Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kbpuadmgtleduxrvcjxfzqfxcsha' WindowName: 'mxpzfptphctpesxxy'
- ClassName: 'pzytnhkqpjkveifxebhmhlpy' WindowName: 'ugofegqvgsjsecmliaofceyneib'
- ClassName: 'jerohhpfzzvsmxnyhwaofksgmwhfbbhnkpucze' WindowName: 'rfhcfaefcceamuqol'
- ClassName: 'agblzmyugrrowrxpng' WindowName: 'jleakuyojhbbkzhvaajv'
- ClassName: 'gystzqqkgcryebskzcuzajqbpzav' WindowName: 'yqkveifkxcyyijedxwtgrttamtwblubngdy'
- ClassName: 'auyqorseubijfxcx' WindowName: 'wkmekklfscceoebwewpwrazskoryfhsibozh'
- ClassName: 'cjckksjtoltyjdmarhogmssdqhrcecousosh' WindowName: 'nydabdqjnmpdfijyvo'
- ClassName: 'lhvkvuqfiuxppvihwy' WindowName: 'obiwllxmwjejojkpq'
- ClassName: 'dtitnizofwsdvstacqwvdvhogdffawjd' WindowName: 'vrgobxaqgrfhkjca'
- ClassName: 'lawitmmwbkikaoithzsfvmck' WindowName: 'pfrbmrpqrmnunsuzllyxshmukko'
- ClassName: 'gmypxfgbkkujnikgnzeuqogslp' WindowName: 'vdtgfwlskyrykrbnuvegfutmzyh'
- ClassName: 'mgyzsyzxnhpffvpimwn' WindowName: 'hzqhwnbzgbxfmdjguirrucmcjfa'
- ClassName: 'aolfwekezsjieprdxhfnbnufrsxyht' WindowName: 'aahslswsxdpchoykpfvckfvgzqkqebwsejp'
- ClassName: 'rglafzzbniimlgw' WindowName: 'hvplpdzhmlmegxghp'
- ClassName: 'yscwlvmeenzvkkypecsninmscgr' WindowName: 'mkjiddljbvelnswgvqgthnoycmff'
- ClassName: 'wknqdqnwxxhgmmwcfxrixpc' WindowName: 'bwtdruqkufhliybynpcjavf'
- ClassName: 'bdkcqsftjkhzfjjtjnznuziyalucdo' WindowName: 'xftvxnbihhfnarvjpmpkhzchmamfico'
- ClassName: 'jejlskwkzmzqncemuuguu' WindowName: 'yklgrgduajzqmwikhyafpixbasqsthlyhgnwsn'
- ClassName: 'pgspmcvddoxznrslopggusnpihsbxfunyzlda' WindowName: 'hgvqdxugkoynidljpdhvbrrjejanwbhrpqpufs'
- ClassName: 'mwpcbphjcnohskgn' WindowName: 'yqyttkvzjkhmiudjmxstoqiuhqln'
- ClassName: 'lncleebehaozakckhksa' WindowName: 'ilooujlysbpelohw'
- ClassName: 'bihfxgkbfctnixxhfujprmlrmkgpqunf' WindowName: 'nplbefifmjnevyyfrph'
- ClassName: 'jjynjhenekbhumgldzffmjgnqagojo' WindowName: 'nkymfgyvnucyqesxmuetiuvj'
- ClassName: 'tstxqdgcckdvggbrycnrljjxmsklk' WindowName: 'tsfrouosrcpzdcoi'
- ClassName: 'iazcmqpbsxlotzwbagm' WindowName: 'byaqfudtaagltrzdbcxqjagtgyhclfyvm'
- ClassName: 'rmsiottbtgfwqeurllyftrdiwhenjgmrbpeiu' WindowName: 'kyyditkktizghcfrki'
- ClassName: 'ibovzmzmzrgmazvlkcwcthismzgz' WindowName: 'euccwugnkirziuty'
- ClassName: 'djtvfoxpcbqalgombvsjed' WindowName: 'sqolahwgbdcavioo'
- ClassName: 'pjosjbkqlatonssblixctzdtmxbbwtk' WindowName: 'vgfzprbbxgxvcsoqkn'
- ClassName: 'zwdmastqkuwrdbmdvzilwtinq' WindowName: 'tdnsnjnjluljwjdaqqncvtcmzwflzvmpyk'
- ClassName: 'lcmmqbtruplyqnntlgjzkanwdews' WindowName: 'fkcfrjzmtiqgxcwmwwnfzmnampsropudwrzo'
- ClassName: 'anaqbvljpjbjadql' WindowName: 'tamyctesvxgukxh'
- ClassName: 'gjjaiekfsezodwxoucs' WindowName: 'xprlskxzgeigtti'
- ClassName: 'jndwvplssnyqjljdmjeewdz' WindowName: 'takkabvwlkaysslvlqatsdopwwhzpxnxjxjwf'
- ClassName: 'rczfslknvrcpiyhsxzsnbeytpcvpnzamripqluh' WindowName: 'psxtrzbbnnwdkhuvwbeseouz'
- ClassName: 'xxocbfwwuisohzlxskix' WindowName: 'jxczwkahsntfrywttkltlsmqhlfbgixwful'
- ClassName: 'paxffornllokfgtckinxprf' WindowName: 'vdumckcmfqsivwb'
- ClassName: 'bdxwgpwqzdbyuxaddszflpmz' WindowName: 'cgnccaijblbpanktykuqg'
- ClassName: 'hcrkcugtkuranyyifmsarurzpivtdujiogss' WindowName: 'witqhrxrjdstscarzacgkddcwptjuxaxnqeawry'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'dkjwihhispqudlbewltn' WindowName: 'miouhjrkjjthmlhjulhgpbgg'
