Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsk2.tmp\InetLoad.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'wakydmwuarihqqufckhqnuqywzvmyxutnyy' WindowName: 'nhhtyftwdoamzeteztzccq'
- ClassName: 'xeuxypqqendcdjhhhvgzsfkpfwfzhaufcztupc' WindowName: 'zturwctxpfmwqztthronytykgwerirtnmob'
- ClassName: 'deieciqvdwqyhvehzeewiax' WindowName: 'jgpvusnmbphecsw'
- ClassName: 'wqdeevnpajkjfmckpghjx' WindowName: 'tpxylxtnupuyxnbpyqhiktnl'
- ClassName: 'nixixzfvpkmghzehatismpbpblvrzwiil' WindowName: 'yqrcqwyhebjjdeunr'
- ClassName: 'lhitpowrxaplcrqlf' WindowName: 'msozczgkduxpiazovacypekyeisrazgypftey'
- ClassName: 'qnpygmijgoshqpnlgnwvlzvusoqoswuwfs' WindowName: 'ztaslebphpflraxdbtbbfqu'
- ClassName: 'meovgbjnaokvtswzjpjro' WindowName: 'ilmublecsyxsfzzuawzbvtysswjnqdbvvav'
- ClassName: 'mmwtoguygqyvfdwne' WindowName: 'ugluweyuzvgdxmgzkj'
- ClassName: 'mavlbxwwjuclhhvkxuraygbftpkmfebgswxq' WindowName: 'qdiyuezjalxwicajzvwhonmngjoyhqb'
- ClassName: 'vhlqkmtbmnvyqptwfbndb' WindowName: 'wtiayvjuwuanywcgacv'
- ClassName: 'oquiabanucqewswkbycdkrlhb' WindowName: 'qrdrmemzsscnickpdkvgymtlwltygit'
- ClassName: 'pdbxzxhqacmumtx' WindowName: 'rdroweplfjmoxdqlejwlnp'
- ClassName: 'koehlssrqpwfwzbegxjkkkkixyjxzmdgwyl' WindowName: 'iyacueevvoydqvtgiteqauoph'
- ClassName: 'naaymbuamxxfpadlulchkvxzliount' WindowName: 'tbzzpzkkgnxyzxvrgbvw'
- ClassName: 'ciwnynvciguzovqhmniykgvcqaxvvr' WindowName: 'jcjziaftbizwkclhdbzntxzprshxgocyceqk'
- ClassName: 'wtpacmjaeofhdnzxmebgqlqzquslngpip' WindowName: 'gftbjoqxwlvcimcvozsrlvllr'
- ClassName: 'zyhbokaislfgplnbntlthqr' WindowName: 'qpqxlplwmwayrvcxjczpxadznwhpjvimkmil'
- ClassName: 'xaavtffglijlrtcvszplraag' WindowName: 'hzauibcjxirrwgbtpudhzkurdxubvtefkn'
- ClassName: 'smdqixquyymrmvtxqmgfwczef' WindowName: 'tnwrsoyyfyqdhfdpolxxufpocwovffgufrbori'
- ClassName: 'udhewfjdfdpweatfiocsvkojwdjjzjzfdfln' WindowName: 'wccuvofmuijllmytrd'
- ClassName: 'lbuguuaqnpfvkeeawwoabrdaiyeqeek' WindowName: 'ocyilplbmlmsqaawffprlckidndmyibfo'
- ClassName: 'srawcnbfbujezqd' WindowName: 'zuvqcnglokcolqgbcyknxeoqdyptfmx'
- ClassName: 'otiszhiiucclrfgtwnezezyqkhukob' WindowName: 'tfbdejutmfzwzsstmo'
- ClassName: 'wmliyahqqyyzbbefevggasizmiyx' WindowName: 'ruphxthqqixiwdixvic'
- ClassName: 'pwfllfbkbldqzfjc' WindowName: 'nmmsocryjjjmhvigydkoyvnorwsjeeeopxb'
- ClassName: 'fsoqknwqnyptthrnkxexjr' WindowName: 'ddwiynmgeverszbmhzpisbttgjzcrdsrxthk'
- ClassName: 'lbnmwdsqvwmafewfbdvqtwlsnqktxwztbicxetd' WindowName: 'drsftwuyogaqfulkiwxmtdauanetimwfenkv'
- ClassName: 'khwdhghtyypzjvmgprcvgqeobyjxfy' WindowName: 'ydltrgkdbcnrnpfp'
- ClassName: 'jgrgtgtpnjeupukeq' WindowName: 'axnykorebktpjxdhjjiymvxkpjerwtcqaxiryj'
- ClassName: 'hbpgkcyzqcrjvvezhhcvxubbrdlnfug' WindowName: 'fnttekndnorwyzxvvwjhlgeswtddvnuaxi'
- ClassName: 'luomrbuclorccexqemqfqptdfdztjgwf' WindowName: 'wzctpaihlrhfhsy'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'rmpuongqcrqeivmdye' WindowName: 'spdjiftfejcwwzvkcel'
- ClassName: 'dlbcydhoamiujdujbkuzhrzuyjxiyaiop' WindowName: 'jjcrkkvjbidrtwiizw'
- ClassName: 'cnsihpjdaobdctobthlwqoceezhlaxtwrmft' WindowName: 'jrrmttucsdmvvsffowy'
- ClassName: 'fstumxqrrxykvxzjzqv' WindowName: 'tkjzhddagppksnawjwehlwyb'
