Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\InetLoad.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'riiapnxdnmfmvfrgjhngfmiwlp' WindowName: 'mnjbfpgvjijbahbc'
- ClassName: 'mvzeolerleuuknwktuehzkgeqljbcs' WindowName: 'kdvwxyishcqtykztizjhsvyfamjclzxapxwgik'
- ClassName: 'ryteryrrivezwuwxaty' WindowName: 'wpvsstekqipwtkpsxhxyztsrylox'
- ClassName: 'hzzyysbearumhmswhhshjmdjhfe' WindowName: 'qcbdrhnsaduorlogslfdoiqe'
- ClassName: 'kmupzjxpqywpxuxw' WindowName: 'nvqybkmyuogrobvakdeaou'
- ClassName: 'hevvoammbsqjrseuuyqndeenaixcvodfwxsg' WindowName: 'jkwozpumdsfmvbizdqrmlcwwgqkmj'
- ClassName: 'avdpqcbtfuuatwsrxodstsjdyhmtvcfmjleu' WindowName: 'iarzwdkprbqihoiyijut'
- ClassName: 'garxwwfkxhbdefbtqo' WindowName: 'nturtwypkwcjgdzwbmhcxtzdo'
- ClassName: 'jxkezzlgtdaetlqpjjtxyvf' WindowName: 'mzmrtpxlyfuhsuirljmbflmm'
- ClassName: 'vjsjmfrwznruepotudpimharjolvmtkglpxe' WindowName: 'nwfhlazvznygfydjdkwudax'
- ClassName: 'skdjbfedmeyiwjwmhieddgrajmmd' WindowName: 'mkwxqfcikhekmlyzttqiglw'
- ClassName: 'emhpkzbthpwonzwdcervlbtbiqysubydtvwhf' WindowName: 'hwrdrkgckhcyhqjrkirwenjpjpkhnl'
- ClassName: 'asrddglohrldbiwczvanoztkuewahkse' WindowName: 'lowiekkadsbpyzwkjvsalrobuk'
- ClassName: 'fzbiojmgbcqwyprxgvcyeexskjwkw' WindowName: 'pacumcznerdfnzm'
- ClassName: 'qpsmfzuwsjkwgueikdgb' WindowName: 'lkjwxmnzufmuaimfd'
- ClassName: 'tjxdosahypmnfbohmapkssfzbysubxe' WindowName: 'cpsyozolqhadnyajdrxpgqxu'
- ClassName: 'serylwslsozuezfwhyvtciazmnffiyeqqptj' WindowName: 'vdkhvreenxbojqtjorj'
- ClassName: 'ssaduthrsdcagosemquknaoimbwaomifssogtw' WindowName: 'vqkdnrymljeavqdmhuzwwijhgwyhgu'
- ClassName: 'cdsernxvokqbmfcogahayuoi' WindowName: 'ytbyacmklennnceentqi'
- ClassName: 'wypqrxoplcattwsalgi' WindowName: 'ifcifvbzmouslttrmcfqsvdwn'
- ClassName: 'amjflafcefdwmuwtozprpcbblerzsmuvv' WindowName: 'mlhokfyboherhalisxlcxfumlwclqq'
- ClassName: 'ptgynrjldlvegzjwrpkduhnpkfvdw' WindowName: 'kcnvtirjoruftgramyoppuiiggcd'
- ClassName: 'nhacrlxyhonzxwxielrgfv' WindowName: 'mijhhgnpctzeziwtmgnsexbx'
- ClassName: 'hzrassdakzheuzxulfyaxnhwputtrfnux' WindowName: 'pwxmnlsonryurdfelegknmnfzui'
- ClassName: 'gnojxvfwlxqmjzxojaztgeazuibxatvfuftng' WindowName: 'yzeynnrmyiecaysijkhmw'
- ClassName: 'ixokwklcszhfzxfjatcvnihvjgpqdbqj' WindowName: 'rwnikcncfjcatca'
- ClassName: 'klubuxrdfdnqxzgzxqivkcmrda' WindowName: 'tsnfezeokshxtyqocwtoxg'
- ClassName: 'htuqrswlaxijgfbaudtkyulaeaahxjaqtbbnh' WindowName: 'ccdgpvfaxxmweknsue'
- ClassName: 'jpizyrlbncgbragugcuhewpbqtzvsmfywtw' WindowName: 'ueikoljztlrzshwwfrkcwmvgaucigwqw'
- ClassName: 'oeuxjsorytmikmlcqbpfguozehgiwtpiya' WindowName: 'awgjxqayhfxagpztybvhnspmw'
- ClassName: 'jmscuzjktejrtbpvrseskvehcrrcofi' WindowName: 'hqgsqhzkxpjspngnpbyaliyykabuskrdgxffmm'
- ClassName: 'ejecgmgdgceqryqaosqpd' WindowName: 'btksidcmirjvspkm'
- ClassName: 'nvlulswsdcyrmlmmwvn' WindowName: 'wbfwfvaselzmmmjukntkibxtmfwjlkhygphsm'
- ClassName: 'hbxikzczrjdafskspmtpgzebkpvfw' WindowName: 'bhpzcmlmwfafmemzclidxlvlrmrnqh'
- ClassName: 'cxoqkowsqztvxnwxdesbwrskzemayyhtfstf' WindowName: 'nzzoqazhltwcnjuqmyxxykgtvarplrpdwvbhpes'
- ClassName: 'ciwxjhnbceicptgwyelaogcdvylcfurdo' WindowName: 'szzxhrsslfvighrcfelzr'
- ClassName: 'blaeesghkigyrmqgklngitlv' WindowName: 'bysewqudnssmlplutkqfajelklnklxxtha'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
