Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
Сетевая активность:
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ceifreexzhxgrhkjhxfrovmqdgcf' WindowName: 'udzpkvqhcodmtbhawonmlieagiduxt'
- ClassName: 'zxdrhmwyakijnlasvmparinbcijunhlc' WindowName: 'prtixhwxvnxzmdevmfi'
- ClassName: 'ilvfnsgncylzceozq' WindowName: 'rgbzqdeqdkcvahlmmqndjjybjhzwh'
- ClassName: 'oayxctahafdjjsqhp' WindowName: 'qntvxtslivsrfomloywozzyrvnli'
- ClassName: 'hrsennxxppeuywjjomrlfgq' WindowName: 'erhmghcyxpovmctpuvazuoqgvmmoylnyzezil'
- ClassName: 'ypgqvokplgztpcygjhaflmeeclynlifw' WindowName: 'bbnvdrjwicrgcczxtorphaek'
- ClassName: 'uplwfenwmzxbzajtuqflxakz' WindowName: 'acyiypnhsacxtzfbnwbinsrazesv'
- ClassName: 'jbwmbnuswsvujqaseilzgqqskjgnfue' WindowName: 'zjztvcscdoxuwzrcywvztjucsqzuhkgesxpms'
- ClassName: 'tqdydrxugwbwgogtmawy' WindowName: 'nmhcsnoslkexggannvnmoplqgokr'
- ClassName: 'yolkphfnntzcajipbmfdyumcbn' WindowName: 'bbbeopveqezdxqmhrrv'
- ClassName: 'ndihcrjadbdxjywriaajzdumkftlfjlqurib' WindowName: 'wjbghzcblqemwtqdtugvhhvrvfevvtickhbihm'
- ClassName: 'ubalcsispkacvgrdtvogyayeve' WindowName: 'ywopbbnrhbmripjxrllwqkarfsmh'
- ClassName: 'zidxqidyagpnqlzwemdraewymiukih' WindowName: 'uivqndmqwtjdncutsvjveboppzpbyhhhfs'
- ClassName: 'oxibnnuaqmbbyzg' WindowName: 'vruonkfyfevbuanakuatdteaolouas'
- ClassName: 'hcemkqnmqjmgvmmwdfjwtu' WindowName: 'xmfidafvsulbymes'
- ClassName: 'dzqjpdyvkalvkpdqpx' WindowName: 'umeasjainznsklrayfkjsnnwofxdmoeynvb'
- ClassName: 'pvkyxjmdeycfvabnmtje' WindowName: 'pohklwsdnrwvhlray'
- ClassName: 'popagtlehfzwccikissoskjrlqkoigxcuidvy' WindowName: 'cssisnbewbukpajpkox'
- ClassName: 'uppkalodaribrvyatngnb' WindowName: 'yjbbhqmvlbdknffirzdvuicycq'
- ClassName: 'spsjgqfaikimlosvifkmhpwqe' WindowName: 'bhlmedgbqlmhjznuvfaps'
- ClassName: 'lwqzabmbimcalyfvekuetav' WindowName: 'iofsdxctagcyflonxndvkbhthsgmpyc'
- ClassName: 'auphadnkphkrjfjjw' WindowName: 'qaoqtocprxwlzjkapwpncytlgtuhuczm'
- ClassName: 'jmmgfrirhlxfqfenvaedg' WindowName: 'ksdpnqrldlhecwdkfibft'
- ClassName: 'rdgsqcmirecteqjtmkz' WindowName: 'jlghejizzpcbzqcdm'
- ClassName: 'beecznzqqmctubfmvyalqyslfaecmsmvlwfeuzt' WindowName: 'ceffaqzmvrmdltqt'
- ClassName: 'djkqssovmijzrxxngtnh' WindowName: 'hahetumpbmdgyunhawwudsprfpybtlqpibgws'
- ClassName: 'tkaemzieybgarvcfwrgdwbvltgwkfllolqlai' WindowName: 'qusdocrdtnhbhqrsochmbuzmadhywqrwgxwa'
- ClassName: 'euffzjejfrqilrmsndojzpczzjo' WindowName: 'khjpxurignryidxcflwcbxhaiuc'
- ClassName: 'jdzyxsvnlitwpgaoqemi' WindowName: 'mfngsuizfxxefkjecftdswqyshvondhpbd'
- ClassName: 'kqpyrkukejjlekxtbnuosimnxzynrng' WindowName: 'gqlnihxsxumraltn'
- ClassName: 'hjbdtehaqnkycjgcirvpxtsrkjecdhhbc' WindowName: 'pwxlijgvxcleddboioaisgmxwltigzizeyr'
- ClassName: 'gibyieizxeuxoxxxoykatpwrljazysa' WindowName: 'oicrhqudbfvogjxpeksitkojbyphippwkgv'
- ClassName: 'vrbpjcqkgytdtqgruqhtwnuvxcrdldnbq' WindowName: 'kpdpxqketnghygrtjylsfg'
- ClassName: 'abeyfscqqdwbnkgqnhcqhll' WindowName: 'osqwmuasrfsvmojbxdlmjltp'
- ClassName: 'nhfyyxwunsuavdmm' WindowName: 'svchplwyqajasjmugerkxrfvawjlbidr'
- ClassName: 'mvwsaamtlomuftqpbwier' WindowName: 'xhzwznjublkpxhfyhxsvxdhs'
- ClassName: 'tmovxxbeudtfdfx' WindowName: 'ncplbggbkmhaaumoncba'
- ClassName: 'bnlcgxkjnkcswicznsmiwn' WindowName: 'anmakiblchngjbymwzsfxrthjjqqnheby'
- ClassName: 'soohcgeysutqstg' WindowName: 'paxgxhnxbepeqlimopsnjrlxvkad'
- ClassName: 'levvkcagbmfluywumd' WindowName: 'qnvcjktrzhiptotg'
- ClassName: 'ypzyfcklspeecnzkbthrmctwwdd' WindowName: 'dqibppphbzgwgqunsoddggxmrcjnxechumxe'
- ClassName: 'fiswayaoucbhbzqygxnqzey' WindowName: 'mwshnyhazrybfauotutmhinbmgvkbsfj'
- ClassName: 'yqiukbrbmpcgmbouagcmsetppjqg' WindowName: 'ylqgwjnhqeqspncheheoyabmnetqojgrwgfo'
- ClassName: 'asxrfiolchdldsaksyitdbpot' WindowName: 'qbglypakbaulqvbbgnzkpguuhoywvimwqdhkx'
