Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\InetLoad.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'vnhptjdnebfhyjijnvtqb' WindowName: 'hpmgyxqihwunkat'
- ClassName: 'kdfxuqgxvfifpfpsejjcuamgvsrbeysgwyymba' WindowName: 'yjgngpocdcmdoiirdnhurdujvapjshhvwtox'
- ClassName: 'qvqmzrkyaijwblkzq' WindowName: 'oufheobofollhruiqmyufcmvedoaswz'
- ClassName: 'bnxdinvnlribpeuaaudvokmhx' WindowName: 'fmpsefakcrbkyehaniybknomimrimbopaw'
- ClassName: 'kstndwmuzfvangbexjmphjc' WindowName: 'pgdsrhbugmbldezcbwiptamkva'
- ClassName: 'nhdcwgeiszxuoibb' WindowName: 'toxmmjbgpmbnchsg'
- ClassName: 'iuwcjvigreuscmjbljbihneoghjxfuti' WindowName: 'tuniehrstjdhoncgsxzfenamfcjotsixdfebq'
- ClassName: 'jhnjlowdcaksbipgtcsngtnp' WindowName: 'wzlonufnghujrftw'
- ClassName: 'tezlbqyecysiicdgwum' WindowName: 'pqsqbsauhbhewinimvekzjuunopnoeuhs'
- ClassName: 'wzzpnrdbyidmqcrjlvifdnfllxbidumhsvoj' WindowName: 'jmuptesobngwozelpwhfuynrlvguxbk'
- ClassName: 'xjshdpheexbieilwrkedhkrpfc' WindowName: 'wdumoeymqkqgftvqlazuumonsytlktgor'
- ClassName: 'qzmbrgjlwwxkkxuus' WindowName: 'oevaissnuioeqzcyzswci'
- ClassName: 'byplwfdpyalyfxhrzvpmwxverzaq' WindowName: 'ryrbrfwuaejoxmbzkerwkvqtvmyd'
- ClassName: 'imbjjcwtffkglro' WindowName: 'tknnystgtrffaaywpukurphhzklvtmasb'
- ClassName: 'utfvhdkutxtfruub' WindowName: 'upqlnuenqkhbfssiytvpmqnhafdrczt'
- ClassName: 'utmjhtshiropxmonrw' WindowName: 'ksicvjdpegnxeqwqerhomfnhbomrjma'
- ClassName: 'bfvfrklhdmrxxrsjkldnqkyjchjbwnvgwmbv' WindowName: 'kkihgidreevrwjwj'
- ClassName: 'znbhaemyqxblglzxvjxogijgtvrljg' WindowName: 'uuamyxakmyotdyieqdoixhyygmk'
- ClassName: 'nmnhzycfbghiwkozluqm' WindowName: 'itkodsmuhhtxhmxoophfegdwcvzagzxs'
- ClassName: 'iuhwdaoeziooduwfrpxeqv' WindowName: 'nhtvsyxslnyawftqtpwyzhsbgqniiui'
- ClassName: 'ekmevvwhgxcwcjlenoiezmhxhibqqveprxur' WindowName: 'ipvqjbwcritdcraokzrqkwium'
- ClassName: 'ffsetylkwweosgrsiwxggbcmlhlnotsam' WindowName: 'hzfgdbocgbxlnxbganpigg'
- ClassName: 'hackphpgawecizkzoijsiowius' WindowName: 'xdkpansjdruxhbhclwl'
- ClassName: 'zzmgoqjfkevvknqwdwlpebsrbfvomrsoaq' WindowName: 'azqemigplthjntncuuv'
- ClassName: 'iniafzvpvciejaglh' WindowName: 'kzgulasvdvrvdzt'
- ClassName: 'fcosobrxcxoijqkteimemgdcneqysmac' WindowName: 'irrloqorrudxjiywn'
- ClassName: 'rjfrjbgmeheortrhjahxrvgjgljnyvjvgax' WindowName: 'ppnzuxvfvnsvnyxtqhizbisfqtmugcdjxzju'
- ClassName: 'qxtuqysgbaqezvzt' WindowName: 'nuzojmlprombdjik'
- ClassName: 'gaxumqhcwsjokgmsfqn' WindowName: 'scamysvlxomksgtdfbkgknwrfiexddifvz'
- ClassName: 'cedlzgmxhaaulibvzyefgyujwqyqyvhslqtz' WindowName: 'esiytfpnoszcevfeknw'
- ClassName: 'uigsiexjrhsrlcwslwdeybhrtwdxvqblnxcbg' WindowName: 'pubjysgfypwbbrbcuetfowgbwt'
- ClassName: 'hhmpjwvvwjdmihxgypiinphkqnwcqckhgaiupn' WindowName: 'gmeoqrncgxnbiutfrsjupkftvxcjhgntpq'
- ClassName: 'gxwnyoeibbcwmepqdwkkeikjjjrpwyfueiszmup' WindowName: 'qircnhccditwoedoyccllireuwevmolka'
- ClassName: 'dqipijqxkbnpdfmsibvpfgrryicindhjmrzkfjj' WindowName: 'uktplnoknsciytkcyeojo'
- ClassName: 'wjxkptjewelmtypnatkmerikovlulzptnburqr' WindowName: 'crejpgiajzknzwmlbhv'
- ClassName: 'emmlkfrqghpaisscouoexlpudzdqxmq' WindowName: 'idzefujapzwamapcewpxsxojiskyduvud'
- ClassName: 'xpjvomkczyliygkquhaejqxmsmlnywxt' WindowName: 'jkuugvjbseolrjahcygwg'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'lznmcajwvmurcgyzqeshjpgjfch' WindowName: 'pjduxxxhcfmlcygkaq'
- ClassName: 'efknqskiewhgicjumjmrtpcobt' WindowName: 'rxksacbgmixrxdm'
- ClassName: 'uymotynimpzdfitgganhfryqilglihjszm' WindowName: 'onazwplkeyjgbrleth'
- ClassName: 'sevzhghigqqwhkujrxtjcxner' WindowName: 'zerfehwyqxttbsvsm'
- ClassName: 'klmxgvfeakkvtiywuuvjoflqnjtglnto' WindowName: 'hikueepqtadevocfoncltgicaulgxun'
- ClassName: 'hccchnkhctgzydbxbfa' WindowName: 'jhtahpxlzjccamihjvhyuzfdomee'
