Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'wkjvotprrylogbcgllghnisz' WindowName: 'bsakxavpzmwkgfamnfvbilir'
- ClassName: 'fyqwkqrdmmmytrfyiohlfsollziec' WindowName: 'antehtscinjpckbxzbpigemlcpvdynkuyxo'
- ClassName: 'wflereffwmmbtdungalucaapb' WindowName: 'pyggaliwuptcxpkknhnwwukqfgfydg'
- ClassName: 'zuchqophvewezpercffnttefdpkbgdwt' WindowName: 'rpfuuqupxfsitikpyggbqqwhdstefqdnxclunc'
- ClassName: 'ijsiwqlvayfmwasyhmgzutkojdu' WindowName: 'exohjcysppwopfzzqkytomuogmvsfh'
- ClassName: 'efqqcxxfcxtkwwcrwohihm' WindowName: 'enareuwsafwtcrpwasvycsbeydairiy'
- ClassName: 'qgtiiqvhbgqfcntfqlkhbpaxpjbogra' WindowName: 'fbkweivyqorpzzzdmxjfjebe'
- ClassName: 'ppydvwxdukgzicuurfjxkpgaggptmayryxcaj' WindowName: 'hqwrzlcdpxppxnagzggktkdxzp'
- ClassName: 'fzpsjcirrumfkzdodcolrnsyiowhqeyav' WindowName: 'trnaequnvpnqyulxowkvaixumbufbeu'
- ClassName: 'nizbjwrioplxfqvfpswozoohyh' WindowName: 'tpprprmlnpvespbeeyjtfnvlmsrsjodh'
- ClassName: 'kjbawhdfdfhflwxcbnztmfftie' WindowName: 'qwykbwlmkpoonjipayb'
- ClassName: 'pwonveqxowycerrusvipijiytg' WindowName: 'uyefuiwgbqsvlrmtmuttwjihkoupyyqxgvdicr'
- ClassName: 'fokxwlodhgvwloooufjkqryfxilwbppfoqj' WindowName: 'gpaxnxdtxcdyacflmyqeelehod'
- ClassName: 'fqjbaujkkanbxszdmqnhwjrbvifiapbzgzkwd' WindowName: 'kudueodbyvukwcqpuyuxrumethjo'
- ClassName: 'daypqttgbqjzmqlopvkbiqbymarvxhuksvfu' WindowName: 'stbkynxxbfdzfnylyftd'
- ClassName: 'ozkvovmbxnnkcornmhavtvosqnjthmpps' WindowName: 'glwllfjsqyeegixtlrnfcdbfyv'
- ClassName: 'wuytbjfojkiwpyhtdqsdthlkrvpdmc' WindowName: 'qlluderrftbwxxutxmjiunezobul'
- ClassName: 'ooprrnplpyezckvyx' WindowName: 'vsbkykhzvmomlnhxgelcdcvgbnphjdgjjn'
- ClassName: 'qvxlzxoghvknxeeypfmphdxzhrk' WindowName: 'sjekhgttndhwykcahxdtvxrdhujdlzzgieucxhx'
- ClassName: 'zgoypejcmydgfophlqmaxrczgmskxvj' WindowName: 'gmtfydwjpxtnltppknrqgrewra'
- ClassName: 'egzhfbazfmokwjsgkalaxyt' WindowName: 'didxrpvtvsirqxxiigwmabpoxijzyopwofno'
- ClassName: 'ypxmtrtqhdcrnczfetqktfkcstkihcckuodxpm' WindowName: 'rclsakspgezksowannlejafvxrccbrgmutbrn'
- ClassName: 'nfysaayqgyjvrbtzibrrwvxtimvscdtcbwlj' WindowName: 'uluaktazikxzzcqoktkzvrsl'
- ClassName: 'brymkspnnmrflnovehstbdzvzrjta' WindowName: 'pncukbkrrnpmwgobdtmfnveotnpyjawzrmrjw'
- ClassName: 'fzphzqmafnwfvfzuhgiibfandvflbmnousqkc' WindowName: 'voqicdsvukpyekpg'
- ClassName: 'nismnxyjscpzvodeaidggywekspoctpvdcjun' WindowName: 'fpompumxsmlfzjlvaevttimdsdkndv'
- ClassName: 'mrybwkdvenducodcgjllrkebauzs' WindowName: 'gbkeqcsegykzvcq'
- ClassName: 'lhlngvanlomttikexwdo' WindowName: 'vjefxryhauremuwzyadtvmizzyfjdpsp'
- ClassName: 'nenhfqbqfsfgibysvxklzy' WindowName: 'hxshlslldkzoautjubcucots'
- ClassName: 'zmeawmfewmpwrlnpnnmbqsaafzibkznjhoxqmg' WindowName: 'bpteidgcifoyrevmuojjxh'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'mkdzyeovcquvsrmjmwcltpzahajglaabicv' WindowName: 'lkxamzlvwirgbuvzedtqiqsccobnik'
- ClassName: 'dkjtlhihdokdbdebymvyjymyafxo' WindowName: 'kiftaeneqmjlxnpanl'
- ClassName: 'gnquyxruuwmhjquzobtqypsqwgyqkwnnupc' WindowName: 'jvkcqzaijajjytbegxfluwfkipbabljf'
- ClassName: 'xkfjevupladqrxmvivdrrtuadffsvvhhglof' WindowName: 'bwtgmwfxccwftlbommoxlthwl'
- ClassName: 'bstriwejmjhkkcolejrhwkpbhttzr' WindowName: 'tnueazltjmzqwrnxwbshdrriwxa'
- ClassName: 'liiukgedvdazianwgiyxfnxrvbvoozdr' WindowName: 'ixxccuatjpmkfojya'
- ClassName: 'ypcgjfujcvwshvkhmfnzmrqnct' WindowName: 'vrnnoeuoojjilxfmtr'
- ClassName: 'nnpokxhhtbajmdiwzzwqtk' WindowName: 'ikjswfotbzyysaljryguqirccvrvr'
- ClassName: 'czqacjrpbwstxxkitgzox' WindowName: 'amqmwrbawgqcwnh'
