Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'aesfoadrjbabwghlbblnowuyue' WindowName: 'fnimdqaazlzxwqyvz'
- ClassName: 'liqtxaictvngoxefofnx' WindowName: 'tlxnzthrhehsalg'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'fxoxihczrqsneamswcnmmbrhumwpgiyetxi' WindowName: 'avqppiumqhmbwzyhfjky'
- ClassName: 'vkddugmgpjusttgfzfspybeoejcdiyemriytmi' WindowName: 'xrgkfznkqtnsxjrattihfaygsehbswesftkiwzk'
- ClassName: 'blernylwrlnpejwvw' WindowName: 'gvrzmcgogimudbvztkgrmi'
- ClassName: 'rztxchaexubeggzppgyfdqwouirykpnopndodg' WindowName: 'ihiebsftyqjbeunrp'
- ClassName: 'ckszdibsjgnidspqujqndc' WindowName: 'fuzhmtotjzcmnopxoosgzet'
- ClassName: 'qyqmtfkplqvbpwrdesqvlqtiyykkcuqcxrc' WindowName: 'xawdsrixvacdbpkgejvj'
- ClassName: 'xllxxvgfcsjlsemeerr' WindowName: 'tjrvevokbwksdylgxjdouhmsbpy'
- ClassName: 'tlaypticteuugyxlfvzkwacknbioroi' WindowName: 'mhxmdiqdiedcaziybcudwpykolcxddced'
- ClassName: 'olickjsbnixejepztdfcjqgqwuascrnjgalkm' WindowName: 'pjpjubuypjofevtgup'
- ClassName: 'mxwkrwsqcppdhfuyezdzoictnh' WindowName: 'ssowmwsqzkzgwttugahcnwzcrvlehmicfb'
- ClassName: 'chtnbxgntsbnzzlhtp' WindowName: 'qkxacjfrjmlacoxovbd'
- ClassName: 'ydjpkplcmefxhhcrk' WindowName: 'gkumzxtetxgsiymmhddedxmpnfkdismkauhq'
- ClassName: 'oytfwyaonrznxrmy' WindowName: 'muvuxuxrwltuvwci'
- ClassName: 'ckuwgaszncuwqxddsfokrlfotsmxpwfutz' WindowName: 'quhppsmfegoglhxmxl'
- ClassName: 'rsuwbbtclshgjujyfllhpxucwehybuwkornwhj' WindowName: 'qajrjrfuasyqwpcp'
- ClassName: 'ethwkncuznpwifevckujmmjbkhwzp' WindowName: 'xgrjejqcqxdhdhuqxleipkhexywx'
- ClassName: 'gcfnotzuoqeudghshfrsuhihu' WindowName: 'oifpfzfrdnrpybkfmk'
- ClassName: 'bxjmfxoqfohtnvbbeqlcitmmnmbjtpfkqgvoorl' WindowName: 'amwxkdkygguiuenrczbptyzhyqutr'
- ClassName: 'wmantcpgdreofebvmxerngxfntkhxoppgxj' WindowName: 'yzrurweljabpdgxh'
- ClassName: 'wrapajgeozekrjkiyddqmyghgmybzcyjnqnqx' WindowName: 'leghttkabjwmazmgjhrvmtokec'
- ClassName: 'kassptrxfafnllc' WindowName: 'cxeohjjnegmepcidebihdzjhq'
- ClassName: 'vexjmwntbmtzyfiiahjvqijecsu' WindowName: 'tavtlnemwztwsrqfhtzdjdkcthrietxdpqoiu'
- ClassName: 'klrcwxhtydcjwimmxjxnfogwmdlnprvjnut' WindowName: 'sxknltwtucwqdypbxwuzfhycwmcapq'
- ClassName: 'dhwtcuepycdjckhkcknginlenquj' WindowName: 'kffuoydvczpjpqs'
- ClassName: 'bqtnmdzcjwwpwurgymcjjpzongecgy' WindowName: 'bypretsvuuikbhqlwsovanhlert'
- ClassName: 'pyzzsznbwdughfyke' WindowName: 'nbdptyoptvcjyaftjjvzwyhheoqrwoyewh'
- ClassName: 'uipwxfdingerigyyhljjcliuifwnkluzjqkknyv' WindowName: 'xttafgswvshczzqiccicf'
- ClassName: 'fodyuihyhafpfqiijfxqgalh' WindowName: 'dkidmhocdlwrzkpjgye'
- ClassName: 'aihynxxmcavvyqsbepjplepmwahjtlbora' WindowName: 'zupwwktobizqyny'
- ClassName: 'zshejxcsubbqsrctuhnyldttnimqrtze' WindowName: 'fcxjemnwbezerjpnhczswdqss'
- ClassName: 'okhraurrneiovtrp' WindowName: 'wfwjucpwxiqmormezntqcv'
- ClassName: 'jkclemhhnsloyhuhzachmlnkfojamwveneqn' WindowName: 'iknbbkdrwvgwskhwn'
- ClassName: 'qqxcyoonsengmbcsgyzduobstpmmdwakgr' WindowName: 'ontywpzdzlrxyazmkxdcqh'
- ClassName: 'iamiiudlzpquxjtxpljmrmc' WindowName: 'ihyphelqirdouzeexkrojtjzjjskvtxrv'
- ClassName: 'iqodwsomxfplgtbsjcbcigghf' WindowName: 'stdbsyvltvptymgu'
- ClassName: 'xbqiqlvwttczjtmmskztf' WindowName: 'oqopyglfxpemkaismstnyudhvns'
- ClassName: 'kziseojldyrkkrwm' WindowName: 'ednnnufacsszlknedbvmfwz'
- ClassName: 'ujlhzxwxipvyddwhrpgocqugyl' WindowName: 'efmapfgpusjkgzqepbhbebbhogadgmqhjhbzwjg'
- ClassName: 'wzggpqcbexprswwrvarlddiol' WindowName: 'itjnjtzxwyaxmzhwhnnvpdqeggkis'
- ClassName: 'gyyifvmqfbzwlsusrvprbwxqlldqur' WindowName: 'ngttoenzzoktoviomplfcazpdzrjuxhbscfgjh'
- ClassName: 'zlzkhdltzypfjweaixz' WindowName: 'hlgtaqjamfcrrfawkywkeztap'
- ClassName: 'jsmmsxgnpnugcxmqqieiirakugrsjqjfxtdacb' WindowName: 'bsehvimpqurjxqsiaynji'
- ClassName: 'levxfnegdtgqjimgjtjeqamcjsbwpen' WindowName: 'itzvkiyqrradtjvwzunlpdyglqxchaq'
- ClassName: 'dcipgfomqauutjzgndhiydtdryclh' WindowName: 'vvzuscbxluwbljqzmjfbajo'
- ClassName: 'sustwyslrjvqorbfb' WindowName: 'fsrcrnqwyamnabvjauhgjzvatpuqvcgq'
- ClassName: 'xhsxtomrsurhppaq' WindowName: 'lcozfhfmqronfmborhbj'
- ClassName: 'eujvshgdnyokulbifk' WindowName: 'ggqwhxzvavadipmgowpnmpevix'
- ClassName: 'yncqayniephbzcytstzxbwhsyxbqdmpg' WindowName: 'eaymouwlvtdfvgftvbzpwgteqernjtdcekexpyq'
- ClassName: 'otgbctrlmopedvilsebyfiaxerqk' WindowName: 'rbmpenvlrjkktez'
