Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst2.tmp\InetLoad.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nst2.tmp\System.dll
- %TEMP%\nst2.tmp\Math.dll
- %TEMP%\nst2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bzxfkngwvyxcsayvjdkbwrzdqfa' WindowName: 'xriadclhhlgufsisxourguvkhneinyjajbx'
- ClassName: 'itncpecnjlynqsipoazazmonfwhrlmhxkmrmzh' WindowName: 'lyhhkcfrfhfzzjxrv'
- ClassName: 'alfapldyssvholqpvvmwphp' WindowName: 'lkixdydeicbcnyepcgb'
- ClassName: 'niiimmmoqqvdlrmrrhxqjdrzxpjauklfakzw' WindowName: 'rwnsqwjdwdvhnykcbgakoscrdnq'
- ClassName: 'tdzhtsazrgvhdezsgpjytenbqdbgs' WindowName: 'akxslkrechcvxhjtgq'
- ClassName: 'pvjcvolljwaafhrjhvia' WindowName: 'rquazubxmiacbjdlojkznkbidtooml'
- ClassName: 'dutsedkkwmpbrngocdxf' WindowName: 'wedecdoademjbzeecadvlwqefyztvmsh'
- ClassName: 'scfnjegzpkrvjamadccm' WindowName: 'qknqmfalzryzltgpyrk'
- ClassName: 'yojwaxrqybuklzvxzmm' WindowName: 'szgbvfxkzlqikquewdbnbepwjpibuqxwahjq'
- ClassName: 'texxllibpeviqozngkwmonqxa' WindowName: 'ehkmywpeimmjptsrya'
- ClassName: 'zjpaaprbptcupkztzjqpuxa' WindowName: 'tvvexawasapoeczvowvzoerdzeh'
- ClassName: 'oyfufutbhnwpodxahmqbbshh' WindowName: 'lcqhsnwbaxfaasybbvreloizxioxccsstfry'
- ClassName: 'auginflfggsjkcsqzmvpcdgenlkkcykyykjms' WindowName: 'chmwqmigrygaerjfrfiykumxlfwxvqahkfa'
- ClassName: 'mpnsonqnbixpzbikqggezliaewdatudk' WindowName: 'avrecuegtefpgwydzdrcexcgutijrsdvz'
- ClassName: 'osutqdyoiugkwlrgi' WindowName: 'yiyicbyvwokffyxnlfhvomdpjmhfb'
- ClassName: 'xzwcuoxqthzmayd' WindowName: 'uvvnkuxurvbncayvwpwtrrdbcgfkpv'
- ClassName: 'hrxztmcggfzydgotasbadhiaxolxl' WindowName: 'jlaqulplltotard'
- ClassName: 'fscnbfqenvdwcyibitkbkwvsjham' WindowName: 'snkqstfdqyarysodrljrqomsprjeioyfjt'
- ClassName: 'jddnfhtrhnxwxoyyqv' WindowName: 'tbiptzupsxvfxjghbrglohm'
- ClassName: 'tcleqikwtrphtacksnehrgvabmmkiyo' WindowName: 'gtxslgmeiqdpomd'
- ClassName: 'wylmnaqnyodaugc' WindowName: 'apomrcxkjujylqrjoodjkhaqdpckzfcitleex'
- ClassName: 'cjqlqmdizagpxfyubrbtctxxcolrygtfh' WindowName: 'yzsrhytevpfojfxofoiginjkkbgkjimxedd'
- ClassName: 'iotdsrkwvnnmfqovdvmuwvrrna' WindowName: 'ixmimmesthsawtgyoisejxymrwjjcscqfkprnny'
- ClassName: 'luginafdvtfhtskqbu' WindowName: 'xbjjcfdljbpkoisevesbcmf'
- ClassName: 'qdhdcjjusucyjqxffrswmlr' WindowName: 'jtqwmhlpxggueumndho'
- ClassName: 'rnvnsrxxccyltnmdbcuysne' WindowName: 'gmnehiezybfkigosgbxiqjre'
- ClassName: 'xhkelmuigzhoromjxywqfyxybvl' WindowName: 'cllafgtlgxdvzznyjoxd'
- ClassName: 'nqplldxalhudiotqmng' WindowName: 'mmkuxboxyieurtqbnavdgcnvoytosn'
- ClassName: 'huxurbvpphesfvjoioc' WindowName: 'wefgjyjytedbkjwclmicixkamrsomtoevs'
- ClassName: 'nfrgzoajktyohrhwjiw' WindowName: 'qobmhzokstcbtoxfwirm'
- ClassName: 'iralqfwkdhiexfbbyqqptbvanerc' WindowName: 'bgabltptzdheudstfeqpde'
- ClassName: 'fpupcgrgijzdgqnkgrikxcajnezc' WindowName: 'hveiwxezcbqfmgqlqvovl'
- ClassName: 'mtyizgaqfassntgbezrxfrrzirsoxu' WindowName: 'tcijdruwerphbitxyaxdrtygqnag'
- ClassName: 'ouhxmhvljwcpfyinszbdrdoqucgkzxdr' WindowName: 'myenmrmxfbsyyxgxyezpcitwuubjksjprxskvt'
- ClassName: 'odnygbduwmcigdudbdrshlcczouaexgx' WindowName: 'jqtljhofsntynxvaxglslngkzingtrdnfdnch'
- ClassName: 'jqlrdippnfeanpcaculsxsneqrrewyjnilih' WindowName: 'gfojxvmnkopkzzwpbuvzietylnwcxyrfdlmwcdj'
- ClassName: 'fmrlylfpbdvibwczhqsuothqkjhlrbcqas' WindowName: 'ynmldiruhovbelqanitkcftmqltpamyeqhtmsyg'
- ClassName: 'ueqsxmwbnapfdmywksggtlpvqv' WindowName: 'rpgfnaafwzyjeqfbnau'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
