Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsk2.tmp\InetLoad.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\Math.dll
- %TEMP%\nsk2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ilwjhhnonjgwapijjotiafzix' WindowName: 'ullmyiznrocicnqezzmpeatatpjkzpvawqfg'
- ClassName: 'sgfpthkjielahunxxubplbzi' WindowName: 'narqfpqwrktchsjpwfsvlrirvwtamrlieabbxhw'
- ClassName: 'vszqvdmehswgpvdcd' WindowName: 'moghomclkpvmuaclxzhjfrzaemctkixbahdzd'
- ClassName: 'obeawlxpdnttqlyefelpkfohfgay' WindowName: 'jukcxdlddnugknsghk'
- ClassName: 'tjhjvyofpwisrpjzezcboqlggtfyln' WindowName: 'mgbbtyfpvhovwoquvlostfwwixocywcd'
- ClassName: 'mqscpfkcegtgopvzlomaichawehbmoe' WindowName: 'antbamveklkxifkuftxgcnvetak'
- ClassName: 'llluasxcykvluxjagunztv' WindowName: 'fvmiwhmfucqfshltvjsijheyktdpjdsrqwrdg'
- ClassName: 'gfoiehosqiehbtzokfsgzbdamatqexfp' WindowName: 'gsbdkczosknpqsaxnarjlb'
- ClassName: 'otdfitrsrccazbbyk' WindowName: 'bcapwrwozicbmltfk'
- ClassName: 'eshzncmzmkvrduxzktxtrktkapwtlsp' WindowName: 'ckeffckvpbdxpmbi'
- ClassName: 'ielwyytymzwmfxbofxsooflmtzybemgztqjkc' WindowName: 'vrqevtgpdgybwpnjfxmbepxgyradkuvdkm'
- ClassName: 'ikhulrdgiuqatsseknvlcvyqvbneznpickgzzsx' WindowName: 'ywnremjglbbvgmbnruqgh'
- ClassName: 'bajoanviorlhlnvflpi' WindowName: 'lrwrpxbpvatgvwjiovynmc'
- ClassName: 'jwhjastokhypjiqdgjjzjcpwhobsnezcyh' WindowName: 'eegsolebayelqrrq'
- ClassName: 'lbamhortfijvhairushdoscmpqgus' WindowName: 'iigvpgypsdxnntmdbzkwjmrkjowwovssrwuhznt'
- ClassName: 'oayicgymdcboyksvjxhh' WindowName: 'yejbvrheoifuatyfizg'
- ClassName: 'whvdiiizzhmhcvwstrnxgtajspkkwmgi' WindowName: 'hpjfiwowakbpbxejtarjwne'
- ClassName: 'gpgyicblwkabejlqrhqjttkajoslk' WindowName: 'ubgrketuyzgvvdcgsxjsqfey'
- ClassName: 'nnzhubzepddrcrmihekuqlrdwuxptz' WindowName: 'klhzhpqkxsqgltrpnjvpzmzdqonzc'
- ClassName: 'qxmtdvwvfkoooiwnzgogo' WindowName: 'cxztuzlvfcqykzat'
- ClassName: 'tcgoninjnazxifuxhftmebcwmqmbagumml' WindowName: 'cdukvpymomdfromuzzqygvdx'
- ClassName: 'exxgnlpkyifowifoqwaljejhina' WindowName: 'djufjjiazhkoivlnjv'
- ClassName: 'gguydsxtwwfllnatjgkujsfjjfvmfqeswdqts' WindowName: 'hyisgzkbdypkwidfooytxqqnlryn'
- ClassName: 'dhwipsipitwzymnwgwvhvygfcvagcbqqjhlzhuw' WindowName: 'hzpccmlimlhtmnnapejjimdsvztrtht'
- ClassName: 'utlagazttwujkiqvxppysxabj' WindowName: 'stlbybndgpsmmmunrabzfy'
- ClassName: 'coghvzzfllzdldmdrbhgpynqogglmhhwwc' WindowName: 'adpufpgunolpqnr'
- ClassName: 'sttkiupzxtvasppratslfvlfzexslkhtugv' WindowName: 'grzptwmnxdreuvyg'
- ClassName: 'wnlxopvomctyxwqgplpjudyieofb' WindowName: 'ucgpfvgekbdhpbghezrhlkkgqgoriditrkdg'
- ClassName: 'rchvateosjnozuxsirpvoxrs' WindowName: 'qqecsmysdwcjaqxvwkml'
- ClassName: 'emjqfulfkbqlfdksurgqrefecjr' WindowName: 'deuyqbdcwcvovdmywiqvrew'
- ClassName: 'grvxpxbedhebmssztqpjxgjtmlnwsdpryty' WindowName: 'whxaeylbabhphsuwbrdkekpjirgh'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'jzkmguxxnvipqducxslnzm' WindowName: 'trzorntsirgnebtlbihdqjs'
- ClassName: 'hzwtcyytwnpxuqdyftzouofntsyvqzmllbsp' WindowName: 'itbvbflytmjqawsvwcc'
- ClassName: 'xsjonfxlouduowsczkuvalpqfjof' WindowName: 'ktdmeagkdfezjjcxigxvbpl'
- ClassName: 'wjeuqszcuquvzxpyuyvcaihydovbec' WindowName: 'vatbecnrbtjejsoedbz'
- ClassName: 'gypvwnhlrsdmdvpcyhxnolmulajrydhwqoqblm' WindowName: 'oxvanrnmwaaepgnxbtnjdlyj'
- ClassName: 'xxrwwcwglcgkaydwnwdjsjsedaeoj' WindowName: 'zamaqlcgfjcjnuswjyj'
- ClassName: 'wvrxdyprhtxmqzjrzkduaphdkehvz' WindowName: 'oftxwdxptirumrvmtyeugdtigkpreuijcum'
