Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'hgzyhiexzprvfmuslfnxbxaacrjhavp' WindowName: 'hkaybrrxdmufrcuxihbxjdewcawfkbpq'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'olgqoklepyxfwmojwgo' WindowName: 'psgenzdbievsntlvqflytbcdyyjlqpghwic'
- ClassName: 'jpetpbnqbsqpglnmkdpgctxrokedwnihtlx' WindowName: 'hiejdookcfejqmm'
- ClassName: 'pidlnnpoeuczewmzlmyrmaooy' WindowName: 'zhoeszgcijicwsysx'
- ClassName: 'mlsaifthtdxsnksxtutmvhacuidwmfipgyw' WindowName: 'sqceyqwizzmyyzjjyhbbsatpginnqdb'
- ClassName: 'eqikeetybvbedpxbbhqu' WindowName: 'sikonpdmjoqudzhlldfvg'
- ClassName: 'inkxzjkfnllucimofnddomzsjknc' WindowName: 'sjzkeqhczwkqgxpcyk'
- ClassName: 'vraatrxyhbighfasxorbkquepiyadqjowj' WindowName: 'ujcgmzecpyqqetbnzpewbn'
- ClassName: 'cagxgvtfbnprutsmhmrxosigskytjzxk' WindowName: 'enznsoprfnkarpzdulsadgiesmg'
- ClassName: 'kcmzwxxffpcsfnhdwwdpmbehitcntyplnwrh' WindowName: 'evjrlfzqxwsbsuhhrbwdamwijpachsdjeseh'
- ClassName: 'fdoejptqgsjfeyhykyqcryxujjwi' WindowName: 'rgdtgruupcykuhuqcbop'
- ClassName: 'udfditmisqhxhymikohkvjesusfaspcjlrfdh' WindowName: 'jyvecfefpsgjtahvagvgleeywlgcz'
- ClassName: 'pfgigscubwnzqdvoywylnladi' WindowName: 'acswsapmqymnkhhdqkupnokftzhvym'
- ClassName: 'rniethiojsixfhddswuqjv' WindowName: 'wjkyycqwgbdtzvyhmcobta'
- ClassName: 'apvkplbxoaaxkqyvbqwztcucakddhgbulz' WindowName: 'bihptqtowuzwcgpnz'
- ClassName: 'rmawqewahuujrifgudpytzivftddyijyvlcwbfp' WindowName: 'bmojwciqeotmbkqfarvrwqkuhlkqsyhiy'
- ClassName: 'awmsrkckpcqoopzyykcnialwezp' WindowName: 'hmzicemkvorugobfug'
- ClassName: 'vyanmdvcapsmgqvcqgawjjdauuyegpceiag' WindowName: 'wgnqrlnnbamshfgcfyxguuhwoclpkkw'
- ClassName: 'clajxvnzclczinkvidkfzlmfezhy' WindowName: 'wyftxublnbfhvuqfzzndwiyzzcpgsnn'
- ClassName: 'khpshniwvnsayeep' WindowName: 'ivtyoavswdfhzdegrlthkovnykdfzdlbkbqqf'
- ClassName: 'ducenogaconfnrhviryjht' WindowName: 'rhuknshldicsbgnfo'
- ClassName: 'pwpjfkyvwdliwfhyjczc' WindowName: 'rgwlbrbdukvtijgpuisgapjgjbvj'
- ClassName: 'xibiqothcefmvpoopwyh' WindowName: 'lbqghrfwspfrpjagagqljcjt'
- ClassName: 'revqljltfkalsfejjpzkutevcqddah' WindowName: 'pqxlwqjmtwgnzjkv'
- ClassName: 'flzguuhqbgjybvbrghcihchbuulmqgmsfwoww' WindowName: 'rkqnjsyedyveksq'
- ClassName: 'lebexdhsvoopirzaa' WindowName: 'vtgutsatwxoolpxhocyamkjmiqfrs'
- ClassName: 'iuvpedwqowwfqqtvsw' WindowName: 'oquentesuzaiqtrdnflywhvgkzsttbgcqnf'
- ClassName: 'kkhmjkxorkbvzqzazm' WindowName: 'uiewrczpfhnwfkgivzplxgsbwzgmxpnipepnm'
- ClassName: 'pterqtbcjdxuqqsbguofhikw' WindowName: 'xafxlbzizymbwkrtupkp'
- ClassName: 'jctxnwsxguzlzknesrt' WindowName: 'yeysiygemggmnoepjltg'
- ClassName: 'vmgspiqlgxcthepkowcwgbik' WindowName: 'iyrprpwzscmisvsmxfzyofhbb'
- ClassName: 'gmfaghiaqthlmnmajygdmopt' WindowName: 'smcgqmgekvkhfcvhjjbbtachmzamhdtftvd'
- ClassName: 'qimwhmvvoqfnbiexopqel' WindowName: 'hfbqesiroqqebaxfkvqrubynluzxhjjld'
- ClassName: 'wmfrmnorrzjqekupzct' WindowName: 'dsemnihzjqejxircsdvpcxbqo'
- ClassName: 'dlovlrrozdxfxxurktthetbshmrxnohvgqiv' WindowName: 'lfpneczdvrgkriujowvd'
- ClassName: 'muleskjbcivhfswiqjf' WindowName: 'iyfvotheldusozjuyo'
- ClassName: 'cuswkvosiwlqcouluhqmzbuukqdqmxivuhutkx' WindowName: 'wfmufzypxspecfbsmu'
- ClassName: 'jgyjrswunvsjfavrwopaxod' WindowName: 'soyrgsenwxuhwwrzhtve'
- ClassName: 'wavqaqfjxzvsaiknbysmjbpkykrkp' WindowName: 'oxbgulctbwfieediocoit'
