsdyvdirhqdeqthislkouzakadlrvslg' WindowName: 'frazlwxwnjhtafmngtuljaabgwpwcpf'
- ClassName: 'ylbmxdvevboqzvyctftejcoax' WindowName: 'teivcktxgajggfn'
- ClassName: 'hqkrtgzyfppxdrguull' WindowName: 'kkpfuqfbxshjysycje'
- ClassName: 'hwwxqekvqjnluotzcmvy' WindowName: 'esbgepruutiigdbkttlzowwfbbezg'
- ClassName: 'vxvjojgnlnjmddjcouqyvpijlvobqrrer' WindowName: 'ubkekcdwejlpgzhtqcsjonk'
- ClassName: 'ekiuqggjcziyuvqioimqoanqoowklrah' WindowName: 'szcupcyctocuiqoxcszzvpismkcn'
- ClassName: 'gmkjnylnhbyjldbpsxnyqngxxcwmug' WindowName: 'nwfupecmwekuwodpuqhamwkbwmdqyy'
- ClassName: 'psemcmgmpobyshdqmmmnirku' WindowName: 'okadptyfmbkuvatoeocaaga'
- ClassName: 'zneapmtdxzainatbsbxje' WindowName: 'hbleliztmaiwfwjudnvariwangwmgmiy'
- ClassName: 'ewrvuuxiabwcbbm' WindowName: 'grytvqhwjmdfdihrxcfptcqlytrstpbcjyv'
- ClassName: 'tfxyyoqrvhyufzdxy' WindowName: 'kkfcqpfgnrfnggo'
- ClassName: 'ljuzwmrhirxhkfbjggk' WindowName: 'ufynpdptoxiocuzzlrpcrhnnfizsbvnrvgokq'
- ClassName: 'agohlgmocmordxflopn' WindowName: 'uvlngimxffsnqrivzvnzcdiscdlyhzefc'
