Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ectliovxilhqzmtfibumbeyshvjrdfuifqow' WindowName: 'vvfqyohqrojaersynyeoe'
- ClassName: 'uyhquvaziyumshdgqzz' WindowName: 'avwjwarbnagtrxvtwyqfegddp'
- ClassName: 'sckeaqbodkyvslqdmrpxik' WindowName: 'scryxytooslbusc'
- ClassName: 'odzqmvzzxuilsomjezyjxqeugql' WindowName: 'svyhvblvkkgleuorswvyh'
- ClassName: 'oyqvffvpiimkjnqljyjvzwuaguopeholmz' WindowName: 'ksjhuqzhdduvakyenhbbppbucyzzpudm'
- ClassName: 'mjzmegsjwbgdcppjcwejqgxnhuaylzal' WindowName: 'jjxgpkliyesjqjjhdhxdcmnrnvjvgvveeib'
- ClassName: 'ogkanhkhtpqyjtpbvyyzwknigchyre' WindowName: 'itrnbuvtqygnvayeym'
- ClassName: 'mriujtkgmiiwrggigrsatbrrcybiziz' WindowName: 'sdjwmrszkkjluafdlpx'
- ClassName: 'gzzjdqrzpndrshmsvnvryjeqgriiktppzyhxmee' WindowName: 'bvcyylaskpqjmyoxegzinmsxregwpqz'
- ClassName: 'nfuslnfnzezzcgexnvfmofly' WindowName: 'fnwuhzorzraptmjykj'
- ClassName: 'ibwirnvqsoxzzgo' WindowName: 'hiybakuiuffcqlmmzhuaeiwahuwsed'
- ClassName: 'mwhatzxksfxgfvstdtlkwszm' WindowName: 'yilpduocydzzoyfvctztsmdovhbrq'
- ClassName: 'cjilcwhtxeqolkagu' WindowName: 'krfpjxweqkydxskixedhzj'
- ClassName: 'frywxsbyysvgrkfphiwekzryjekdnybagy' WindowName: 'begpmrgknyxoqjlpgjmajfejofondbl'
- ClassName: 'meevhxhezbivxmhhvp' WindowName: 'xatmtjtsbsdddtpmp'
- ClassName: 'ysmzmendmpdelwr' WindowName: 'atcplyvdkobabfgajrbssbaewqgw'
- ClassName: 'jnjfqoxdtmcznsilhnzvopgqurdgdg' WindowName: 'jwwyimmglqlmvcrpeldmxoqrfwtfe'
- ClassName: 'whvgqyzgswhcioxlovf' WindowName: 'fzoierimdusokrbgiwlzixyen'
- ClassName: 'upeunwlyuwqipnxslxvxrhkyeeth' WindowName: 'jbbchapbhtfjjrwvznfrlrdafuoyg'
- ClassName: 'dygfbohlkcjyvvhyzkgcfdhrztjsgehfjsurs' WindowName: 'awyuimtnenzlvfifstltnsb'
- ClassName: 'qkepvsdazcxycnydetacdhrwodffovpdr' WindowName: 'ttysjybyrvcmyxakzgleqivktwlazzjypwfia'
- ClassName: 'xjsfqnfamnwaozggk' WindowName: 'qfejxmcqrmdesukvburdrczqfdbiqmgnj'
- ClassName: 'xuzyzfjosiglyzxvjktdezjlctjjmayqspdzriy' WindowName: 'mwctikvslzdbeeokigbsbumvympomxjzmdqvpja'
- ClassName: 'sxvxeaagtmsckek' WindowName: 'ddicikhbzsgdnufhtlznoprkrlpkxvlidj'
- ClassName: 'wyhvivggothyksxakvulopdqbn' WindowName: 'mydalapncurvkdheqvtg'
- ClassName: 'nxnyhrodjcujeys' WindowName: 'gusgquypjjuauaufzgufg'
- ClassName: 'kbojwrubqinwjhvgr' WindowName: 'nfvgvemhuhbsnsj'
- ClassName: 'ujcsnkctsuumooazjlqrxepeboqvuheszcstq' WindowName: 'elivqhyfnagipyvnnfabjchyqwfwsjvf'
- ClassName: 'eiutxgfrqffekklnotdxlchakwgzldi' WindowName: 'ubsgwubedzzajvqgmmlmqurahskyrsbfjq'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'dftleggfglqnwxxyshuaqqy' WindowName: 'hirslvrndzggvmvpzmteqgwydbzuvwq'
- ClassName: 'jztnomctdvwfhgv' WindowName: 'ochcxmgsdphxsdrcllfnhbcgf'
- ClassName: 'jhktihjhrskrwsjrpexcnrlvzvqrvwdljdpskd' WindowName: 'qxnwuycobgfqyprduqhxc'
- ClassName: 'afzaxlchmqgwhlocuvaen' WindowName: 'ltxvcfdenqntiiwuwwhctqjsqggqiwnzy'
- ClassName: 'tdgozjbfqjbdzemxfskldifhvjqsdt' WindowName: 'ulizyoxrczoczqjpyxujwybehugrtl'
- ClassName: 'tcapovcknzeyswy' WindowName: 'kotanbglulqgrumncgwaeiqhzbauezw'
- ClassName: 'nimjsvvolhplwjndebfafgibwlckdjw' WindowName: 'nnnpsefnyfhsnisdockbkidkvdsst'
