Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'teipleqroatwheldlqptnymqrs' WindowName: 'ocbsbgbrnsdoaikshqoswalcxisfzcewzj'
- ClassName: 'snchfcpudwteejbqkrkdpcxwvzrccpsimhi' WindowName: 'natjoyajdssszyds'
- ClassName: 'anvjrtxnqxfualwuksqvljglhvawjx' WindowName: 'zkqvvhddxmyyxdyrzsjqmf'
- ClassName: 'pktmshfwegxvhxmclbeawebkmhvqdwxybfuxqng' WindowName: 'fjbiwzxcuquhtxobebtjyawgujorjhj'
- ClassName: 'kgixuwdseclecjuuysbbt' WindowName: 'yiifrsexrkwahbskpsarzzqgcdpeelada'
- ClassName: 'ouznecfrpvabvvqfbcessrvxlfymdgi' WindowName: 'zoodstfqwdeeirkmbozldbdkcxlevgaalhuukka'
- ClassName: 'rikcmglprkxnrprjpmxtxrhqbqusqxk' WindowName: 'tvlkuavatvgywxupahvrjaknf'
- ClassName: 'zcfwwtqvreypxbfvt' WindowName: 'uzxgqsprzugwjlzalufyyjhdbfdy'
- ClassName: 'sjzgmwaagopdavfekzczvkwifxslvbftwwf' WindowName: 'ekfximqybttlybwradekyrzchbdkiqo'
- ClassName: 'uqrwiwoztgyzgjxnm' WindowName: 'kaqgomiufwahpbhbscosvb'
- ClassName: 'szavoibiyqcgufbdhmfxkefzjjlqhyjlsora' WindowName: 'kzanflaaoxibaabviopeadyjftvecqp'
- ClassName: 'yhzccvydktdhsxcdmmkkuptjjugyv' WindowName: 'lwroffwdildabyxbp'
- ClassName: 'bdakvpeijdlpczvoplghaiktef' WindowName: 'rocfnavxfqfvfqi'
- ClassName: 'bocbzehhgerltaqxufrsiioe' WindowName: 'yethrxnrehldwfdaawagipykzxlmtmtaaxsl'
- ClassName: 'wtttxqmnryxuiftsedppisandwkmdd' WindowName: 'tvqllhedxwabrgdpbmplaemftps'
- ClassName: 'rdugsjdylvedqmwdolcgyhencltszcmmmn' WindowName: 'spaweqbqhrycooheziiynjihdoalnhycf'
- ClassName: 'nlxdrtcdluikqgjkwyecefybvb' WindowName: 'cpovqxjhzeqnjnousapcrlmoytjt'
- ClassName: 'uetlacflefbrzyucbkaoxbsokevvulhybstvya' WindowName: 'nycupqfcymbkfkfnropbmrunaengvnpkappgreh'
- ClassName: 'auwiukcxindigqzpogumomgprtmgxgqoqqfepw' WindowName: 'ehyjplfbrzzpaphueecow'
- ClassName: 'vduinwomlstgxrpxauweb' WindowName: 'xwdyrztnccxomsrobmo'
- ClassName: 'efqtvrlpsaldxrijdmrts' WindowName: 'jvhaauuxcrryngxvmlemwxyub'
- ClassName: 'urkevbvaxxxzfkeagwyxdbutmsytrrdpdxrbcam' WindowName: 'mgnvfcquzwzketmsxzwd'
- ClassName: 'tcjxlqbhgshruyatgaeyfjoltmrc' WindowName: 'rthaurrysahxxxwuhiporwgqubbkuiitimqqq'
- ClassName: 'ffpgiamvewjrkgzdikuln' WindowName: 'hktoqamslxclriunx'
- ClassName: 'smhekktlplqachmpixubayomkauw' WindowName: 'uscykroldwuailtjsolymovetfwyhxdjktvy'
- ClassName: 'qljdlvfrwephhieadbvtbojyzw' WindowName: 'ememzrjghiimlnkydqokkf'
- ClassName: 'bthudmtizyunpwoyxyjxjqxkcswggp' WindowName: 'hgyasujlvoajedrmcalvbcq'
- ClassName: 'logwjkzazolbwipejdpvjkrgmjcnjp' WindowName: 'rhidplhksjedqgybktugvdqgdz'
- ClassName: 'qszrgebfgvnhqebtvsgdomafishe' WindowName: 'gzcemejmmbnrwms'
- ClassName: 'zxbyfhtpykegpfdlo' WindowName: 'xgbfystavnxyhxkcfwb'
- ClassName: 'ovgypvegnjphefqbuadxbotpoxmvuzixqiuy' WindowName: 'zbdfnvmguitmjjiwvrczbamfhjtqxg'
- ClassName: 'qqxdwvgpfdcawexqaj' WindowName: 'wzyefnejlbfqcwcvkitthqorkbfcrfyjhsg'
- ClassName: 'xcjjysxgtvmwkfdmvbzaxsy' WindowName: 'aaiooxlibhyveizqzvs'
- ClassName: 'jawhzavuddyciomvmezz' WindowName: 'nywsjddplchkuunxjubob'
- ClassName: 'jiesrpqqnawhktfjzjdsyumloddlgereqdskuq' WindowName: 'jdyuffhdpuvbeivllyclazibjfmzobf'
- ClassName: 'yeihtmdnohvcheobemxpop' WindowName: 'hiaxjjxbyhdjyxphlknudpwetmpxaorr'
