Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'gowccukdpdbluabj' WindowName: 'ujkvofbvdedvrcftiyvrkgusaaisctv'
- ClassName: 'zbxjkahmwmnsqqrfbyyvmytefufgeuzbte' WindowName: 'pxtbqiwujwbcgtsygaskoelmgqdmepjwvvo'
- ClassName: 'ovqbsvjrlzfqlhdhtasmcminoiybldkxcihek' WindowName: 'esdufewyqrdjyqaniislsbjq'
- ClassName: 'tjefsmcvgguwxqejgucudepwovbwvsr' WindowName: 'vvrfbmevmygrdfrpkzwvnpiozyvmsnsax'
- ClassName: 'qubawuplxtlaedzyrwdnexwogzdobyof' WindowName: 'vnvhnduosqmygzhznoynntkfobbbnrsguoqqq'
- ClassName: 'cslfewneukaeppbikhjskpyfkfmmisdlywgj' WindowName: 'jvoxwizdkmkwdwha'
- ClassName: 'eiiostauqrjzmioveqbycg' WindowName: 'amcmrvzcgwolukcdpiaobbrxf'
- ClassName: 'wskzoucbtcztvtscdgpnudqeuuotyndybbrqbby' WindowName: 'jzvchcskwaylwrjngjbiubeifxfqejujxislni'
- ClassName: 'gvkkhzytcuhnxxov' WindowName: 'jrtdaoxpxrofgcnhnsxpaaidp'
- ClassName: 'ngjszznjjgvnpuazo' WindowName: 'datfafnmggjvibzpbloxq'
- ClassName: 'vyplxovydjwnlliskhdegehjfbheqwfalsvvi' WindowName: 'ahywfkcrkfsvfsqmweengwxserywzxtkin'
- ClassName: 'vtxwwgsdpvnzhqz' WindowName: 'nnlzdvztsjaoutpqhmfgojhmmjpyvzv'
- ClassName: 'vpmgsfhcszewyqmzknbkttar' WindowName: 'kekxzpeuihapowwevuyyxjftycnxcxnrhojxz'
- ClassName: 'kycucpmjfgwdizakwyxgriwxyafbh' WindowName: 'mnhieuyglswcwghqzzv'
- ClassName: 'geaqxwhwbqewpjmnedkvxqfecrfk' WindowName: 'wyqlcvmusefaexhxudqdpl'
- ClassName: 'utjvikjkugcjqppuelxq' WindowName: 'qxbqiytqlvhudciqvnopyxofpnbxtqdowdkg'
- ClassName: 'myjvncxibclthhregqosoacnyrtnewydgnwjrvp' WindowName: 'uhibbwoofvtsfqyeehyvjsnnpi'
- ClassName: 'xwcvxcbrmhzhlohev' WindowName: 'ookgasubgqlllavykwrykxbuvzmyzdlsko'
- ClassName: 'zjngqaamwijaqvnxe' WindowName: 'whqrqdmfcvliytcnmqqpibfxjapembdciunuhes'
- ClassName: 'woqoxxaekfvxukggnzwyc' WindowName: 'cbutxvexgaqwfmnytwojfrxgxsswl'
- ClassName: 'sbtauvdhcmwfdztqsqjdsokwi' WindowName: 'pluzmestpgcdgbpfgbstapfr'
- ClassName: 'zkztjuctydvdkeragtwvwkalnwhvoso' WindowName: 'idmiagilrujisubbvwzaccqvtktewhbiaffzf'
- ClassName: 'uzyvtdzoonmuwyoxjgchexexldllire' WindowName: 'rpnnmokfdnwmgborwpvjleevakpsodnzax'
- ClassName: 'zkyeemnraiaegnjqbfuqwu' WindowName: 'wcmrwnawxknzxmylsikojxn'
- ClassName: 'ecvlqwkmbfwxqmejisf' WindowName: 'yeyrkmeppnjflks'
- ClassName: 'aysfbllgjkiselrtvbhkemeyobprejiy' WindowName: 'uypcjmamzcgtnmjaactmk'
- ClassName: 'zedgrvgdymzpshwdtodmqvazrp' WindowName: 'mgpacmawibbnzeaadlgkbjibpznmpcggqzn'
- ClassName: 'tmohmzhqouquodgbwmieh' WindowName: 'ibcwmrpltvdqoibfqdpmvopymkmpue'
- ClassName: 'eaqvyscqfpolrudgazqddoqvuwou' WindowName: 'xsykxdyeuzsvejqjyirlvcdpcrwmc'
- ClassName: 'gopxfwntrncxahkqrbhwcxljg' WindowName: 'lxllldtcntyeclobgbvohznvhhojowtx'
- ClassName: 'xzsnfizskepnkuxssczzzbodojkkwianhh' WindowName: 'kpaqmgeymwtjbjo'
- ClassName: 'jspdlcnmolnymwhatii' WindowName: 'uiytcopxeqxdqmaervxnxvrfv'
- ClassName: 'cvmgnnvgsbtijshrbjdenkrb' WindowName: 'rwaejxrirrfecmllhp'
- ClassName: 'ryqlswzrpslfbanpykmbacsmyh' WindowName: 'ypexsipusxrtjkjopgeyuz'
- ClassName: 'ubecltjzzonjtpadgyblzuzdcmonijsgmq' WindowName: 'nybgkzbohiwzwwhhnir'
- ClassName: 'kxsnjnhkmmovxlbra' WindowName: 'omtnqakowgzaoysokp'
- ClassName: 'mywqqqtprivbqeisrtjdif' WindowName: 'mrgjgkigsptumibzdyydpjtabsuxlfogwel'
- ClassName: 'yqfwaankehxrpmqarosnyddpozy' WindowName: 'qxwqeutfpipkbfsilujuxbsnivgdjovbcqfzl'
