Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ohrojavjohramtk' WindowName: 'ckjoaxgmtcbqlhljyonkolu'
- ClassName: 'ckrzmyrmczkgrccghcybubmajzf' WindowName: 'ihrhbkoveicyyquylapjqgwxplwcwsd'
- ClassName: 'jhcqawkdaqhkydtcsrgavkgnublqo' WindowName: 'xyhxdxryeumyvhijkjysltp'
- ClassName: 'zzwbqbjstdiqpkiuzesnkpecibr' WindowName: 'dxqxrzqwbadfwmnwvxzuzjqxevdlqsvkop'
- ClassName: 'txirwsxxbnhbfpt' WindowName: 'tchialiwaigccybrocs'
- ClassName: 'qdqkvldgujyrxmipr' WindowName: 'ebmbrgzuhqhkrgdqbxoqrm'
- ClassName: 'bhqdvrgzyoqwrxnsra' WindowName: 'eigbdyxohuffasidopstpvldtgbxwdg'
- ClassName: 'bjpnfqzdnpftqxlyl' WindowName: 'gvbsihgakmcbdjhtwxltoqpeivizfyc'
- ClassName: 'woqyscwdmskbdwrfrisrabuzrfnlhdijgr' WindowName: 'zryylvmjnpqzhvjhcyrzazusbwmeyvfpqyz'
- ClassName: 'dhmkjrtvcdarthuhheucdeetcpc' WindowName: 'npiuqlcfdcxefecq'
- ClassName: 'pzjmvxyxkktvrsdhwmqdbhmyiwsesbtlcnwjmj' WindowName: 'zlbbetfimhqzvcdync'
- ClassName: 'pcwuuupswcguzmfuuszslssb' WindowName: 'chcsrpghrvmpwbchf'
- ClassName: 'cqfultkragwvhneyatdnikawonlfrpa' WindowName: 'mtimcdsfxrvcjughwd'
- ClassName: 'kzfxthgfgardjjkzmjuvtkujiges' WindowName: 'iavyhohutxphsenqhaun'
- ClassName: 'xmmozysomdjnblmxxly' WindowName: 'ucvsxikrcetwphbscenw'
- ClassName: 'tppswtneysgaxndeniabeguxfxcujx' WindowName: 'rpzcwvtasylnokugyjrnssctdzaxxqqrvczof'
- ClassName: 'naqmcbsmithgchbpqpctqjzcaxzuphafrtikigh' WindowName: 'ffiyuebklsnhgylyjufqmokqjgfhrjna'
- ClassName: 'alqfutgrpslxfqvtdnfagwk' WindowName: 'gmhdzltpmvzxjekcalkfkdxutoifjsgmfjffa'
- ClassName: 'rdlatrxaknxzkhebf' WindowName: 'gerfywscrczkssmxtntukquxmdsavlpafurhun'
- ClassName: 'bmklcexmloflnonojeyhv' WindowName: 'wpmlhpglmsdyscppgmqkygeapyxarcfzidmjy'
- ClassName: 'udwzxbnbcqiplvbfevctmrievvsefzodrpdtuzy' WindowName: 'wwflumsdayvgbtwskuyfvrvxnvipfrc'
- ClassName: 'afykmhppsxbkieciuuwsn' WindowName: 'mwxfiytuyisxdivlwbowcxsq'
- ClassName: 'hhgbfsgndoscpogfohyozetynrb' WindowName: 'hjlsiizhceysozokoclzzhklekgffvnwktffg'
- ClassName: 'csvzyswmivistlppgsudedxiikwxhtqjw' WindowName: 'odbbqjiigmssexvgjtr'
- ClassName: 'onceiqgwguqakuimapcjxjp' WindowName: 'sckdlssjrwhdcsteydhvi'
- ClassName: 'vjxszcznjsqmyypjw' WindowName: 'mrpffzbvkqcmflrfjfpytpeikhfrvym'
- ClassName: 'rwrkriwulkxdsxawpnxxmhezmqqp' WindowName: 'whoxoqnogqtsixvrvwleqgljy'
- ClassName: 'cfdqhhatnfkqxdmlzveskbkzrfnethir' WindowName: 'jevcjiycznxasakwlycpjxzspnv'
- ClassName: 'ijtjbahmsastgvlziennv' WindowName: 'kxoxvqcqqstfrwaosttyul'
- ClassName: 'sxcxrbmtczhlbzjmusdpmqqofica' WindowName: 'cbabfzxxbjpyjewpnqqbcpmgjkkdyvtrvk'
- ClassName: 'guohuruqiwrlkunalfwopz' WindowName: 'kywjcqzfmowiiylzaonpjiilbkg'
- ClassName: 'comalwhitamxpmsbvkyykjsai' WindowName: 'cioaduxptkoqetgetmduv'
- ClassName: 'aiurwtqjlviswjohwxcphxf' WindowName: 'uittbslibnikjzssxgtuuaioogyqs'
- ClassName: 'emqxdmsfimyjkanleemezfzofuepfxphmgfy' WindowName: 'luvnpevwgrxzhmfauxgxhufvvukpyp'
- ClassName: 'ukrwaujmndvsvmuhuxihgxibzazb' WindowName: 'tpdfxtfqkwnwmgec'
- ClassName: 'pqyluotexlvwkimiyrtgozmmbzuaoqrlbl' WindowName: 'nozaxlqcxtucwrbzbfpxomvsni'
- ClassName: 'pmgseirrxfcsvqyhirhrgqivsvcftrjfylh' WindowName: 'swtymwsczfbhpbml'
- ClassName: 'sjiiafuwrfsrygnrdiitwrxkyvzkykhek' WindowName: 'rpgrrsshrrikrufjsberjpviacxvhrixskdql'
- ClassName: 'xmxekyallbzkqeoviyzcclegzinchioqpuloxpp' WindowName: 'ozexcuzwehlfezdnmnefglhqtl'
- ClassName: 'gpjpumiyfstkriffjdaivjsxqokyaul' WindowName: 'smtpmznghoekfsialflcyosowjmohuz'
- ClassName: 'pesbltleybfjhdsvzzadak' WindowName: 'kvwptmkqemaqslgiynndmjs'
