Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\NSISdl.dll
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'einucmkvalypulb' WindowName: 'nzkwwadrhntgjsa'
- ClassName: 'deitpmppetexddjfjzzytkmhdunkvqc' WindowName: 'qhecotjbubxiogmpzobxbfbjfvogoyjw'
- ClassName: 'kxtcumjzjcjilgzgnemjvbgxadimowdszi' WindowName: 'spllgeklxcavzvzorwlnlzwglyxcsatsmsfap'
- ClassName: 'slfeteohfqunlcszdutlutqhgwcjs' WindowName: 'ueeeqwhityniwbkrbkjidapwubyphdgibe'
- ClassName: 'rlewmqsrhcfzhqogjoncxbb' WindowName: 'zndyfvwtvvkymgck'
- ClassName: 'rlqdskozqjjtaufdoyvdulgphcvsfyzl' WindowName: 'vpzcyoeqhuivylknsgzafmpdx'
- ClassName: 'wkwxniwiztldqsvivbwenlk' WindowName: 'envnyqnalfpzqufxppynbxazvou'
- ClassName: 'jjjlkzmtodvtrmklcofqzy' WindowName: 'ygmpqryduicmrizrwbwiabextyewuxr'
- ClassName: 'sdwnojcqeofvvzoczgluntdivkdaatwjcpjnxld' WindowName: 'ydhbvbtqhrfnzkmaimvl'
- ClassName: 'lixdhwogbpjwlcqcuvavwhsqgygqybyeahwqsdd' WindowName: 'alwjkgxaizjhwuotfkzltwvak'
- ClassName: 'ksyyfeqolkbhembyyuwza' WindowName: 'uvojmbvvafthphxawcjsvtodcjaf'
- ClassName: 'rpknkfefakustkuxrvamwiqhffszuhzktrnr' WindowName: 'hbgsbclhbqrtkiywfqfqniluzu'
- ClassName: 'icowxabfmfefhjpxunknxvlwvgrnopftisi' WindowName: 'cjahojnorhyvdgirvubfpiuvwzczl'
- ClassName: 'qcxjmscabosmqsqafitynhzudihnmt' WindowName: 'rihumdqfwqdctkjgftnidawcoddf'
- ClassName: 'nhxnpdodtbghslgahgukbm' WindowName: 'cejisuikkrhwvcgpzupsg'
- ClassName: 'skblooabofjqchthqzoshtqnzzae' WindowName: 'qmoaqainbzeyfgcrgmpxxooiovujmgul'
- ClassName: 'lnrnhxvcdceyniretmzdduhcgsjkknw' WindowName: 'vysfltkpsniznuppdangtrki'
- ClassName: 'amesstgyhcdbyrbexfkprylyuwehl' WindowName: 'yvvolnsbqgpcrnlr'
- ClassName: 'drirwdziknfytrxqtlzpdwkhzrgxvoukzddzxd' WindowName: 'eugbggefursdejpgrbr'
- ClassName: 'lxujeeeunzjmhvrpxzcbgsfyefqzmrqv' WindowName: 'gzporpicvmqdmrhdcenicyptrokdotvytnslpb'
- ClassName: 'udoswmwipfvquwfvxolmceisqagpufuorvitnel' WindowName: 'dsgqaptkwauwlgbcdysssaubtpchjzirqoygko'
- ClassName: 'mhjfliscyopgtsnbziinqwfemwhxynettauhu' WindowName: 'qecfusatouxbvmanyxlwjihbtca'
- ClassName: 'mtnrmhkfjizvhshdctnbdydevzer' WindowName: 'oqcnafmrtiwsqwgx'
- ClassName: 'ptwzknlksnxocwfbklwo' WindowName: 'yvkgysgwodnkkncwn'
- ClassName: 'alkjmcmuvwlvlqahehtcvhwfagccxifowux' WindowName: 'mgswyfgdyjwrabwfjgimtqmfkajwmnua'
- ClassName: 'awpxajeouzkexqtwksym' WindowName: 'lvazdwpyuurorwvbniknqeesrjqew'
- ClassName: 'lgnoyprzvhwgzdrbromxdppohdhz' WindowName: 'wqayioslinxiquamthvaxccwwp'
- ClassName: 'xlblatdeywuyqcidryxzws' WindowName: 'wvaevoixiohmurzaoaondpifbpxfpdkzcibn'
- ClassName: 'dtbtxazfzszbgqiujjgpjruloprtvvwa' WindowName: 'ldblnibryoazrvtx'
- ClassName: 'lcecumsqqvvmtiayjuvazebgbr' WindowName: 'kwaoxuafkdliydrmvlummtcjaebfrhjs'
- ClassName: 'xymzhamfjhqzqegneeqnvmpin' WindowName: 'ohjwtrbcemlswcbnnydpwdjesxhvpnwrstf'
- ClassName: 'niadahpmrdbkpzf' WindowName: 'hyfkglltdmcymkiicjyhjtlcuj'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'zeuwpsrvhsuutwirnjwre' WindowName: 'uyjfwfxuaqpdwlmduwh'
