Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\InetLoad.dll
- %HOMEPATH%\Desktop\Internet Hao123nknk
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'fjkodmnjxgmmzrjnchsjaodhtoep' WindowName: 'tcbhqgsdflllhiakzurt'
- ClassName: 'ghkaewxlvhobpeokilat' WindowName: 'umrgkeoaztyitlsoqjbushisxzqwqb'
- ClassName: 'fscxsucrvuxnhgbnnn' WindowName: 'fwoqovgxdismptlnvdbercazcmrvqkvg'
- ClassName: 'tkkjhvhxpdcyoetxzsajbfdebzogkklgqsakga' WindowName: 'aslciawyetwcchzscrdpn'
- ClassName: 'xfxlehwfgwjxgvwmjjujgyysicjcs' WindowName: 'hsdjwusizvanvilfktrggqampujwalshqw'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'qdvuyzsrmexnpquiifo' WindowName: 'tgzdcvfnoyhnsolhmtaujbpojbqjqkkybi'
- ClassName: 'lodjcvnucutgbdurhz' WindowName: 'koxsthppjybpatkkxnucftx'
- ClassName: 'bnepnmsrilzjgkwb' WindowName: 'gqzzflcqeewjusowujkvidrhgphkfq'
- ClassName: 'omhkyhsocvhffommhgzkzctraduhhwpikdebupl' WindowName: 'rsskvatbzwekedgtlhwtagtewtzlwuiqeuwjzum'
- ClassName: 'ynsbyszwgmwlzskngfivbgdizikpvlvlisluu' WindowName: 'esvogbuoeptnmaznottexcvfsardbiqtoxlskik'
- ClassName: 'koztekdgmmuulbfpasaonnqiebeuxacxvg' WindowName: 'ipbsqvicdjyberkelfjlvexhvazebtlol'
- ClassName: 'kxecsykzayegsbueyflxdsnsuekz' WindowName: 'hicbjktuvurtlnqkxw'
- ClassName: 'xvoolyvdcjfdlkad' WindowName: 'lzozndoqyrciaylgxvhzdkmkxedrd'
- ClassName: 'yvigmuqcvijivliayjctndqoxqbagmpbizzt' WindowName: 'jpvbcpfpescayffwd'
- ClassName: 'tpvqibnvwcficdbldsatqrmjkvwpiczqnxcil' WindowName: 'sllfzjjarkskfmywt'
- ClassName: 'gqcfdkquwasjlfiqdowkquupidkfcyqxgdvfov' WindowName: 'mhpiviwyueoppvvd'
- ClassName: 'lzchnjfuetcjqguy' WindowName: 'uwcywhuidailavpzidsztmhpqk'
- ClassName: 'ytrxrawjfdvrjmfotiwjebnp' WindowName: 'lzesdxzkejoofaviwxqmnbs'
- ClassName: 'njmnahcdrqbdaginqzpohndvhqedgcxifsyseiy' WindowName: 'qgmnxuyuabfywsypgnxzuhwkgxbwzyifjys'
- ClassName: 'selqllhytkycwyitqsvtx' WindowName: 'rowttyzxejqyqqzhp'
- ClassName: 'eudqryzqfgyqjwrxixfuwfpmrxluopo' WindowName: 'ymvjjywhwlfmupggdmzympapfnbcojlronxbf'
- ClassName: 'hkavszwcgkykfnyzqqnxpo' WindowName: 'nyxthjrucwlalpdfrtngrmicetnvglfdyg'
- ClassName: 'josfrhfrnunywfriafdcrmqpw' WindowName: 'gstsndiwdkyvcedxkeywgkyxjjyisibn'
- ClassName: 'fitiykzdwkjbkxgwusoyqfrcuwxrqrrbkljdu' WindowName: 'zbwbctojzmwhthhpsetmpstihykexrisx'
- ClassName: 'scdknywcmjwdirpuxuwuxfjizq' WindowName: 'ezfxysrskogbndkkuprbrwbqrtwvsjhju'
- ClassName: 'uszhvzgvucgmajmuvky' WindowName: 'hewwfkorxvmigwnvdubyltkqerm'
- ClassName: 'xtgadwpmfundftginrcholfd' WindowName: 'bbiltadwciascsaqspuitgwcvhgimtmtm'
- ClassName: 'hldovbugiabqrwghclvbi' WindowName: 'sxdesngegctvrkpyseqbcqeisrlanpapzbegh'
- ClassName: 'ufolvqvbnogsxcxegchjuxxwmcemawxhtsnf' WindowName: 'tytuidelbgszvxoveqzwmubbsodpywjmgq'
- ClassName: 'awpumplpxgaxeswlwveqxdtzzurftnxwps' WindowName: 'ehlcnnaoxqkqnwusmwujozofdmzz'
- ClassName: 'hxijrtigdrmxmhyxoqjrokh' WindowName: 'jwumnmrijptfxrxyjrvg'
- ClassName: 'wamtppaoraflfywgxmxfkzudaxwxy' WindowName: 'zcbxlmyniixetrztsllxgycslnhyhkoehkpmz'
- ClassName: 'arogrnixrdkofgrbgzwjebyuzjtjgjphyjymt' WindowName: 'xlizcpyyqoffogwgrvxugzpkvswx'
- ClassName: 'dssqnwjwtuhtjuyrihledfsv' WindowName: 'klxqezmmdtzqjtelrlmbldf'
- ClassName: 'oskfcrbbhwxrghtjnkleiayz' WindowName: 'cmjfoygckbdgmch'
- ClassName: 'opceddtxcmfcmuhttp' WindowName: 'fsqmficxkpcsnqft'
- ClassName: 'akidjafewjsrtqfolnckxawazgblu' WindowName: 'qqeekesokymvhalbieqcksmabgakboieaykvo'
- ClassName: 'hikaoulhvxkutlvzo' WindowName: 'jpjzbdnsbcfguqvvmmkroy'
- ClassName: 'hggowxqlzgmsoofvgebcftxxpuvh' WindowName: 'jhkmjyufyzdvnmerrmmknnakeuavchaqo'
- ClassName: 'lgpwqusuywgupjwhgkmayd' WindowName: 'zuncxyrqgvtfaruzkyuwxopzfyydbruafjtwbhm'
