Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'vfwdbepqatbehqrhgdnyomfxfzvy' WindowName: 'jezgbgsagmelgjbcephznmljklpca'
- ClassName: 'eirgymylpadrhcrammxogbjihiqkylvj' WindowName: 'vhfruzeulaicjaeiqkxjzmklckojfktxf'
- ClassName: 'wywkvudweupijdkxynamexbflknebuzt' WindowName: 'ijvudhilpmavhfufiakleluq'
- ClassName: 'mgyjjxwtyxjgnsuht' WindowName: 'geamvnlouenlfprglumisiigrjuklmqqvque'
- ClassName: 'lhxuygdrrryukojdwnqilbyatdyj' WindowName: 'xmlfbkyhhwpfipuvzcuoghlbw'
- ClassName: 'tidqgwprdymaucdgwszt' WindowName: 'bbwywacfnqytddqeavhjtvbjkbztapgsge'
- ClassName: 'lgkypxibymnholkrexbbtdwcrztvytchxkdlblx' WindowName: 'joapjibkgxhobdwkpavcqhsahwfyql'
- ClassName: 'yqiljmxmrtbimdugkpwpykritypsndfxnarvy' WindowName: 'cfznoxnmfwbhwmzjiylkivnbvkfdtal'
- ClassName: 'hcbdfewectfywruzylyhijzsltyegdloihdhy' WindowName: 'fhbzwwpjisccqsdy'
- ClassName: 'pxvziahbhrjgzdauwlbclqrjin' WindowName: 'fbenkolfmmpkdbiugybvpghvpzcrwfpamxie'
- ClassName: 'vicrjjgseuytqnoc' WindowName: 'fgkervlijerrnfsxzeuadppymvfgjruujxaf'
- ClassName: 'tdexqcjczwblukugtxffmoeugjczfahi' WindowName: 'cafmerwzlphsokvovjiobpqoutkmeuxl'
- ClassName: 'lddxhreprjleqwcxbmvdbrzbvxfugjchi' WindowName: 'shupprfqmpstzhmebrhzuttbtvqguwmft'
- ClassName: 'cjymsxdpxwcumzvscy' WindowName: 'ezebjveemsomxuwuihjitiggl'
- ClassName: 'aoknznnslexeotedkzkncpljpxmvhocqbmmltht' WindowName: 'ijpvmqiwnyslpxrmzzxte'
- ClassName: 'infazygscclqlumkgjviouzkikwor' WindowName: 'uozqhntjihvzrfniwzxeuarwrcukhmchlfwi'
- ClassName: 'ggjdintjnjpqycakwnpgtadlunfvadjn' WindowName: 'oetdtfqqeuclwududghzlkhzvc'
- ClassName: 'sqfwauqgqnghmivydzd' WindowName: 'vfodketprmvldrfktemxkdu'
- ClassName: 'erisatxooijjgbaeuvkkph' WindowName: 'tmtylugdhydbigafj'
- ClassName: 'uorsfjddwpzgrsstjqxkymuuqyytxzoztchycp' WindowName: 'ciwrxdnzrzkxpokwyevwu'
- ClassName: 'kvmpspkxbdsmohffiouksxtgdeowuu' WindowName: 'wgsitqxoseutvbjhtdgsyu'
- ClassName: 'uatgtgovaihtmqra' WindowName: 'esgcgyftmifutychlpimjgyjclsxjqacits'
- ClassName: 'pswqdmyemgkbuvoi' WindowName: 'doxuwwqnswcsrramtvw'
- ClassName: 'zljxqjpqyykbjtbmfwatipshlrpqjd' WindowName: 'afeynmssgpsfewhgkqcbprlvlvoofjo'
- ClassName: 'yarqwydwwwqxhuomfjmymmn' WindowName: 'codxapmdqmybjjbsfcnfqxiqntcxbjc'
- ClassName: 'batlzklaidigyadkcmwosweimwfsfv' WindowName: 'qnceftimhkfbmqgrqccvxfg'
- ClassName: 'qwswadolzqexjxig' WindowName: 'glppngiqrxmlzffxng'
- ClassName: 'xvmqfdktczbqqqufgv' WindowName: 'wdzizczwcckfrgxnpgquhbvyf'
- ClassName: 'qalkwqfypjuqzlnaxdcnrluml' WindowName: 'zbofkfcxpkuncxej'
- ClassName: 'bimdgfrbompabfsoipot' WindowName: 'nqbqqydmnveauqcogd'
- ClassName: 'mczxmojbhkpmuvkbjolm' WindowName: 'xylalwyartolnhdxpxrzrxl'
- ClassName: 'roygikwmnbqmlqbksvukol' WindowName: 'nsefjjfmxboottyonbswdllcvzsg'
- ClassName: 'ayfufhxrmhqwdapujl' WindowName: 'helpohclsipfdncsakmjiooqxxqghnh'
- ClassName: 'albgllabmgevriznhcvambvuqi' WindowName: 'znnwtfnpzpzgnlblbupsomt'
- ClassName: 'deiasmxscowtpsuswwwviozsjznj' WindowName: 'jiidnlgwoqhcautlwvx'
- ClassName: 'jeazhsnmwlwhfdvanxogr' WindowName: 'fyspyaypjctmsvzvpbqszpces'
- ClassName: 'uvewpptbtwalsgnsdutjyaeqrlhirzn' WindowName: 'tqdkckqdojsfshdhif'
- ClassName: 'wconmnwubuugsfa' WindowName: 'olrolslgtzxloeoluxspbapvhuvdlrltt'
- ClassName: 'jsewdtkqdwbrnedbncjtvxcdzzwmpxkgqegkywz' WindowName: 'djiniccwscdsbsoyhlymvffho'
- ClassName: 'buubxiinntrrovqddzdawudvsibks' WindowName: 'dvshkvacgzqihgynykfoyh'
