Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'sghzdrqrltvquwkjqnvgy' WindowName: 'spzyxifdmzorhwoeltajdnnofi'
- ClassName: 'emqdvhsudzwgjtwlmizbd' WindowName: 'tyrlfhffyifatphifwgimvexwrlzifyvhmyy'
- ClassName: 'pndigjfmgokumgboakwsmbrwzjbcibqqp' WindowName: 'fdjlpvmymphlaxawgopypyjlmltebdhlihtww'
- ClassName: 'digfwtuzctasigcqvgswuphvpxepwlqnfyp' WindowName: 'jietgmdxruceduqwmlykgjcqwfwolfxttlksux'
- ClassName: 'cpjnlbnkqvuahfluamoxodrpcgiftusgd' WindowName: 'aruemyfyzwgsctgdbxo'
- ClassName: 'vrmsckwlnbyeuvgx' WindowName: 'aqnnawpouruvakfpltkxoccvjewwwtaovtz'
- ClassName: 'nsyyzwrhmohcfvu' WindowName: 'slefczwdofcktyzhgyk'
- ClassName: 'rajrtnvfgmwjrnicrnqtzoos' WindowName: 'dgfysdtjfatanwefkewgcgeadujlvycphxrqek'
- ClassName: 'zuumvpcturzsgtpqpnnaavmyjsq' WindowName: 'ltumrsaphbicmgthow'
- ClassName: 'aykxnrljethzpheucio' WindowName: 'bofuoycxcuabuqrsdldhedxezsk'
- ClassName: 'tfqtzomgepyahpasqsmh' WindowName: 'ekpzqnsffxjxceudco'
- ClassName: 'erdobjtcdnjuazyddaycnwi' WindowName: 'rnxozxbslaacoetnehvrvlzsipx'
- ClassName: 'vzdmuvsayhscjqgfjhnzegipwayljgehj' WindowName: 'xfkivmrebgegijoesvxn'
- ClassName: 'etxckbafglcayoeehqw' WindowName: 'ifepomovsouclgsadaihgppiehovvrtddtroxh'
- ClassName: 'qwnuqvtadjbufxakrpwegspbpknomhuymlgjiwp' WindowName: 'daxlevstyggvbjamehyxyglke'
- ClassName: 'hrkzlpdzoalkrkbyhiiivvpeieueuwmi' WindowName: 'omhmgsywvaulyex'
- ClassName: 'nllytimttfzhohgirnievcqonmm' WindowName: 'jbmzfdwazoymmzzmnrwolkdonyhyzqhyqidqj'
- ClassName: 'adwmsbjslzquupywba' WindowName: 'abuokiwutbdtdpimbbtzrhpxszjoegbjvqwxubu'
- ClassName: 'hywqskaziwwaemmqrsehxktpansgjt' WindowName: 'dgptqfrpnebokbdkspepojsnloequrwu'
- ClassName: 'evullaxgnbgmviowlokyejvdraigglxaozc' WindowName: 'pxxknuapszkzbrzcnqghfuyglbcdaufecwejv'
- ClassName: 'cjbgsttedntvmwf' WindowName: 'uhxjlgeykaxquqxpiotwsluuvknnqlrpwrrj'
- ClassName: 'tchfvpgdqzkikpaehjfzpdnhxcmuyli' WindowName: 'povwvgrwsnukrsmnedcuntnklzmlbjcsh'
- ClassName: 'oyrgfupyhpjhrxwxcccepc' WindowName: 'sqfhrtksqguvsgdtrut'
- ClassName: 'ngtbekakkdzzugjwgfyupwmvgxduoitwhxicj' WindowName: 'yueifapeqqpnqisgwebsqzozdx'
- ClassName: 'popnsieqhasoichxzejb' WindowName: 'bzjigcvzhouulqdvvyvlbqqsuysocgjjdrivur'
- ClassName: 'dnjkviywqzqeujlhmnznawynjilmhrtgpzxrdjf' WindowName: 'vwiwjffdtoauzevyytznupvkle'
- ClassName: 'phijxaiilnpnbzjcbwzldjkmwujtsfeyz' WindowName: 'uofysehubrpgnworeukdlncluecnrrt'
- ClassName: 'bhfltfoqiwjzzspzmdx' WindowName: 'nfxegjywoftqytjhzvhjutjdxwvfvhz'
- ClassName: 'ushzvmcnhfdofbxbzdfzpcncqedkhrauvr' WindowName: 'asnlrariprsmibbkkzo'
- ClassName: 'nihmzjzhbcpfemxlnatnzbiwrampdjklrw' WindowName: 'drsgunqprjeyumiqhlmyffsvdozpfqtscho'
- ClassName: 'cnqoxecprzbegstwysgdawymncigfy' WindowName: 'owqwbizeyyekkhum'
- ClassName: 'pxmnbosicegywpw' WindowName: 'gypaxcuobdmnlrzrfmahganxo'
- ClassName: 'rhzahxmpywxeqlqcenpztkseidkdpdqlblbqyem' WindowName: 'gzscdqlgkmpiswqacmiihqhhse'
- ClassName: 'hdkxumudswrvmkjnkshpj' WindowName: 'fwtqolxccynmhnrlumgxxilbvuqsu'
- ClassName: 'ojssdtoddfnsmipsrqamglzssgjkgzzyvhc' WindowName: 'ugnvcviyqftvdlqyfwldryierzyww'
- ClassName: 'owsyfdszphvtjfbccgqoit' WindowName: 'bxyzffwtopyecxiwfgoomridzrouvdoh'
- ClassName: 'ainihobgzzyvvtyc' WindowName: 'zswjivvwvcjpydlsbtyfqlgjoiiepdkqhdut'
- ClassName: 'jxwdiijeegiukryedzsansqzmevajrapmt' WindowName: 'ravtiwdxkukbfnmoqymcuio'
- ClassName: 'bsaqaypfxarbbpgjfccxnn' WindowName: 'tguxoqvegsqzsrrbiaciq'
- ClassName: 'sixffhroxszouwvsjs' WindowName: 'kdyxysintvzgzusaqtnfhghjtzccgjj'
- ClassName: 'vxprgiwsomdetgvhtwluicfknluyokys' WindowName: 'pfqskeekzlicfiksepmeaoybcxnumlnpuxhzc'
- ClassName: 'dmgncbpvexdujuwjnbplyqbofyjnuznejavaaal' WindowName: 'jeujuubtbynboeetdcrxzjuloklfbr'
- ClassName: 'ufxbhbwqpnwyeltteulmgjvasauyth' WindowName: 'bfqkoqdkfuognrckzdeoavaukikjlcaghf'
- ClassName: 'ytpyimtlckgxqmguyxqqredv' WindowName: 'pmomthoatsdcrqybvourdvzcdib'
