Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsk2.tmp\NSISdl.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\NSISdl.dll
- %TEMP%\nsk2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xictaudiqtercvf' WindowName: 'gesuxnxxgjkcswgxhkzrzqvmtjxtlourr'
- ClassName: 'tqqcgxjffqqtkqjsqx' WindowName: 'klxnekpzmjthbmsjsixyjfyxqht'
- ClassName: 'cnaxvnxjrcelnhzwsykn' WindowName: 'ywzuiezjsluqdpytcgjxzhvjnyyhgtltfmkg'
- ClassName: 'qplhyindiltycgsindzl' WindowName: 'ljkuvsvngqnfyvykewgwevuq'
- ClassName: 'ubcvjkxiddnamklxpojztrwxhgspmybqwzm' WindowName: 'sakuvenetvblmhhgpqq'
- ClassName: 'oqtekvxmlkjsnpttilpzssyoc' WindowName: 'lerzzwnzvejfbekxacrvtrewumgqqqwgcjn'
- ClassName: 'ekqauurjnsteouefftxqyktnjxcxphtm' WindowName: 'zwnknssczcbmwinzeeauyeqqfmynumouka'
- ClassName: 'dppkcayggregqsxhby' WindowName: 'mfbtrnzutgjaujbmqzlgkealrphxhoafm'
- ClassName: 'eymuolbhvottqsszlipacdzwbrnb' WindowName: 'ldvcgaoenzgqrvgwbidgteyokhqqxvzrlzw'
- ClassName: 'jbrpffmtcfbtsdtghlgxnumydzxktxufidcgx' WindowName: 'qfmdcqdekpaslbmgwmnlzqazsoad'
- ClassName: 'pqzaftjfmqueknwbiudjfwmuzklmxkuazeljkfi' WindowName: 'eblpeoogafpwciwcfrc'
- ClassName: 'ucmbrbvmngjytvvihfzojdnqcnxlnnvcv' WindowName: 'anibpsypaewegzxygeszgrnkvanlkjymgxeo'
- ClassName: 'wgezirthdoptnuslpahofkrzthwsstohkadud' WindowName: 'zhavuxkohhtegvmslmwyndtskhvoyrjwdpd'
- ClassName: 'kbdobxdhbkfzectrhbwocrcbbnfuw' WindowName: 'cmgjfluwtubfjmggvavzzyplmcnoh'
- ClassName: 'sbjemhzgnqdhdreefc' WindowName: 'qychehkqgpsnxkpkfmivopa'
- ClassName: 'skxpbypmhjdowhapjemnkbareod' WindowName: 'fthuwmmlfojnvqbs'
- ClassName: 'noegcgdfmfonhkzapznjfkgtrgv' WindowName: 'mtbkkdtbruayzytnxgoajrpvvuvvlqs'
- ClassName: 'cfwctoekwfxifuiqu' WindowName: 'degddprrurxvusupztcoackegjodud'
- ClassName: 'fhufgcpguimfgktuuqpfszawwycgxvtj' WindowName: 'doovustewrhulziuegdasdilszvhipphsv'
- ClassName: 'houfpkvmpnobvkrcakjmhufqyb' WindowName: 'nplyvwyvtiqzqzcdazhpnxggofa'
- ClassName: 'wjfibtmwbbhdvcmudhwzoykolpfapw' WindowName: 'uejbiwnqmlbdmoilbvaksfxmvnfqekmvqaqxrv'
- ClassName: 'seaddhokvhesxcyjakcgetodsfeyibb' WindowName: 'rthyheendtasdhuyfhuzscmmmkuebsmxax'
- ClassName: 'kamixyywshcwpkvqfonwofkewgd' WindowName: 'jhcxsrzckwtncmfbhduku'
- ClassName: 'tkvxqpoiozfjmyajdmwqihfmmlvszzcsyhdix' WindowName: 'zrqstovvqphtvdpkyygbw'
- ClassName: 'wulhbubjaeqogeahghmsoxlreho' WindowName: 'bvdbgtzckoaljdmunpkwgnk'
- ClassName: 'frsahkpguwwrftwbdkhulkvu' WindowName: 'acihjwgemxtokustgzalwtrylljcfrdnfpuo'
- ClassName: 'hoeukubaslrqhyuhhosqw' WindowName: 'zwelmtzuajndlbobxuyg'
- ClassName: 'mlrlxhhmmwdlcwvdxdhryrhqquzd' WindowName: 'pkoovcbahdeipdutrzfrmqe'
- ClassName: 'kohzpgeplqynxwrmpjvxvpysxrngogxjl' WindowName: 'azanppvhbkitafvqszxmaarrkclruqdxeltjm'
- ClassName: 'fdpomqszwsuwhtqqjdekbxjfkqxtydiypmsxnea' WindowName: 'agxjveahmhzdnnqpcmwsecatrooqoybt'
- ClassName: 'gwwyfuvbpmdwlyhszxlklknibkxdw' WindowName: 'vggaivkuotdgyargowowupea'
- ClassName: 'ujxpdjsgakogktkrtsfezj' WindowName: 'fpvaggriqihbokszrimcgc'
- ClassName: 'fijgjfeziqeqztvmxbmetkzr' WindowName: 'xourwtxfrqqjnxhimieja'
- ClassName: 'dqjrrtkdfdurbtwkrekrxpybkcylnchiupj' WindowName: 'xactrfuyrmdyvnepeylqyfnckcjeaqrebowfvto'
- ClassName: 'fljjxnxrlnzfamht' WindowName: 'xmdememjalvhannnkmdhuiwblmwfvexn'
- ClassName: 'bgvsyoaonkgkwrnfzsjydtbmdzvl' WindowName: 'dtxertwhjqbbagjcvjqnnhhqbrqqtlnmccgsoy'
- ClassName: 'hgppxfexnhlkvpumlgcorcammgb' WindowName: 'ujmshvmugcdynpjdqtdhok'
- ClassName: 'oforisbtddkvyjq' WindowName: 'iywqzducoxknivabrweuwautmtcbshnpoodoam'
- ClassName: 'zfhnqddxlinothnheajx' WindowName: 'qljknyckqnuxbvvraqpixjgkpbxcc'
- ClassName: 'yojjycimuqovitihhlayripadzazfa' WindowName: 'wossnyswlgwhmeao'
- ClassName: 'raatxwgdobozjiqhpljsadhxovwdqxeiilnx' WindowName: 'nfyswrywijiwgaqt'
- ClassName: 'ipnrgvkzcqakvogtetbxjdlohfl' WindowName: 'wkqvonwnvzcernyqplujmr'
- ClassName: 'ahxusecryzawsmkb' WindowName: 'zbeooofsaiobowivnkvwnepbtonepgiqmgnbups'
