Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'kegxijjfhmertfqtukgj' WindowName: 'taowilcmedehfvupjo'
- ClassName: 'nagitgvfrvmrytwqainp' WindowName: 'apfcvvmluppsvseuaed'
- ClassName: 'ismmaacgjjqbferyxvohtp' WindowName: 'ttykdeaulilkhfhyqyxsjqbdcnn'
- ClassName: 'matoubfygnxgwbjdiizmzabypvslhtcopdt' WindowName: 'lhyybdnkqbdcjgraeggxfbdwlm'
- ClassName: 'jywqpbmqbikikvdirusxhrwvojcirggzsuhnx' WindowName: 'gxrmhptwihikjkwbkgtncnsrdgalte'
- ClassName: 'ahkatruyzouveobyneei' WindowName: 'amvcglbchimspsgzkgworggqfkoohxaheuwnyj'
- ClassName: 'rlxbpghwxqzmfrvcknrejzpnpvmavzqjcixzqn' WindowName: 'dplkxxtqhxqstnuibtqvezldpyr'
- ClassName: 'xjhymcwkvrlriwzmgrqp' WindowName: 'tgryasmqvpizbxchahlrdxvridhhahxpk'
- ClassName: 'fuplrqsdlfgqzzzmxzplivbtofvoc' WindowName: 'eydintqzzaflcvkcrgqainaaczvlu'
- ClassName: 'snegexidehgmnkshnnhbavtoogzbgsktdbtslp' WindowName: 'qnsoxwtbxbdnlaynh'
- ClassName: 'kmahgdpxkmbhghqxepkrlidps' WindowName: 'rcnlvwiewkhqwwiziwayhfklhunodjtdunvd'
- ClassName: 'nonuskirvdgfonplvfbvxkuiycru' WindowName: 'yvsdmsappleaqbdostugyrijvnuv'
- ClassName: 'dqpaeofdulaoecryyrl' WindowName: 'mrwseujnlovlmhxpzdbxppcbbwzoinwy'
- ClassName: 'ijqewabtrlmudzygcqacmjn' WindowName: 'htpkeqrnbmjfurhljhwfnmzbqrcp'
- ClassName: 'usfrzuktvlfstkuykxosttpf' WindowName: 'chceaqkfaktgpcsb'
- ClassName: 'xevqivclxturgkiysolwcechhd' WindowName: 'oxvjtafpjbblyjjztydliegjeeiqyyjdrtop'
- ClassName: 'ddbvoztlmiidjjgftvb' WindowName: 'xqvemiuqklyxthwp'
- ClassName: 'atvnjsipgzbpqzmrlqrfaolpgnipcdmnmpwyg' WindowName: 'njcvqzzfwndjdxnyqaswzxrrmobrmfdfpqnavw'
- ClassName: 'dbqanykguueoammigmkklnk' WindowName: 'nfdpwrjqxubsnbnxgaipqpbulpdmgdvtmoibru'
- ClassName: 'zyvsxqjuajujefwcfxhkdvammtsvndrhyt' WindowName: 'publmpgzyfxrneuodkkamkdcqhwfcozdeimb'
- ClassName: 'frdnjumqcmyxlsnyufrawjruxfapubhtcakm' WindowName: 'mzhkxleuwrakfchwpgpcldnkaqulm'
- ClassName: 'pyeeqsiunspeyztejmpxqfgahrvu' WindowName: 'aqohcpzibanlgpi'
- ClassName: 'rkraxzmrcvfkhwmcurkicosudiqot' WindowName: 'ujpatuffpjiyrwwhsqhsuzjf'
- ClassName: 'vvjwsepkklpcdrxctdw' WindowName: 'uwebshxacxujqdylaqesywzdgu'
- ClassName: 'cmctpeuclxxjiwamdafowafjmqzvhi' WindowName: 'qhzxonkgazyzecwyyifh'
- ClassName: 'pghsvceoybozehqfsqikxrcqzjiufvkbqzvmnj' WindowName: 'arzdcaknbpczxrazqpaqqmxhdg'
- ClassName: 'zlwxjahaoyewpndhchpp' WindowName: 'syvdtdacmpsiuwjfdfgazs'
- ClassName: 'ldmknqhujoghybgdqsxfghifvwo' WindowName: 'fdaaxhtuzjcrjaeuwgyil'
- ClassName: 'awrsgaxkckrnkxxyswqvkogxwutwpe' WindowName: 'wwbybykmrgywxlhbtfthkakmbookwdjfblkiv'
- ClassName: 'geymmposwvezocdfgnamuywpia' WindowName: 'zrnvkmyxgmwjfkzpqfqptppmsm'
- ClassName: 'vjwwwsftfaasjmotpsqwaqecebzropgxmqcetmz' WindowName: 'vhkmdbfwzoqioxyfhzyzwssvxrhmxmspqynxsx'
- ClassName: 'whffcuclzswlgairqflxwyqpydizl' WindowName: 'gjpgeyrsexzzbefblqexrtb'
- ClassName: 'aiookanfiitonshkrvroelim' WindowName: 'chtlxpwsiebwccugcxiqbjgxpom'
- ClassName: 'ubbtofeyhmglxygkhjbvdmctke' WindowName: 'fgdtodbprfbgapxbbmilmbshpdiupunekvhlr'
- ClassName: 'sfyakjjiwfmqigquwknqpzjttyzdxb' WindowName: 'wombnazaoxrfnfovtkfvcuguyek'
- ClassName: 'oxkviuzgczijdxy' WindowName: 'iqtsftujybosgvafdajipvctdz'
