Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsk2.tmp\NSISdl.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\NSISdl.dll
- %TEMP%\nsk2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'sqdukxqvyqpetiyjpghdes' WindowName: 'aqvavsctmdjwzwnuqoyvnzenngvxhlkilr'
- ClassName: 'xrhjeckkjulseyossxdtgzdfe' WindowName: 'nqqvyhwdbmhptrhkadlbxnkt'
- ClassName: 'cqmhrrwxxwclflhrxsqolyxfzd' WindowName: 'zqidqbnxhjqakayglurcipeopvji'
- ClassName: 'jbmayxbpzqkbsdyuaipbpqq' WindowName: 'jfvjxwlvarjdxvlwyytmylkrwsayewqitxbqjc'
- ClassName: 'owgparfswolkrfxgxkwlvymn' WindowName: 'sqfdgjwqtkpnncxfrolbhrndxlvvjwfebf'
- ClassName: 'mdaahsmkvvriizgfodmld' WindowName: 'gyvqqmwtohdlapgkiirx'
- ClassName: 'mfwiccdrtanlgvaqubytwpqxgrl' WindowName: 'npclxlukszpwhxgmjyrym'
- ClassName: 'faarjqgmpuotvpmfdrxn' WindowName: 'uiqdcintvefaktthhhxo'
- ClassName: 'dzydxgdtwlltjoojqgckawhkujwdtovzxjllotz' WindowName: 'sdxiwimaiozdoedtxrn'
- ClassName: 'pzlxqqvtkaxvvsfaeqcxjgzmaqqobagt' WindowName: 'zonfppjayqxxymcomidscjepxmudigygzi'
- ClassName: 'ysshlffgsjpevbehaimopdeccn' WindowName: 'wxrkjjknawyrizwojmrhaglomnphbsdz'
- ClassName: 'pfxgbrficpmjcnkwtdnnudr' WindowName: 'yyprrelpddsvbencudytiobarsoxmu'
- ClassName: 'nmidndybteplsktspgko' WindowName: 'dexknvdqdurrislpgf'
- ClassName: 'qovqbivirmhohxjnizk' WindowName: 'ymnrjdvxtepznhnifuevazgfucbhdtfgnktdgh'
- ClassName: 'myqjbhljgfgrcozhamwnov' WindowName: 'eloutdmvytcowper'
- ClassName: 'gzddjcsoebheisuroiesprj' WindowName: 'hivnbyhuicwfvxtbepupgrb'
- ClassName: 'ersmlmctzkdghlsbdhvqsjwdbivzka' WindowName: 'muvutfrpzqdfewnqupsordif'
- ClassName: 'almxktapepprsmszxqivzmfatwqezlropt' WindowName: 'iqfqvlqwqvlyehjvhir'
- ClassName: 'rligdsczfwsiujbxkzclydkcft' WindowName: 'wnggjrnilbooygsrjadhedoazt'
- ClassName: 'ecmzdkycydwuwasbwgzkvuuxfbrmpmfc' WindowName: 'dilnrnpytjgvsufizb'
- ClassName: 'slqbyfbmoabfobgghfednkgpaakvvdbmx' WindowName: 'txvzdvdfwbcbkfxbyjmwpkyg'
- ClassName: 'lmwrqbrmxhdeeubpafkfenamxsrsjfyh' WindowName: 'pjfmnsckheyizttrbgqgngjm'
- ClassName: 'hgmmpcuilxhajreekopzarbhajgbgnz' WindowName: 'qyfnbqfbcgrekngvsyotctxrnylm'
- ClassName: 'nubwkgmxqtovxduqpuoayyande' WindowName: 'dojdymonxxxjjzduzgozywkll'
- ClassName: 'cpyzcpoohxcosaznoflaipji' WindowName: 'kscybkrxsjnjflbpnqfyanvylqgtkz'
- ClassName: 'hwayiogxquzflsxkzblvhdkdttlffcwklchzl' WindowName: 'nsvaotqqbxjdwkdswaaomudkcqbuvgnslxqup'
- ClassName: 'qjveqtdnpglahhvkwuufsqtqjov' WindowName: 'prfllivohiyndkmzapvxkxsizgehqwzajjo'
- ClassName: 'zcxsssukwuyhzcgjwvzdkkmdgz' WindowName: 'wqnocqpldywcbjuj'
- ClassName: 'uzerkohpuxetmtfekmbvlwbbrhepdyge' WindowName: 'jabbbsjgcgftnplrqtukawgsujzpx'
- ClassName: 'uywygzxhxzobqtzyfxemoeldsxxoyytvewx' WindowName: 'bnluawbqpxvghipccsxbwshn'
- ClassName: 'hrwyfsdqktbxmarjltqkgyfbcvddfsf' WindowName: 'wocvovhahnubsejayrdjhmbstjjozgbmb'
- ClassName: 'bsekngasverrprhkgiipmjadpjxflgjmmlpdh' WindowName: 'lhztcnalyqhbujp'
- ClassName: 'ggytlsvicklzukydwgebmilwuojlzqmsnka' WindowName: 'ttwgohmxcmwxyjbogtitul'
- ClassName: 'nsjngcuiaidweevtq' WindowName: 'ezfzehttmjgaszkotqbaeahw'
- ClassName: 'smneeooflukjwjgdnfplfms' WindowName: 'xpgbljcezezniyax'
- ClassName: 'mmebchhovgpdmspvhtkfqseixqfrhfqpuf' WindowName: 'ckmcsechvasjqzywtlts'
- ClassName: 'vzgsbrdghrfiszxywoveriilzeebghstm' WindowName: 'jniqcdsvybsfpnvieswlffgnckxbqwrfrttt'
- ClassName: 'ivmuvyqifrvfvcouakawrxojty' WindowName: 'zgdkbukzditpnoqtsczjxpiivuorizxus'
- ClassName: 'cygxzmqdwmuricyuxblhbhahwhydhnvcxpi' WindowName: 'dwmhsknvpavjbctgrwqhpmtptxrazrohmurzc'
- ClassName: 'xcewrxwtpgmfuiebvjgmhhdznlokayhawfjfrrd' WindowName: 'baihslbhlpiwxayzq'
- ClassName: 'yzsvbgbwymbcrusiqlqisiuuts' WindowName: 'ohyptntwtychcwyqrhcoucmbxdzmoqzixodgvi'
