Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsk2.tmp\InetLoad.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dvpjanbibuzelqwevovznzafirybhbqh' WindowName: 'lwjvuvashltjowhfynxhyxvzerfkjceku'
- ClassName: 'jvrapewtlohgsqmydhcz' WindowName: 'mcwnvryngfglnfzb'
- ClassName: 'zmuaggsyobrpvemwjephbppiblcswyhcqmyvd' WindowName: 'iqikcjutgmqdhqazxlblhooys'
- ClassName: 'mlprfwlnhqbsrspewupluwtqjofhby' WindowName: 'nebyszlkhvtieurt'
- ClassName: 'rqiipxkncmkauqdauxqledvfrhjfcfsktl' WindowName: 'obbtsrlmsbtcafhmq'
- ClassName: 'fdujekgunkamnvtbjyjqbv' WindowName: 'eywgwklnikgsbfkagehrkpcye'
- ClassName: 'guxqtucwytbwziavwnvewjiqrgpomdhmfizv' WindowName: 'wyugooaqcmsfbikbqouwb'
- ClassName: 'hxcrrmitgawxgjfgxzmdosmhojwqa' WindowName: 'ekgulvhhkcabvbv'
- ClassName: 'bfybqorvwqurnbaqnhapzn' WindowName: 'riufafkttxjjclpmhemmoosagfetfez'
- ClassName: 'yxtcvdofjzsbmfogs' WindowName: 'rnllkbgkcyowdeakdamsfthye'
- ClassName: 'oqkfptfbxrwgtsbpdaqiyxrkhqtmrvrgo' WindowName: 'msobqxhkiplmcorrgdxsjwwiafowrwrcjvu'
- ClassName: 'ndddmbltvuxybxyxynfnlfshsfnqkyfoan' WindowName: 'fsrpnrcsnmkvusgivfaqshbujbxntlpwjbzxb'
- ClassName: 'lyrxtbksufaqkrhwuwxlxey' WindowName: 'qmhimedwfgnhxdpmbkkm'
- ClassName: 'nwtwugxndseohzghaswqx' WindowName: 'oqtynurpjzodjjkzcwnmeeku'
- ClassName: 'cgobbsvtgzfjxmgxntbfuiagluegp' WindowName: 'yddquhzcjmhjienrubvkmdbqltpuntobn'
- ClassName: 'pjwgrtaziszobhpdkfrpuxf' WindowName: 'psqkrxhxiayroefwfhqbprjdstlxf'
- ClassName: 'gznowddcqfvdcukifqgmmyzqkykpvorwld' WindowName: 'txnbqcyzehkufort'
- ClassName: 'wcvnpraudjxmarmwvafynxmhhx' WindowName: 'fdcbzyeyrzmyvtbto'
- ClassName: 'tafpgpicghqsajmmljszv' WindowName: 'lviwawkwejjffdxz'
- ClassName: 'pumroygmnpzesmgdeajqkv' WindowName: 'fsskzpktmnypqaovgkqkjttyykrjogrlakzzbr'
- ClassName: 'alocbfgpoklnrybeh' WindowName: 'mfmdwnpksfezaorsjdpmn'
- ClassName: 'gvtzdttscpqotjrxspjogbyvnapxol' WindowName: 'zsehyjobusvzrbgzgfu'
- ClassName: 'oembyqeojmuihrq' WindowName: 'rtqozqtaiucubbmqxspox'
- ClassName: 'zoefpsennaiirvxzlbloohfjxsvbckwrxx' WindowName: 'rlfxhrjtotmtyuwsfomujjggfyddlvy'
- ClassName: 'xreyegwexvlnenvrvhtkvaidxkdvbdeio' WindowName: 'aolvrzoosarbilscyhhimgcw'
- ClassName: 'mgaisrbahueqxvcvpfjswjytahqyvcwb' WindowName: 'brdipqkcjdsnkhevqpmlniisjnhfadylhqry'
- ClassName: 'xmpzfcudbzlwbxfjriqbvopfjcxxozvzgfldhu' WindowName: 'wtrpdtbyfzhkhjqnqisthjfvw'
- ClassName: 'yhpwxmsobjlrljtbyouuoefwg' WindowName: 'nbxnagdxqjxdeowoht'
- ClassName: 'mmngiiptaapqndkhmwe' WindowName: 'ktgljcvscvfzgchpvdhzmkjlq'
- ClassName: 'zafomfcpzqiqnctlc' WindowName: 'rkhbdjwcajtrycthpeydqzbe'
- ClassName: 'mjqhzequkbhvyblgzucpsjhwkcnyarjqhdnoufw' WindowName: 'tkwiqmryjtopiisgywrisledeoijatlaxmjsm'
- ClassName: 'cugcjukemlyhzxwggzttmxo' WindowName: 'njhnysaczvgirwimzfmqjv'
- ClassName: 'nasfilhigmwhumbfvne' WindowName: 'cyygnveywmvleiilaoevji'
- ClassName: 'rsdztqgkcnhobordyvhbmuxcbzzrvzq' WindowName: 'sldklwpbwehvofqwoiixauajdirlzvwa'
- ClassName: 'gbiypjuvlxadpouoiiekblrvhdxehm' WindowName: 'ibshhoxcxjvigyhc'
- ClassName: 'cocgonimigzbfqehhkx' WindowName: 'dluxwcdtdjurwdpvqljqwxngtkafzpibn'
- ClassName: 'obnneszdlizhdluxffmnarlfe' WindowName: 'bdybnvgslmsdbmoejvmqur'
- ClassName: 'ufrpmmhprsumwqokgqz' WindowName: 'usywpnozkkyqreyefbifudagjtxkzfjglzca'
- ClassName: 'xizjszsoldpmftsrcgcseqvxxcp' WindowName: 'kfthdchkqapfijkpkrf'
- ClassName: 'vwloburjrukaqcuqkvye' WindowName: 'htldxzgkyjphdvxldhiaskyuuxyg'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'sqwsqwltxurbavyordoserasxjjqonxcjyherm' WindowName: 'fsfgmdsfzauibhqhykwtgewphdqbdoqhaxwlvpy'
