Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'hjdaorbfolptkwqwxjnydysilqejjhtbzkcjnfg' WindowName: 'acdrarwluvikatfibkiyo'
- ClassName: 'otgfqwvaxipqoxcwxkbvdzpp' WindowName: 'decbdwimswlkmzqiwzjfexeilqmbanjqspwru'
- ClassName: 'baxsvmglbtbgpkktmbtkodbbar' WindowName: 'mygasyedgykluoijpqezkql'
- ClassName: 'uibgireqxavdmibhfekyyaiderbhcmzrrj' WindowName: 'aetcdixkmdoeeytgajx'
- ClassName: 'umkzmulcvyydwxypckvolhnrssczwdprm' WindowName: 'lggcnxaaxabxfuiimcbyjp'
- ClassName: 'gkoogibyuwkpslrhbapkecxubaidrhrzvl' WindowName: 'fmkxdouxhwrdescfgpcakkanowl'
- ClassName: 'kqzjvjvcsxklkcirpiolpubxs' WindowName: 'zdqvcoxcuukslaedjiz'
- ClassName: 'ypdfkpnzrouyjjrzz' WindowName: 'pgcdrkbfkcfestbocvabxbydnjaesiemavfkp'
- ClassName: 'tyuptwvapruhbxfr' WindowName: 'wmdmycxzruayhtdghulmgnhzdsvuezfthdsln'
- ClassName: 'uploxbrrfzwolydsnqrl' WindowName: 'jiyalygzkdifmappuhcfrycls'
- ClassName: 'wrmbwcaxtrphsqlckmxgpntlcrztluyxszg' WindowName: 'jcflukapjdesmymirhnupgzpqtbotddqz'
- ClassName: 'zpyvsitpjyqixvyxpiqplvg' WindowName: 'brylgdlwhmjbqrmygdtdxcxpjcfkf'
- ClassName: 'tuqksagtcyuwhlyfhvokkfwwabzzhhrxys' WindowName: 'lfhgbujhzadsfggmmypizcewulno'
- ClassName: 'ygqlbhkuohpamadgbqfvpzdmjec' WindowName: 'twyuphinsjyatrphnvsnjhzqqpydth'
- ClassName: 'hsebvjqcwkqwyffwflwuoxmwuefvxtrmdbuxqz' WindowName: 'dzprogvbpocyphpvdemfdkyndekmkdaageei'
- ClassName: 'likdeivcixrdjrynk' WindowName: 'akzcclmdnysqqkh'
- ClassName: 'zeknbeqmruuexgmpdnhwqspv' WindowName: 'ocsbxezokrzygxlzboczdsff'
- ClassName: 'tqzrgpwlmrnbwpdnmlkaqyowtqmoxhzew' WindowName: 'sgnqowfvxywvgwru'
- ClassName: 'lspbxkckxkpypftcdqlgddapnqdkzijvydrqdv' WindowName: 'ugswfmdkzunjpykzradolerigbzy'
- ClassName: 'fzxdnsmuaxcakibogp' WindowName: 'vnyigfychuzffkxdrbvaysqjezqrqsooopzno'
- ClassName: 'yyzuknrrhadhwveobqmijanwsvnz' WindowName: 'asojstakorjhfhqabvmkfygnrmxlncnok'
- ClassName: 'ftbmqigvtcgawvecbmkednelspxas' WindowName: 'vnusfaxnuttinfxrivorflzwfgeodorttzizs'
- ClassName: 'roryeoehfddseggdjbjaqltme' WindowName: 'obpdspjnldkrcrgweiylj'
- ClassName: 'exgdikozqidlwjxtcpjtanjcvpma' WindowName: 'ymotkhgqkpdubwknkgbyxjcllardpzgpsbodid'
- ClassName: 'bgpwsdwagxfuqgvesdzlzoiz' WindowName: 'zhchkcosbcgwgxqfuuhonqqlbwk'
- ClassName: 'lzmkouccnsnmocs' WindowName: 'qvvqwtbjfhlvsfbgpzbzmkfiyoprhdemumlgaam'
- ClassName: 'jgtwoxlzmgfircuqbgjpjnefvxlppo' WindowName: 'mlsrrxgbrfylfespievtdwjrloqznnjskj'
- ClassName: 'rumhrurowynzofwhtmsp' WindowName: 'rkaixzxhgdziffkpcdkkjlprbtblvkjjivfep'
- ClassName: 'irwwkznrhfrgckwridw' WindowName: 'skimvydcmiwkonwtwlijxalyvj'
- ClassName: 'gwsyatxidvzesebnmspnvzjt' WindowName: 'dwgjqgslwjqrvtahnxkndnwphyhcpkpehrbgg'
- ClassName: 'ocxavgdfmqlnaxwndhyovysnabtli' WindowName: 'ymxbkmdrwuhlxhqykwdncpofloobvvhwclj'
- ClassName: 'snipdovybcdcgtordkw' WindowName: 'mqrpcgchypdodlqlfmfmlon'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ivxpudnvwhhdzqnitcammpg' WindowName: 'kbeajlcedxdygtoxq'
- ClassName: 'immulkzbctqemlgtfllycrdyjge' WindowName: 'spizqhzjileyjuppuhudymfev'
- ClassName: 'plcikrjqpklfxrvuijkbgezcqnekdr' WindowName: 'jzcnldrcdlzvxopzmkpng'
- ClassName: 'ynvdqeauuvvennbsklqi' WindowName: 'irjatoqfbnwrxihwhhnvd'
- ClassName: 'puxrohmqtouuvchyxnuqbkrtbmvw' WindowName: 'ohazlxxewbyzuhiigtcbs'
- ClassName: 'uklciniskohejauupqzrupnxuvjjziesw' WindowName: 'psoxxtxotcjmvtlawgwfgaxiitmblbd'
- ClassName: 'baqihxpgyajrwiyqzvmhuqvymqwndr' WindowName: 'fapeqstaqgeciaria'
- ClassName: 'tgzdhxgqdduielrocefftchs' WindowName: 'okfagemcwwfbbqnc'
