Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsk2.tmp\NSISdl.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\NSISdl.dll
- %TEMP%\nsk2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bamfxiswvymzksujdobssofbvmauqaitgtkkd' WindowName: 'mnyxjhoehpamcctcwxmxlobdzcefkwumw'
- ClassName: 'gxydergdtgxagakegxoovdojq' WindowName: 'iztyowhrvwejetoiupsbuhcfjfvifkxfraszah'
- ClassName: 'negdlzyeledxtum' WindowName: 'hvsqwfynppubyqoyfoazlgrmwclst'
- ClassName: 'kxbfjniuoxmytdqtgvvsjlsf' WindowName: 'ynohwqcnnevquxp'
- ClassName: 'qbjlpjmctsdcjvqtosdcoizkcontjcwwfzvca' WindowName: 'wgapubfnmpwhasvfeflakedlschnjgcxv'
- ClassName: 'bdosdfwgsnvantvzrdwarnegxa' WindowName: 'bklwimdgmzyilqlv'
- ClassName: 'czktfrjrfnqaynccexlw' WindowName: 'jcjizjmejjsqcccuevyovd'
- ClassName: 'iiviijwrpevgydltshrlasxkbtsuatienn' WindowName: 'sntasmxjjhbopmpfjey'
- ClassName: 'uqlhilumojsrhnjwf' WindowName: 'nkgvhvkztqfxdzczadwmhpshpysmludbjodq'
- ClassName: 'zmtuxrcqxvdgtjlqpzflcjrdvgkfhfuujbybyat' WindowName: 'cnhfplgxkrhykndsdom'
- ClassName: 'qvevsewjlajmhratqcbhuiegjoxvxn' WindowName: 'wluaawvodnxtxatofbiifi'
- ClassName: 'ltzzgvbvspamfhjust' WindowName: 'fakumxeouevwmkvwkqqiuzn'
- ClassName: 'jvqlpnclwcqeyrtrpsuy' WindowName: 'aouvqyjowctnwvazdpjzfzyoz'
- ClassName: 'vmziviszculfhxn' WindowName: 'hgoshlyxqlbhlhnlivmjt'
- ClassName: 'zrhoxwnuqrdrpebvb' WindowName: 'jodsagxwdzhiwnqyyz'
- ClassName: 'ukyewgvpmplmdbvvtjfeiymtfacslsveca' WindowName: 'nunrzupsltwamivelpb'
- ClassName: 'nmomivkfxvtfrpmehpuogzaqvrjgpgkkoggz' WindowName: 'hpyarcojeugfttiuhkpyqljkyipinqfjx'
- ClassName: 'fnmfqfyxbmtpxolk' WindowName: 'pkbojptjxeiyvkzenyguegggvpmqmqhny'
- ClassName: 'fhzdhglvcgrzjthhuqkhse' WindowName: 'spdxnlwoopdyjyefnrbvsjwrfjhdppbkw'
- ClassName: 'tcgdynnxpftinpbzbmikkaxyopcipntczja' WindowName: 'gxouinphzvthoqeiqvawnntpuluquaimovzat'
- ClassName: 'zabpelgliyztbsmyujxxkealoekspcagt' WindowName: 'pllqviksamxyjjdfofevj'
- ClassName: 'jnzbahipkirwbryzjnjasdgusiltlwm' WindowName: 'pjiqqozrcexwulifxqilrwdvevdqendndl'
- ClassName: 'nxkkhdcfmsxbpxmyj' WindowName: 'yzttjyodrkyvaokhlhbnivjmvuxicddapsvb'
- ClassName: 'dvbdopohrkcdktgszrbqogudat' WindowName: 'qwwpvznlykkwghlcqcvosgdgbfjrmfwjw'
- ClassName: 'zqchiaeycsujeycmftirmgvrayu' WindowName: 'upgxjpkebxveqbglfkhasdbwemklucosbsducey'
- ClassName: 'vmzjhqwptdgsqwbwhaivuixzebgjjtbv' WindowName: 'gkdcccwkbcgegxnrjvckmfcdlw'
- ClassName: 'aflrbcmgfpjqxdqoyonpmjzotccdwscgvnbz' WindowName: 'vdplxqmywyiwwewcpcdusljzbjflssftdsay'
- ClassName: 'foronsurqbseasr' WindowName: 'lqqjihziltcqknyiddiuxpetchmaihlpse'
- ClassName: 'kowxmllwecglggthedpmrkdprhyluri' WindowName: 'uqvjhrmkzpzrotctaiqozlmdfvvsorbswplx'
- ClassName: 'hqhdaxadmwprgfispgpbuceajrkfgfgf' WindowName: 'iknzbabdublxqmxtknjtec'
- ClassName: 'qshhxdcegzicimicsvvihgzcsxz' WindowName: 'zsuwjnbmggodchhpbcmwjgagciwhnbqymwnqwx'
- ClassName: 'eiuxsrqqpxddwnqfmroerwwlmemdupfygadke' WindowName: 'jtlpwujjrqowkakvi'
- ClassName: 'mxzdvbpldypvlyfbjngvujombalknhubktk' WindowName: 'ersiahqukcqdotqngxdhjkbdculzyuzome'
- ClassName: 'gubxkacgsnczodg' WindowName: 'pahpzpdzeusbyfjklmdpfvndogudblrshx'
- ClassName: 'kitepgglmpqtsptlxqqehntjr' WindowName: 'igbstvxlxexkvpnxewzdsbjbdxtrinbtfnmdb'
- ClassName: 'mbnqmzqnjcykntlaiftug' WindowName: 'pjtcyiqmffhnvonnotdoi'
- ClassName: 'owhbejwodzwjhjczgjqcwddyfh' WindowName: 'tdteelwqtvvjeoonmjmiqdftebkkduazolph'
