Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsk2.tmp\InetLoad.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'yfsukrvqfwndenbavjprxdiydhijq' WindowName: 'tpqtbzmrtjcibebwemptxloqkpjzam'
- ClassName: 'lzokhwntsmdjxtxarigjpbxmg' WindowName: 'gxqidrldfnmsxvvnpujgmjkaatcrmdu'
- ClassName: 'hutlwkbprigxacxmofotajtzobaec' WindowName: 'pkkeluwfvsffvdrznv'
- ClassName: 'ibomkdooqzdyjcbarackrrmmexzzaljqpi' WindowName: 'xxnhhhmnryawvomccrpflyflu'
- ClassName: 'fwnascbdlwmczknyvriitpiiayztxgzvwtzvj' WindowName: 'mvfltcbdaryzoqpqxzmbqnzrzbioqoshffgqlz'
- ClassName: 'ekmmtatwpdzslpyolyjfvhocoodecakmfgtao' WindowName: 'danmxouyltcsynmbxtfvdmqojawlcynsxlcyj'
- ClassName: 'toffxqmrbsnbmrkfdhajipaqgajllvwvbqqop' WindowName: 'rzmzywmlnbaxvup'
- ClassName: 'qtxkudtryajqnooarruodhzptuxoak' WindowName: 'ojsokfdwgxldeutmqidtqexldzqikedkkhgol'
- ClassName: 'rcmafvwevpnvozlzzsj' WindowName: 'henukzjisgttkqevzdys'
- ClassName: 'azwqkucvzlveopibkhckha' WindowName: 'sapgjkzzcqqvoawtg'
- ClassName: 'efssvoigpaxchkqwwjtscllpsjparaqfngtkao' WindowName: 'satkwpvkrwyleeqitxwvnfbozkl'
- ClassName: 'bodoxizsznkrnefuzxmqugk' WindowName: 'geudpemjzwmsijybjggzwopn'
- ClassName: 'yvmtcjrchmillhtsxgexacxs' WindowName: 'vrlpuczmvakdfgbgbefdxfwftlhfjiwhxihxdd'
- ClassName: 'lardomojgbyzxqhbbesichjmiphlcszldsjycy' WindowName: 'qfvymppxfxosjwb'
- ClassName: 'odfhxsqdcigxpeqkqwudnooijkhzb' WindowName: 'iwrvdnqqzymamjqezgnpujpnl'
- ClassName: 'vtierfwxdomduluwyv' WindowName: 'qicletfdjcfmdywcckyjvkxsvekeh'
- ClassName: 'itcqfjnapzytmeewojqfyfqxdieerlgcokvhf' WindowName: 'tpxvciudkrdsrfdntrsgnkbbzc'
- ClassName: 'saksvlqbferkouvkn' WindowName: 'gvvfeymfeyppdyukngdmequjyvaqcoplaqbqb'
- ClassName: 'lumnxcasldsmtqzkdpvldri' WindowName: 'vcegqynxkgqkygtsyiqyoxufbkgghzdsg'
- ClassName: 'ljhkeligrbocafocpzww' WindowName: 'rjvdrqifonuhdsawxcqpsrbffpd'
- ClassName: 'jxfnlixcunuairnbyieudruz' WindowName: 'jutavxjgmwlyxricnqeaw'
- ClassName: 'uuxdbpmyavcratlnhwwdotkznyrtnohkjifgxdy' WindowName: 'myvydsvhvfxgsgzwppgvcwmnfiujalapv'
- ClassName: 'ghdeviepyrivfoetx' WindowName: 'mkxevvwtojhbcjavtrrmdzpmwoxrnsypulfxy'
- ClassName: 'zgkrwhfqjtswvrbfbitkxwrwrcqdlk' WindowName: 'atlhtzmvxowfmvnge'
- ClassName: 'sgwkprwtsndoeobr' WindowName: 'asrapouxzidkqjivhnyniyrsjge'
- ClassName: 'gbzkdjmypqtybzoaknymchjw' WindowName: 'hhydpaqmzmcypmwmxmb'
- ClassName: 'lcchivgiyiivkyjqiiyklrsmdxpjukxjkz' WindowName: 'qiuaacrhakeaoaxvifcjskbzmz'
- ClassName: 'pxrtzsemqlvhbnrjvo' WindowName: 'axxljplclzdxjuvhsfeyjhjfcppgvldqbzmydru'
- ClassName: 'tlkltbmqsmzmcahpunracpbnahzovj' WindowName: 'atbupqtlimfmgjccehxwitemyakamcfpm'
- ClassName: 'guaxijkoysabqzvwoefqxbabqwaqhkvicegzikm' WindowName: 'ysjsmykawjqjtcaznv'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'kwbzotkkqzzezpwrvuzxgtmuagujpg' WindowName: 'wrufdvsvdyujocrggnxcl'
- ClassName: 'itdcuaflwjxnnxfrmryvtpylkx' WindowName: 'wpdruxfausxlntfkwaixtsv'
- ClassName: 'htuohauvpnyxojhelkeljtvjpixryy' WindowName: 'eioapoppyzroantjxpgoqmikevkufqhdpri'
- ClassName: 'mybbrzytrgtxawfoxlqmyacthjfhfl' WindowName: 'yzddeltjatfodwvjztdbxjzlrkkdomboiani'
- ClassName: 'gunzsbvitbchfazdetqidtlp' WindowName: 'fshbjzteplomwmhewt'
- ClassName: 'emsvnxgtumomyegwyduaso' WindowName: 'gsrzsvwdekcmivfxblsjjvt'
- ClassName: 'xzugsjreavwuaoplslpd' WindowName: 'levgdhmeiponzey'
