Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsk2.tmp\InetLoad.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'aipewffeuysxcspkknmpukslwbernusdjsq' WindowName: 'sitjqkqfwyqpcupyxar'
- ClassName: 'wvihhqncirggiwzirqxsvvkfjkfnryg' WindowName: 'fyfmolysdawxlbryvwsyiwmojaqswljiyy'
- ClassName: 'eqhnykgqrdrlxsvxzkafghizwstqqelv' WindowName: 'vobfzhvkwyjnzudoaimkmacpbrccksjnk'
- ClassName: 'hbuwrnyyrpkniqhvcgjh' WindowName: 'owauzymtpoffohzmgpyknzpwomdjr'
- ClassName: 'bdbosvmrpygxwinjwrsvzxrtlczbrwtbjgcns' WindowName: 'rlgdzxjkuclngxwavf'
- ClassName: 'tgkigkgucfjkfzthblemdvlfazatclzwm' WindowName: 'rqnrjqyvctfrihjbfhycgthffqtjercnacmvfh'
- ClassName: 'gpgifjnttitlzkpxzhyqekmhfwumntos' WindowName: 'uipmqwaddnixwgzuqeyohhsfnnietb'
- ClassName: 'qmeozkfjoxkylvycfebmbfgpawftstxpcroby' WindowName: 'pvfmnrjmvfucvfcqtynozxqawlybmcct'
- ClassName: 'clvcffzmyziuxadoblvdzkivce' WindowName: 'gvyradobvkgsjgkdhprvkjh'
- ClassName: 'bhbdauyogkrefveuotfvxkyzvdckzdbecna' WindowName: 'tidaiofnqvnrfhyzyqhxr'
- ClassName: 'qtmprjklawsqwzcfnfmjxyobcxhmaeuaqnxy' WindowName: 'dzvylnykejzrqilqnuxrmqrbjfqxmtfalxowpfk'
- ClassName: 'jaqjcfinvqwdczxurruswbqvgaq' WindowName: 'blsgyjvlpitxvnzrwgup'
- ClassName: 'gywwcwcyrbahtvh' WindowName: 'denpmyuzrgauuhouachwwvohrtsgodlrjihqq'
- ClassName: 'yrinuygazkqjukadkchfdgbsspljugskaumso' WindowName: 'evyddcksdctntahqw'
- ClassName: 'nsnevriutrxzcecpvigbbl' WindowName: 'aviwtrvprdrbovqgmyabiqyyakyqqgw'
- ClassName: 'sobpcconslksddzces' WindowName: 'prezpqwimmebbdbbavfaqbcofvohcq'
- ClassName: 'xkcahweriplzvmkf' WindowName: 'bledgarnpbawrnrikwgubkgweay'
- ClassName: 'fpgrpqslnoooawttrnzhrumrrpgguzkujsjs' WindowName: 'dtaleujbbgnvpwpdmpmbllbnjbim'
- ClassName: 'ffxuzcaabiovaxtuixompwwbqiaobgorytuvkdj' WindowName: 'ijzuyrwrhswdedf'
- ClassName: 'ccmmmshdsumpnrulrdddvnxeudqgk' WindowName: 'xqnnbhzrgqgnmtclgsfhhfljjpa'
- ClassName: 'slzjmxpsrntuywablyglqlcdmywqunlzmxps' WindowName: 'cksroiyptotxlqgnmagjc'
- ClassName: 'oehrbqzecmhqzbltejmnmwrqmvucxqgon' WindowName: 'vmhytebwpbwfdxztpengddvuks'
- ClassName: 'wfbncebmobkzqwhlgbgbebwywxiuzanbz' WindowName: 'odwgxzcwbargbrkbrwmsplnhtqwlekdz'
- ClassName: 'sgnxkfzevcoynsqhfxiamzagcisivga' WindowName: 'liayjslmzgckkxpqtpznodxflgyeyydwqcmdfw'
- ClassName: 'hinudhrzndkkmsecdduxjhefadua' WindowName: 'vrrawtytzjuvzojeynrrszky'
- ClassName: 'okjzidcqldlnzfmn' WindowName: 'kohkbohsdabkikfzquesflfryscuzxvzjma'
- ClassName: 'esnmwqfoxblqkhtgnmlcjsmaaznvujg' WindowName: 'mnnthxbwqrizomdsqjzeyzlnfvowpil'
- ClassName: 'bltxnyewhtyejfzqzfyputwiyscwvti' WindowName: 'aufjasopntsemvxmhj'
- ClassName: 'afpbrjnlizvaxozlaw' WindowName: 'zirkqvettzrfzmppv'
- ClassName: 'zawueohgijnxsslobyvamcpmc' WindowName: 'vmcswznfbtiyokplzjtzqobhzdgr'
- ClassName: 'cjahziptkagfjzzz' WindowName: 'bramipvxwontvosiv'
- ClassName: 'lzrbnhlesilpiavkgsowzukyupzk' WindowName: 'sttmeidlpfwqcfwmecw'
- ClassName: 'hjbbxjjmcprtqaeksndrxmchhvoylxmuhgpa' WindowName: 'msjmslsjzplhdubrxugfriokwrbvwpzfcob'
- ClassName: 'msowflshonafsxpaebrxxfvfspkhpjn' WindowName: 'hppvcdtaqiffhdwjsiyawtqahz'
- ClassName: 'szlekcybdlzythvnujswmb' WindowName: 'wvbotmslolfkkbybhnzthzshpjkfy'
- ClassName: 'oueynobfersymyapqizx' WindowName: 'ubfzyewhtqusiqcp'
- ClassName: 'conjpfhivfijmurmz' WindowName: 'zdqhqvkdjvxxubjsjwlkrwtvvsccpaqf'
- ClassName: 'slzfdcawibnbtahnfrliamhjfivkbycglk' WindowName: 'fqojdwfekyofgjfaeprctkxqxdiviavvqjrnruc'
- ClassName: 'qoaelsayqtzgbrkesnfjxswxiw' WindowName: 'ulunkwycwubnciap'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'udnqwllyhkpxldmqihn' WindowName: 'xdicvtbgjeapcqwqvuyvzlumlh'
- ClassName: 'wrmiosksejukfixqcqmnzhrrlfpcapfdm' WindowName: 'bzwynbewbscwfxw'
- ClassName: 'wjtmtcslydvyeqxwchs' WindowName: 'iydqfvijxtouqybqheazbnm'
- ClassName: 'xfydyqobxlvtohybaxpsihbatiktsigeexobqn' WindowName: 'jvptvdafqgxpsokbcyyzintfeesvefwogxzquj'
- ClassName: 'vndxmxiulohsddhlqcpxvqivasmgvfjvmic' WindowName: 'xzlvsjynnkkobxfmysszvayrzwpaugi'
