Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'rucarshuwgydsvetrjbkavprcm' WindowName: 'xkuazwbjoixxjlgmibrz'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'pxjneimswkybkskvsncnlnvoc' WindowName: 'upyuohddsmhjvrunsrtuitaisgtgodog'
- ClassName: 'dspaajmgcjxicirrwycicflmegzzguxxe' WindowName: 'qhpdelunzzfqddxbsqtfxznnihlwgngrszjsjki'
- ClassName: 'yhygnqwymzksoixonxpbqnfoiquvstiogfult' WindowName: 'aufoekzmjgfkonlucfcgylelwadwctwxxera'
- ClassName: 'hfslhhfmzzcpmhqihbnmxb' WindowName: 'wrjbelrxvaowmcftiavzihxo'
- ClassName: 'hyimenfhthksxwyurqgtfcukpcoe' WindowName: 'sxiesbtaqxmwrfjuygmvlcnf'
- ClassName: 'fnsxdhgiclolqvzegltbdisbahmnigtcpjuadrd' WindowName: 'knvmcrjetopoteejybyftosdjyvryqytiobh'
- ClassName: 'ngleqwqgxppcfnajkplmxrti' WindowName: 'kwiapjrhokbhophjtorshfjdtednxb'
- ClassName: 'dlqutjkkizjmrplvjjhvbkkrsmobbfvlfsfhv' WindowName: 'smlxurqkrdwpmjujtcenalubqasovmlpoxwv'
- ClassName: 'elhkhtpxkjoebckdqmoxplhkwwjz' WindowName: 'kssqckjbywcfyiwqyqlnjnzrwysxhqijmf'
- ClassName: 'ibndykypqvvsmmlofkukwqgjkssbumj' WindowName: 'iowfkloppanepmqwsnwdzjxzjcikyhyzmvoyipr'
- ClassName: 'uhzpnlhqlxmqidwsvdcwxnfj' WindowName: 'nbbzduqjpyxasfqircjvevqtqlhqc'
- ClassName: 'olggkpcrpcwhlfkjbfibckareedncsuphntzv' WindowName: 'jsjcyvzjqgvblglrwe'
- ClassName: 'fgwccturirtyvdvlsskbcanfbumclttslifxva' WindowName: 'jntwssxfgvrezawtqal'
- ClassName: 'nsurklrnfdsezlshzvraoxofbnlkztwexfmuf' WindowName: 'resgpwoguqudzpftn'
- ClassName: 'lwvfzndrpzshbibbasnuqoftzm' WindowName: 'fiayszjmfpihrekkwyrdotvqdlldkbqqfs'
- ClassName: 'osxvxjhlawfamsersqwbtclcppwlbfywqrau' WindowName: 'yfpjhniruhmzucfsoq'
- ClassName: 'uferyvwlxuynoxkjpivkhldzlb' WindowName: 'wailfzhihpgmewtgta'
- ClassName: 'djxrfjazbvytroparepekoloyfrsgjqxbtxonoa' WindowName: 'rlnipnnauxpatrqmuwnbpzkitepkkik'
- ClassName: 'yeuwdilcbekxmaaayllsiixymfmxj' WindowName: 'oujkprsiwobkapyuppliobfr'
- ClassName: 'jqvgyzuarfsqizbvvcaipxpejxengdygjz' WindowName: 'bvjjnbqrrnvgnpnojcauitrwcjrl'
- ClassName: 'yvencrsdqilwprrozknggjqxqwvrqtz' WindowName: 'hoalqwyhpgenshcskerfuh'
- ClassName: 'iqebgdhhrzbnrdnoyaoyoncyhqpsmckuobwejhu' WindowName: 'nhkimjsrgbcnpkqfpyjx'
- ClassName: 'jmcojykoayffeddioyhqt' WindowName: 'tkvwomfzkqdvkrpgsznyoy'
- ClassName: 'logjdxmctdvayzymimjivffynhkiiujfi' WindowName: 'mlfupzwnadhozoruadngs'
- ClassName: 'fdcwwawtksivstpwlcktiwuzbverxbp' WindowName: 'xyujkgftdkxgnslweja'
- ClassName: 'taazegbbliltfmjbudceemx' WindowName: 'fbtgmzscciaowlpfiflqlkgnhcarunsmnodq'
- ClassName: 'vrakvwbtnpncbsqrqfuqvoaqagprrvnrt' WindowName: 'gjutnfuigmqwvtiakqskbhfz'
- ClassName: 'jkuxozosgmmfmdsgsadytwsvifvfzoomhep' WindowName: 'xearltmbirjslwxiq'
- ClassName: 'ogbtiiummhzsjmjwydccrcqastt' WindowName: 'ublgcslbtnhmnhbbxbxyjolk'
- ClassName: 'kvmnhtxhrxrixkt' WindowName: 'bqimomaihfzwlxycpoogchqypreknxwejqcvo'
- ClassName: 'rctbujabcmhtuxpyxynayyxinlmnbdj' WindowName: 'wbhnafgtufkmzgpgfwberwed'
- ClassName: 'gitfgbrwhtijxhljntamzzlcqadzigyjurrwjs' WindowName: 'ayfxgqroenckuengjosjmtyedygbn'
- ClassName: 'dpvbgymnvayzdwqsdtpltessswbnknwde' WindowName: 'jowxnpwublnvjaaduuyc'
- ClassName: 'katvufazjchjerancpv' WindowName: 'enjfqemsnupinjmhotqybftoeqdoeibtchrezqh'
- ClassName: 'llwejryicslypkzjdylbuxkhnt' WindowName: 'mmmtmoazsfwoulmkksyawisdgfkmodezeiudz'
- ClassName: 'rdhiopvrjrywnasnxjfvaue' WindowName: 'kdwmlszaeqbatijamrzl'
- ClassName: 'fjwvdbjfrkueathfnzqgtkqotnu' WindowName: 'vutarenektxarjblmfcixswgympthhu'
- ClassName: 'nyhfvwgskdytdyjjbgosoqmuulgtvfsfd' WindowName: 'iqmgzhnqrulffhotadnjhf'
- ClassName: 'hjjvtvcmvggdmyltvohthbrempdykskvs' WindowName: 'gbbolggxpmftzalybxdkuohaitjrnmnpoyirttq'
- ClassName: 'wccqnsqowluxafo' WindowName: 'yibwhoklvyjeaxpdbrrzfxdvdmsvhrgdovxzq'
- ClassName: 'xdinitydkunfrtljlqrrqxegayssih' WindowName: 'rahauppcwbjhnfuvqurujskpcv'
- ClassName: 'mxflocbwqklphvfusvlrhsracuzlowqyex' WindowName: 'oyxhwfagssztcbihxlclthgxjkm'
