Trojan.StartPage.58323

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\NSISdl.dll
%TEMP%\nsp2.tmp\Math.dll
%TEMP%\nsp2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\NSISdl.dll
%TEMP%\nsp2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'tlraujckjyojyjxuozjwpyxqzihpedvlczrj' WindowName: 'wwfltyaasrtcugbqvukwgc'
ClassName: 'fluspduihgbkhrlrcxjnbpxglrcactgagerj' WindowName: 'kfbttsfftfuzfevo'
ClassName: 'eticwubmcwyjdpkvrnqdwsym' WindowName: 'qnnvklxksusldffcwaiwycltieixsh'
ClassName: 'nbgorjlupyludgshrvnvyf' WindowName: 'plopztijkkphcznsptby'
ClassName: 'sbvfhvejaiaspnpbuwzdqyreccopgjw' WindowName: 'plfghhgrbszxndbe'
ClassName: 'oomjygejjqafoitnvvawgcacvwvashssshdf' WindowName: 'jdwmnbubvbapbsasqgoplybhmyymnggcocdzvm'
ClassName: 'uitccffozbgakogshkudqurbxbuhshnawxidg' WindowName: 'hnkbuittmsratuqejhchckmaphjdtc'
ClassName: 'zqofelekgeguuruzsqcxoeyvsglcubgbtwunjjr' WindowName: 'clfswcnnvlpecryfnpqiyenviftbk'
ClassName: 'fmmjxdcmwnipiubazpkjpmyatklefdblzsojq' WindowName: 'bnmdgwwmaljcynucklqlzqtifmqahuarbuwu'
ClassName: 'kvpzanuqatilbbbplrkswmcigmhditfkuvrpwp' WindowName: 'qxcajuegxtiuaosgutxz'
ClassName: 'sjykghmdtgcbwsaootlimcszwkwdrpk' WindowName: 'ztsqnfnkbwwbkbg'
ClassName: 'nkbbfjxcelyhbljaqrswz' WindowName: 'anxqnfveppzuieukuvzng'
ClassName: 'gggcrzpasndfafempvjmsazanbvlo' WindowName: 'dqpxdrxdkxnbvqdtsfcdyefnoabqise'
ClassName: 'lsoqcznjnjhlhlyvxlazhe' WindowName: 'zzlkfkrqjvfqhruppws'
ClassName: 'onrtxtbrpnqkwwnrtvyigrudtgqorvmbj' WindowName: 'hfenwmsidrpaocyegixfarigmcx'
ClassName: 'mjgonrjmrzxwktmzs' WindowName: 'vojrfqantzelwmdkaapnpcvogoefuom'
ClassName: 'htcbozmzhsoragvjzyzwzscnhzwulkvtbthc' WindowName: 'orefhbeoghrqpazsysddps'
ClassName: 'xukaoqrkuvzukmh' WindowName: 'ouxhhmbqrhexyjcmpuktraakzrmlqiimqycm'
ClassName: 'aytefiumbjmfhcorhfnkdirqvh' WindowName: 'skxogbqfqdjvslgftqknz'
ClassName: 'hklscjukmmslunywhgtan' WindowName: 'wcyvrcncfqgkzdyxsthzhbmyuakeeyugahoyjz'
ClassName: 'zjxjoccxkpcolhcjytgdilelzrnr' WindowName: 'zmwbohomjxwsdjyfnkcrttjjdpm'
ClassName: 'mynuphctvdtbixjwr' WindowName: 'dovvzzrxoqjoxmsofuqcinplksxracgfuetrr'
ClassName: 'ocyejbptxvxxvikuphacs' WindowName: 'uaqorfavkigxejcfuadqen'
ClassName: 'psnvriabilybgbqkf' WindowName: 'oyszlkwgjlzcuqesxsyqrp'
ClassName: 'jnpmkgvebgvsfkhkwgmahnneldnkpy' WindowName: 'gmeycfbqtygzeuhxglywoavkggwqtvth'
ClassName: 'lhhkkesjkypzjfumyobxctest' WindowName: 'cjbcpznncrbwhfodyllpxywykurcasxwrbnnbpw'
ClassName: 'kseldijlxhkgfshthbezsbgkonwjjri' WindowName: 'rwjhtovausyghlnobxxgzlk'
ClassName: 'dihfbqlsvnikmofasvenpyojymuivcu' WindowName: 'iqvnadytofunqixzywrgyofnr'
ClassName: 'llhlgudpwqoozrqjjw' WindowName: 'xgoajupnzmrfzvlsfoieaco'
ClassName: 'vhvqydhvhobqynyubaicyfb' WindowName: 'jujcipwiwlfbnayoklivrqlfsnzfqbyjyj'
ClassName: 'zscjhlhhveoehrhn' WindowName: 'hgyzygjdvpwsppbh'
ClassName: 'figlmghdrdgskzdwlfcicrvebyhpdrrfwsixxe' WindowName: 'exmfodpkvxxknvsn'
ClassName: 'byhxpufregzlojhwflwaqjwwdystaieenpxtkfa' WindowName: 'ucqwwljffxphjxkjnvtfh'
ClassName: 'getcmyzpssydtzjzqtxzrvrlliirtoc' WindowName: 'khnzxgatsmjhjgffrqimhkjvkkzigpanksubqcs'
ClassName: 'dgekspskzlhnrvqrfsqcnkasqtvdjfxmspi' WindowName: 'vcvhqbhzjlkzubdrtzatglysiryekgprtlpfrn'
ClassName: 'dobldqenmwgbdbylswigoiraiwagvhkalkbudp' WindowName: 'cscsvawzhqlzkehqojayigbtjnipbocofnbu'
ClassName: 'ldddyuxzpfcblukgulvfeb' WindowName: 'sbndfdxnpvleahhndlcybjyorfcyrty'
ClassName: 'jwuxazdecqaxjvccbcsiq' WindowName: 'dmbhetcsaetgccnilhqltemviqgpatwuunkv'
ClassName: 'hdfmiudftpsiipkmtul' WindowName: 'hqdhvebnnoacfoopvhlqjrylpjr'
ClassName: 'igtmfwbkqyqxxnvqlvcaoybgkuzi' WindowName: 'imtamlqmozjtuoafizokfmhaueqrfvblbs'
ClassName: 'epotvetkemfohnqurxerqfoxg' WindowName: 'nqkvuauayyrnhtktaklwleyxift'