Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обхода различных антивирусов:
- ClassName: 'huxaafiofublzlklrvpfavpvbhowaevhsvm' WindowName: 'mpcivhywbqnfhuvzrgj'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
- %TEMP%\nsg2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nsg2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'to####.kantule.net':9282
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'bxvldbwtzgpfpufsllguzlgyidbfjiyknbllal' WindowName: 'kmulkhwhytsgbeujtshtcqkcjipmshxmuti'
- ClassName: 'khjlvfpvslgmsddjqupit' WindowName: 'zmabmaioqiwpuodcrugaunwd'
- ClassName: 'mvvvieiehtbcwxbyfbiu' WindowName: 'snuhaptkfelvghmoexixhs'
- ClassName: 'etcnrkkccjxmjgwarpbdxyp' WindowName: 'zzhrjgjqilzqypzmx'
- ClassName: 'hjbzaeniynxqnsioostjwdqso' WindowName: 'drrhevsvxovtveiyl'
- ClassName: 'fizrtyghyrdamnziabe' WindowName: 'glhmapdaqfyjsdeg'
- ClassName: 'fkzqpotipgajzimvajuygclbfalma' WindowName: 'oiqvhzfcuobwyqelwbuxduscrogeefonfnfku'
- ClassName: 'icbshszncnhwerxsgyc' WindowName: 'wpromklkxtvhaytdnmuspnubqobdsqfoblmp'
- ClassName: 'dfgisvusmkjsoimyrtxlcbwvujfhadlachmpgta' WindowName: 'ogmqhqrrxinxmes'
- ClassName: 'lnierizrwncgeabgjjfjpujkjsisk' WindowName: 'jxmulkzcvqbjzyvqteunc'
- ClassName: 'kryxitxfknawpgjvnkpdinsgzgxdasyvvva' WindowName: 'rnpktyemqekllpad'
- ClassName: 'txhzhnlolriwhoyvotoqqxtydeomixo' WindowName: 'gcnugnbyfjssfnjhjvfzcx'
- ClassName: 'eiryvlngitdycthzne' WindowName: 'jvlcqeajawxfxgfcahsrgzisigetrawcyf'
- ClassName: 'mjimpdbuvsdxrddqbvjqamxqq' WindowName: 'numhznukojihtakglsocrexydzjjprt'
- ClassName: 'kugirafdcjfapuuuqjc' WindowName: 'kzsxvvlbzeqhcidhynccs'
- ClassName: 'zljwzrtrzpqalcpttjevuehyurxjvjljrjbiqu' WindowName: 'vhggdqrybjptnxmykezn'
- ClassName: 'htupodyqdhsedabwahytko' WindowName: 'madcazluhxuvrdtxsqsfzydoilvqczzebznxrg'
- ClassName: 'pdmbevzhwabxggfhxzyytyknxow' WindowName: 'mxjfonhqxaxpoijvvmpbrzwrtiajevjy'
- ClassName: 'qscpnpwimjpgaplsblmyd' WindowName: 'duwbagacdnqlvgg'
- ClassName: 'ikwanyjdfeoklzc' WindowName: 'hqnmkiarkovzjwwojplmibefcezfblgbw'
- ClassName: 'ddnjnzdphzfqdplzkmk' WindowName: 'zwlviiiuqnomjpyfbrrldpuejlag'
- ClassName: 'krqflnzzrfszukwaefoyyhhqjftkgitrgvofvi' WindowName: 'jksfdcxghtmgtmxawvcangebchkb'
- ClassName: 'arjqnlalbgbfswzqyrhisvbouh' WindowName: 'snlccqatbacplcum'
- ClassName: 'evltebpaunhijmhsqictjznvip' WindowName: 'rgljvbymfzisatkhznobmzozth'
- ClassName: 'hhojvjpkeecpcsq' WindowName: 'almclfhcqvboaqezawnugonwnnjbyhni'
- ClassName: 'lmznsufolglolmh' WindowName: 'rsncbrdmftslzbnyuoe'
- ClassName: 'lqotzbzvurrqhab' WindowName: 'vthwwuhjkmpeqntapkwljsloksztox'
- ClassName: 'boyytkynwexicfdnuvuvih' WindowName: 'pthdyktfpyafeycvbfxrlhysp'
- ClassName: 'nkunjddblltnpefujblfe' WindowName: 'vdrwdehebcjohhispnatxzh'
- ClassName: 'enuhyhxlgtmjpbampfdmcraqjsynuuzkgvv' WindowName: 'ckkyxgpryhaoxilhfdhnsrul'
- ClassName: 'ikadlyimjkafmycjewa' WindowName: 'drhygjvokiifevrsxovgajwsxymrohrw'
- ClassName: 'pfwfvtoqscbvvvaibjsgbngewherhrq' WindowName: 'drfgwyoxagiremenrshcotcgsrpn'
- ClassName: 'ekrsbodtoxnhzknu' WindowName: 'dfqtyphkdiycwbasd'
- ClassName: 'fbncmjhsyqymcpjuzinbckrnemipiogh' WindowName: 'kvhsxbayprjyeccldrhcntfrfch'
- ClassName: 'ylqpznucifrwnywzaxuwjhfnnvvfbsblkn' WindowName: 'hgmxofbzlueksyeu'
- ClassName: 'qvfjksjuckwspxqmvxlqfbgwfyholyvykq' WindowName: 'onbvyedoivzqwxbr'
- ClassName: 'zhmwymeegzrytfl' WindowName: 'quuoinyxgjfxbmwwo'
- ClassName: 'jwsadlunpcjuihjicxmktolgxqzvnqkxppk' WindowName: 'sunymmfewsjynshlrzulqqjssljgxdrleaoh'
- ClassName: 'anmdksttwstpalpggtjtnijembxrvuumthfwuzn' WindowName: 'jdojnxvkhgghithqkjhf'
