Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\InetLoad.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xapewbrhfuezjbcspeuyf' WindowName: 'ffogzjhjkyjkyefqykvjxeibsvaj'
- ClassName: 'gfmjpqyzfvamobwzfqplx' WindowName: 'yfgjwzrarejcxwwduskozgqquslnxgas'
- ClassName: 'hdofcyyrzsxjssptdyhijzjk' WindowName: 'wquossgtukakraqhchcbvpwzcpceucpmrjwk'
- ClassName: 'jilzhtzjvudcuxmbkuqklfxawngwym' WindowName: 'uknhekyrgukbfkzipnjfuwcuq'
- ClassName: 'mcyovhbyaduagejdqpfqazmnqu' WindowName: 'rxbwlkbizafwlicb'
- ClassName: 'jguqnkzmylpgeumjnrrl' WindowName: 'tozepzntqaupvvwhahqviqrqmyhmbyywi'
- ClassName: 'zvbmfhhrehflepivvbfdglmlzcu' WindowName: 'ecjvpsfehtbajczgermrqxjphtfpkffktmaeow'
- ClassName: 'hmuorkafyporkutij' WindowName: 'ikdnrezdeglusmplwbl'
- ClassName: 'uzqxincyfuhuqpmlsplylhlm' WindowName: 'vreuoqncjdmrxvhckyqyxqu'
- ClassName: 'winqrhnpfyepncrokdtj' WindowName: 'arfeintijtnvanhexg'
- ClassName: 'iezhdkypvwdxxkcxgcwflsfsgcsbobuwhuc' WindowName: 'kytkcgyxzqikcwcmlvjgozmmytazowbfy'
- ClassName: 'jgqfgxpvhyrnxhmxejkhhiapt' WindowName: 'otnmeqfhicnvrklfh'
- ClassName: 'vwwqsctsinuelijbwodmpmaupxdtwvl' WindowName: 'nbffhzimuwoingkbybee'
- ClassName: 'lhedizhmrkprprfdwdlilnk' WindowName: 'ezldzunvuuetkgciomdfpfpwikiqozqmuxqoj'
- ClassName: 'kxgsufexbwhvgxrrydtoedfk' WindowName: 'rzfpaezgowmuspmcdoiceo'
- ClassName: 'yftxtbbiirdnvjvugywlriawioevfxvmkjs' WindowName: 'sijspyaubfhctnhdiganygnxq'
- ClassName: 'wtpgzvakeodlurulrpcjynpueusqpxzq' WindowName: 'donlyoszvzdduayvzt'
- ClassName: 'yrtbuhbdcpuxlrraks' WindowName: 'cihbqqfgsvlgijcmlbxlxdfbjzbdliinraa'
- ClassName: 'eriwyargjmtfkhobmvrnsdxlqvkcjqyjhq' WindowName: 'wmzqqjpscqmifbxfimfqafdwqtizqaprlzmtzo'
- ClassName: 'dghkkmpzkhprnyzitvrngbfyhdlrabnnfyx' WindowName: 'ghhqcarfdzoegbnqemqwdisinadvyqco'
- ClassName: 'wasfzsjrdjaadfvvuwlbkulnudumqa' WindowName: 'zchjbcxmgvnsrcqsiukblrbjebwtka'
- ClassName: 'pwxegjjyfgltaphgqg' WindowName: 'qregdzaswkkuuvvddbxscglnagycfzznrjlgmn'
- ClassName: 'pynxuvfsrekbilrtrniqlunxpu' WindowName: 'rtlzvcrwaaninlbrsynjdnkqdqvowi'
- ClassName: 'ghmoxwdawqysmgbguvfaewxfgtpuabcegbskios' WindowName: 'cdhysongdqzrcfvlq'
- ClassName: 'vnjajqqugwydjpz' WindowName: 'gpaxctzpwozpfzscfwltcqrdx'
- ClassName: 'dkdjdglcfcfsyjujahjg' WindowName: 'opqetlvgxellkidcvl'
- ClassName: 'onzolkasqiusikinv' WindowName: 'eudcgssmwpavtrrbqhrfaxwhcun'
- ClassName: 'yckxgfhvaihemrc' WindowName: 'inlujxjfowzerngglmwcpebyvjabz'
- ClassName: 'kdfbdyhqnkozctumfgytduznhketzuwfayuqu' WindowName: 'yjwbknweutljgvquocyrzuz'
- ClassName: 'kkwbfkphpkluenixoxvogltggkfjndihgpsvoma' WindowName: 'wglfzvlnxobmafanhbkjvudzlavpllkhtpizv'
- ClassName: 'cfdisvsyamyevtedccskfvfr' WindowName: 'equfayrzcvixgsuvx'
- ClassName: 'gpwuylggusfxvjzgenvxtvi' WindowName: 'enlpwyroktcrsxahswqndeivzvssxljgdbzrcbu'
- ClassName: 'neoefttxkdbwyryljteqlg' WindowName: 'xwzdtqnteviwavj'
- ClassName: 'fsohhfwpdwrjbvblzsougtlnifexzijxnce' WindowName: 'rlfmmjmiizsjqqclenoqdkw'
- ClassName: 'tiqwriginjxyghoqjphwufiqdzjcdly' WindowName: 'cajxacjxuznrccrtjcomiwfarnhsdb'
- ClassName: 'rccepnpfvdjvxiemikjppnq' WindowName: 'eqvqvzbtofnlphplirhphrdvdp'
- ClassName: 'rfibcagbcmqoflq' WindowName: 'qiyekolylwprqqv'
- ClassName: 'frhirjzkflrlclzclobyuczfxwfatqx' WindowName: 'muwggotzjeopkegfgxskjbzfgzympv'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'hyavwqyviteejblzfchfiyuobzyacuyxkhz' WindowName: 'znocskuucrtoywuhu'
- ClassName: 'ggucydqdvdqswjmmdtstymqrojkujckaqrytzg' WindowName: 'jtzlasknghfxkdawmisgqudnddxo'
- ClassName: 'dazbplezhfcmdmlqbtllixm' WindowName: 'efqorcjlriykflielkwalkznevglglfeasnlahx'
- ClassName: 'dscqxhrwfhsavgezkfsjmycvowfkbqdxgpabcg' WindowName: 'qzhtijmnpfxydkawassnzgilmpgw'
- ClassName: 'xzkqijibkfkomkqvmavlzdqgl' WindowName: 'mplmtxpgeytebotukaqlruajjstcqatzxg'
- ClassName: 'hyhrypwpgbbnfobmhkcewhkyqpmkovyaozkgvam' WindowName: 'coiixomamuqtcfqydfwxrhuzwt'
- ClassName: 'gkwndhiotvnohzwqgbnpopyjrhotnmdrv' WindowName: 'ryskjdewhrjdancftsuiajtfqlcsa'
- ClassName: 'vinhoxbgnxevxozwgikxguvzomirbxwspbjie' WindowName: 'jkvzjvudumfdofihdezmq'
- ClassName: 'xnzwbehofbccbcltmpfbxhhknmgrxslloou' WindowName: 'ebqdismschhfsfccvkcrdjibdj'
