Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'tepmznfaguyzqepm' WindowName: 'uwasntirvbbzrzaiman'
- ClassName: 'fubswcamfzteamnaenrdsyxuyyf' WindowName: 'jshpqgtafhqryfgjivmipyg'
- ClassName: 'qfefxwmhlicixwfxndcgvpi' WindowName: 'lfzksgpefyzvzdqzwtgxwquxzgdd'
- ClassName: 'leyqyvwyngjuqrdgdzwofrzs' WindowName: 'nrtgomgrummptyxcajifbqqgealwhqtue'
- ClassName: 'mziafkdjweikqefzcmyjeysrwqylelc' WindowName: 'vzermdbxtcwlqhryexghjlqhlbnblx'
- ClassName: 'fcuprhazloxoynxqdcxcmzqfjmezjrayfhnmu' WindowName: 'diayzuzpfjjmqpzugoikn'
- ClassName: 'acjqlviclnttglpzhgvqkyddljtqmqhpko' WindowName: 'nzdrydgaadjviieqjktzhjeomguqmxlvz'
- ClassName: 'ydtrlauexnrywpvzjdhfk' WindowName: 'ugxhymmawtygljc'
- ClassName: 'fbtohxaxsglewbbbpr' WindowName: 'uarehjeyzvknogegcunpizdhnagg'
- ClassName: 'lipkqqsymhctadksivcxtsaos' WindowName: 'jbxjalynumpulumcn'
- ClassName: 'colkfzmgjhsuzvxtbthnlqeatent' WindowName: 'wuxnyavfijrnlwxwwunbgj'
- ClassName: 'mxgftgjyrqdjlkbokwazwmgunygxrhvhlz' WindowName: 'xxczumuzihlmfhzknhdrainlcqq'
- ClassName: 'hskhpthlfwxqkyxxszcuwsypmwkvguwtljo' WindowName: 'immgoinjmkbzstkvgexi'
- ClassName: 'wvotznweskbovlhnjhknsqvsu' WindowName: 'hhsoqbhjersqllghtewdvxptwlnnedy'
- ClassName: 'swzndthwlrsvxfurnhpwglpzlrssppdfmursup' WindowName: 'zjbjuvhyyztvbnfnnblpfyqxrc'
- ClassName: 'ajxwovolhahpoahjxlixxu' WindowName: 'mfjmbzhianoggxakoejfahvvnddemyapeoaqt'
- ClassName: 'sxugcheimkdgyawdmagfopgaeeg' WindowName: 'pwthtbolbhhealiumbeixkpgetjk'
- ClassName: 'kbqcpcdzskmtzqctcb' WindowName: 'hramnkjlmhqtviyzkjethaz'
- ClassName: 'frezawwawglfzndnhfc' WindowName: 'vgnshtmyyadifqbeophtzkzci'
- ClassName: 'wjexegjmlfmzcyfhpd' WindowName: 'spewhhrkbupftcjyptoh'
- ClassName: 'avxnfwffxaljcodpbokb' WindowName: 'ghqxjtkqqyjfvoxuqlotyv'
- ClassName: 'jnxfcelpcqcxplnjitoomcmyxomwubjah' WindowName: 'dgevwqxsrqlnrrxlwdqzocloadwiaut'
- ClassName: 'rjbcckntzeltnpsyxygtwepgptfwvkfmc' WindowName: 'lercptulqhxqhvdk'
- ClassName: 'vnvbhgjatqkqcpk' WindowName: 'vxdeyclygqixvantzjwgxx'
- ClassName: 'cfqoisudmvnntrpysvtxrnjdyfgjxduk' WindowName: 'uiyhxxmelshzslgcmdasgtnwodscwlv'
- ClassName: 'nudhiwqouoobrboye' WindowName: 'sltallmugfdnlndnlirlikkkfffukgq'
- ClassName: 'hbizybsxiazxwrwymtoo' WindowName: 'xpqqqxdhylbzscyvsvaaevesmdubxnmw'
- ClassName: 'xzggdyzgvjtejujpjupjhmahzlglibbhlyhk' WindowName: 'tiirmaqpiglgrshnmfnzpxjtjy'
- ClassName: 'bhxpwangqamrrocinhjiamxvfvokuk' WindowName: 'smspbbwfxpengenpfdcy'
- ClassName: 'kdcgylhzbgotciqbywcruj' WindowName: 'wpvxntxhawemymtwjvagcnvkckz'
- ClassName: 'ycyxsyorxofafidzhisgnhbjfjxyvukfiirgf' WindowName: 'oxnbswgtnanzlqkbavwgmbsxwwns'
- ClassName: 'mggrducypsxetfixfwelwotdqgvqmn' WindowName: 'magpwcuqbcnbkyoir'
- ClassName: 'rdtxqyxnujzesobiaq' WindowName: 'wckiyhvlxuhjpwqcmkginhj'
- ClassName: 'gsromtydaqszeqqlypfvnwcroilctxyz' WindowName: 'ijbtdrsrelxyefbptakviuki'
- ClassName: 'sxcjcqftredgndrizyzeyksczxvwcewllh' WindowName: 'dempycptmybeqvvnqytcdjdywu'
- ClassName: 'lewbdikhgnwtijfyxgd' WindowName: 'grhkkvnlnetkaxrfdkyiuvluhytryrtffmkgxpu'
- ClassName: 'tiksmsxmbbmqwmhfqrwokgfasgdemf' WindowName: 'xbrleflphstruqkqwhnmppeatvbsmhpoxfl'
- ClassName: 'xfkrbflmtauxxahmrdlfb' WindowName: 'ypgtffguhfcwivogkjpalrq'
- ClassName: 'jgrawxgysncpxuvzwjgbiqhzscd' WindowName: 'sjtanefbqbnlmkieibszyarueqlekxnnryu'
- ClassName: 'guryaffkgyzijyayknqcqwlofyqansnqslt' WindowName: 'vpmhspktvtefjwjxfyi'
