Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\InetLoad.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'emrvzoorytafaljpwbfwv' WindowName: 'jfaujarerewidpz'
- ClassName: 'wqsnjeuicmlujoefvyhhjnjhmlts' WindowName: 'scxghqjlaeuwciwvecu'
- ClassName: 'ulppppdypygsekioseartchasdkvyrur' WindowName: 'slqtqtqgqcmvtyjdf'
- ClassName: 'isyqddngcrmohmjafrmszpospzkmptldc' WindowName: 'rjetedzhnsyuiuchskhvjd'
- ClassName: 'jucjjnymptlzjuirakiksgnedqkzeuvkmxca' WindowName: 'nzssppqghtvfnctpmrimhoay'
- ClassName: 'zzmcusmxvlksxnrwndcnrxdncmiiytlambguvb' WindowName: 'ihulqarkjskhtdhhtbwjqkjrdguojuay'
- ClassName: 'qpayutehhibzttmaoeroosfhimkiglf' WindowName: 'tdwclcpnotcwnkkdhjdqqbdqthmawo'
- ClassName: 'ossjbhsihkppwbhxecqxusfqoieaogxgidkc' WindowName: 'tgfhotlqgufuffhnmwzjquwpcuffeyfkc'
- ClassName: 'dsudssmpmyrfodiorfzydwq' WindowName: 'fksournanliftvwzisrj'
- ClassName: 'luyytjlwbzaoksmrceeqoofcwelebkhec' WindowName: 'qrbtibqoledbpnvsudx'
- ClassName: 'wxbjuhwyfrourmbpxylkqumu' WindowName: 'vlacwnaqgmztyvcewv'
- ClassName: 'zhpupigkwlrknlvrcngzdovsjimuz' WindowName: 'jmyildxpdmajrcttduyuigwunpwusudk'
- ClassName: 'wdiprietkgfanegzjdhj' WindowName: 'dopgkjohnmenuvexdxruljisttdpgaaaov'
- ClassName: 'xectmghxbbpimsvxetfc' WindowName: 'brxoeaiukukiekb'
- ClassName: 'wojrxkgmnpomyvtfsinogepugmynemg' WindowName: 'epsvtiatawhwybiagm'
- ClassName: 'dfxjfcbtubdhevbpwa' WindowName: 'ollqkfgqeklpzehohabnbzldaqalpibsvoa'
- ClassName: 'ziccnjykwzgwcgqmmkzzxqxfb' WindowName: 'uuztcxbzkzroicoaoxcy'
- ClassName: 'qffrbtcqziqlzavcxvq' WindowName: 'stvqissomxputzd'
- ClassName: 'cnnpsttypywreildpxueriahkujlypw' WindowName: 'enpjwphyhudcrke'
- ClassName: 'pgcjsrbcvtbsfjuxdutsnjlsjeozrsuzepdnn' WindowName: 'bqcgipoevxwfixpxrtmqtpqegdzzurrkgbk'
- ClassName: 'oudbyhhvbeyrsgfjignghakpwptjq' WindowName: 'ugqxmfllfimkmbffdqkuuefc'
- ClassName: 'kaozhpdwiqqnyye' WindowName: 'nwudmxgeukchnovb'
- ClassName: 'sldkxzwzdlusqhnetgogrix' WindowName: 'nwrocwdprttfyjnvaxqelsaaulrktk'
- ClassName: 'tagghhbtdphehshyonrkbywnozo' WindowName: 'iaerbshedgwmjnwsvezdmspky'
- ClassName: 'ufpcqciavouwggredxltupkglrailnf' WindowName: 'akyyoktgobvebuthefhuwzlqhcxul'
- ClassName: 'wkngyydgnlsxyxwxvpzdmayhuvphfpfw' WindowName: 'yoswmpwruvoubllnaqceuyxtlnbzioehrgvbz'
- ClassName: 'ugaexdjcscvvdfjgbdvtkaiwgp' WindowName: 'rakjftdnidwkdjqkcpsryzdwdulmuhqxehef'
- ClassName: 'jqavbsukbjxyzoxpzqsrjxuijykyg' WindowName: 'eefvlphvnqbmcgq'
- ClassName: 'bdhtpawivyrttgkintzqbyxdhozvozrbdnltpvv' WindowName: 'cozknagdwcosnahurpy'
- ClassName: 'szucxxccsanhqdfptyxboq' WindowName: 'opptrzqjiqeegudvuaale'
- ClassName: 'nspcihrppgikjwgpb' WindowName: 'yembkfxrhvcoyauh'
- ClassName: 'yhxvidcsojvftvdhkqrylkbjkbhkwzhbxwv' WindowName: 'fyjyipftcmmaxbudutg'
- ClassName: 'yxutfowhggqpdejpdgdrwjttepyjsmvngmecxz' WindowName: 'zosxuencusokkwokbbpnywdhksucrncmnchrtvk'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'cjkmczxdlghvcpzriunv' WindowName: 'dmdbyoxlyilqqtvcvdizrjhcavfqbzmd'
- ClassName: 'xbtqwycgnngqhlhmfenxfrw' WindowName: 'bhjptibosrlatuhfqrmvucesusnkzvooxrizmp'
- ClassName: 'tqcpukyempjydxeak' WindowName: 'guhllbaxfcgnlxqunomkr'
- ClassName: 'nvmodzpzjgkclejyjrbhslxbssxcybx' WindowName: 'otreumgxdbfaeienilsatqdfnocwdedess'
- ClassName: 'axmaryeosmeedpwxftagvhpysgpaju' WindowName: 'jloxwrzzcqwypbddveossohrjlpzw'
- ClassName: 'ibvpvboxrqtrupcsqoocvgipueeskbc' WindowName: 'ugvzpnwxwayyedbjxdiabbffpxzyxo'
- ClassName: 'gbwqmbzjxlkulklngdqipsgsdjrxyecss' WindowName: 'faizfzlsakkbfcsoegevckpzglmvyoxuzdeup'
