Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsk2.tmp\InetLoad.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'edwygrhfpeanmozkupefnomiffsajxhixztwmdv' WindowName: 'atpisdpgltamorgbjssaduyjuft'
- ClassName: 'qsckwnpggofbvdb' WindowName: 'cnhcrekxbndtmemhm'
- ClassName: 'htikvamnxrhunaqusz' WindowName: 'ybhgortwyokxkahqdwardaakepetawcci'
- ClassName: 'hzyllpspndanimhfkkgvpgsvyrlqqbgkjy' WindowName: 'mqhbhvnaszndszf'
- ClassName: 'cufmwwxxzqijevqittptxoxfvmqonecklrq' WindowName: 'vnqkezfijwlmgtoavuzljxjd'
- ClassName: 'hdgaytukppjepyoqewvsmanxrhce' WindowName: 'lmrsnkjchgrkdyqyjspgo'
- ClassName: 'goopjsjhmczfwhh' WindowName: 'ienbqbymwpcrxrxlocxatyhhjer'
- ClassName: 'waforsbeebaopjyxri' WindowName: 'fxyjcrssopwnpxjyiduacavqxv'
- ClassName: 'ijwowvsowsbhswwvoilrbkeasyjyjxdxenvli' WindowName: 'quceipotglhsgqyiohwsmmzvdnde'
- ClassName: 'jvccesztzbqjjhokhjkjccpvnuasug' WindowName: 'bmhqdpxblfpcwolasgvbl'
- ClassName: 'uzmwailpuzodkchdneishoxddos' WindowName: 'uwtwqsjlljacaqqdhifzqiylmesiylge'
- ClassName: 'hgckhlyadwdwtbotdwqnbxieeamsv' WindowName: 'zyagictwvnecexjbyjknsirlmhreekz'
- ClassName: 'rmjuxvqushpedsgjaeztawqwuy' WindowName: 'vnrkyeiqyatrqsxfjmgfppftieakpqozvoyz'
- ClassName: 'fzznyvbsvzcgisvajizzrtyrid' WindowName: 'yrderqlmbpazgnzcbpljslxaviiealowjcu'
- ClassName: 'mfqiajetxvvgusqimnxwhhvvruw' WindowName: 'vpjjmzstyqleibhxfoiqsbpcho'
- ClassName: 'mslsqcjyrrkhsekdxtzs' WindowName: 'jnzitahlwkvvnyylcvxzgoatockvoghrwn'
- ClassName: 'ghubcdthqqcdpqsjs' WindowName: 'ewjhuvnbqgqywqpfhlxomccznslmysokeoew'
- ClassName: 'ezdvorquntjezgoztxqxszrxgcmrkjsohmsnr' WindowName: 'yphuialdieuyaaznujffqgvur'
- ClassName: 'njvkxmtazofnmphiajcvijzyuiaz' WindowName: 'llvwphuhqdefzlecqomvxqzcphyuxzndknkd'
- ClassName: 'gmtkwjgnguirhpgsakyaxlada' WindowName: 'hpvxvjauvhgucgdvklzpeuepoxnvwvam'
- ClassName: 'quqwakbjhgwsrphqtiznbaxgrnqdqpoxy' WindowName: 'btooqwlvkffgasivk'
- ClassName: 'stgeilfkitiamqnqfdvemy' WindowName: 'tawrsmrvcezowxqvqbcm'
- ClassName: 'ovcbynakztssqxgplmkde' WindowName: 'bodiutcdbszpkklzms'
- ClassName: 'llahojetytbubtgtfpuqolxvodtdusm' WindowName: 'pgthudgjocpovfemohnnaahnfimwdxvqmcegrgd'
- ClassName: 'shpgxoosxmvxqrcwhvfsjyfkxd' WindowName: 'qieksnhctsfodqyjemhixrhqttfmouxwaav'
- ClassName: 'brgtejffznajpjoykqulhxhtrkuewuso' WindowName: 'lfecmxblxyrdyzsixffbgzrbf'
- ClassName: 'jzbtncpxhjvnkiiedogpliq' WindowName: 'lffmvqybxgebihszgaruwfxpk'
- ClassName: 'wdvnhmmcgnmarfivdstzigmfhfrxo' WindowName: 'equyckynyykimbfeiediojb'
- ClassName: 'vtifgeijnbxyvmqnoixtodvgmruplkjnel' WindowName: 'lmtszhaqepindsf'
- ClassName: 'isyirvvhalnfqqxkmnlkmkevp' WindowName: 'kmpqsdbivcqxrkdstpxvahrfnuiouvfo'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'cuxrcvlgegkfylkqqqogrykcunfzumx' WindowName: 'tzgqmhqmzeaaagoqmtdaqfco'
- ClassName: 'nhuwbjkigexspuzkzapjpgyidodxoboanvs' WindowName: 'sghokjkidrikdibifzudonhbrjlqwxndg'
- ClassName: 'kvllxrnexnqyaxftmrvevv' WindowName: 'ylvartgrxolaxsmtu'
- ClassName: 'monqdhoptcheeogkccmccdhqiruxea' WindowName: 'wswqbkxglzvgblllcwhqezmolkqqcoa'
- ClassName: 'kwrexdrjiaqefaylzzgln' WindowName: 'zcrnvwssrhcduwmaedamczqnoarqbvtax'
- ClassName: 'auuhcokfdtdbumtntlqh' WindowName: 'nnqvpuempjuvewpfnpkjlazqxitinffxx'
- ClassName: 'jcuagotnkydyktxuomzvpwfglkllmxwl' WindowName: 'cipiuegkknyuaordiysmocdxsznaajtzorl'
- ClassName: 'xbbimncvgqnkszysdzwwuqbtfc' WindowName: 'hzzjnqjktxoctieocr'
