Trojan.StartPage.58492

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsn2.tmp\NSISdl.dll
%TEMP%\nsn2.tmp\Math.dll
%TEMP%\nsn2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\NSISdl.dll
%TEMP%\nsn2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'skwlsmnxxmqapmyakalajntag' WindowName: 'yibmzlbdxkzppgdohm'
ClassName: 'xyqyizusmjpiqhapkxnc' WindowName: 'dybwosuayrifyfyoxmnigdmtml'
ClassName: 'cjhaabwtxqigzuuafbbkzn' WindowName: 'shpdogkqnualsdmilaiseallxcung'
ClassName: 'bquidjlpuxccsdapt' WindowName: 'yisuwpuqkkmcsaugcwz'
ClassName: 'pydouoconfhmycgkxbmgicgagyacvw' WindowName: 'lebenghmrmhvuziktwjwfxlbdhumpn'
ClassName: 'gxqnpaderrantnpnwnhzdqyjyeurxelvetdy' WindowName: 'knxtvgnvejbpkeamtegb'
ClassName: 'ghvdoeeuuojqqzuqdcmiglrfu' WindowName: 'qkbldodyhiiprtcakyzjxxqvb'
ClassName: 'vierjirhsvhwvwclosj' WindowName: 'oxpeljhqqodpwnapyurf'
ClassName: 'olnupbyrpnpjasapchyxsdokmarpuscqv' WindowName: 'uhykpdltleusaehquoivdicpwpyauoqebdru'
ClassName: 'hdqiaqfogyhwwikkdeqyondnl' WindowName: 'frvhckpnzoxvknobknngwdppk'
ClassName: 'gjimcueeiuctbazbzmvqzfmdwc' WindowName: 'mecwsvsgepanexgucpndphtjyugba'
ClassName: 'uvztavypgmlokuagwjfi' WindowName: 'vjbhylsaumbhxqezardm'
ClassName: 'ojobsiwkfbkudtl' WindowName: 'jteovdkrienjaxuzl'
ClassName: 'tiyahfssrfmwxiegphdgsaahlhxtypmzrk' WindowName: 'lzrnpddhfcpvgdk'
ClassName: 'jolpwousdozqokble' WindowName: 'bqvwuxzichdmzjwexczxocdbxrilstkcfgftdgu'
ClassName: 'idpxnhzstriysjuavqxbpkznkf' WindowName: 'ehukpoypbynrbrkprbjktbekeq'
ClassName: 'akujlrrilwepfgwpaw' WindowName: 'wectrycdykbzyhzypozqajdovq'
ClassName: 'yujbnyvyzxzpnyojqrte' WindowName: 'qjlxetounaeaoxubuyhqizcrtmsglriipuw'
ClassName: 'ilpkmfpblgezaoe' WindowName: 'flyahykrsewjzfgfpywicfbnqdrsgcshqgs'
ClassName: 'hoeofrmifiwjwsefwqmyorpzirmgmeshnsx' WindowName: 'jsuokgcratpumiwjlqszankwtaulwskrepxxu'
ClassName: 'yvyfdckhphywjuhwjozvnivzvlqokkryds' WindowName: 'ctbrbowflxnyacziovmvdxq'
ClassName: 'ijanwwgrmsclppvg' WindowName: 'zpdpjlsrppdsbxqmfjmxzpnj'
ClassName: 'xzmmwfjacznkurstqtskuqn' WindowName: 'htmxynbapqvtjihbus'
ClassName: 'zhnupxiewazfgnyofzxouzqmqpjrvfqc' WindowName: 'cgfvlekmehggccokgdttpmckytwocmqbwl'
ClassName: 'soeoeoyknklyinllicoltnddebycxdmjqvyuvu' WindowName: 'fjleekralvnpicmahnuibcihzfgihnnzo'
ClassName: 'gfzuhqqutjncsgnsqcnq' WindowName: 'ejifcpzdogmjrailyaaxqlgzqvasc'
ClassName: 'ytuzsvsaxgrjxso' WindowName: 'sjgpmdammijpgikulok'
ClassName: 'ehjlwzkbehaeinvxjghnwtgm' WindowName: 'ojjloygghqwzgbnlqbourjbbefvncnz'
ClassName: 'tkqjvzxqtabakumqudcwvzkkipilttheqvuzrja' WindowName: 'cyaidaxpwyeytdpmpbqwyeowweztsabuod'
ClassName: 'dowwcwjfiseaqvddjozaesjndewsoriao' WindowName: 'ihvoxsswwtrgobpcyswn'
ClassName: 'sewegaqwpqrrgojsdvpjtgkwkcqdzefoqba' WindowName: 'jjvnbydeawjgkxzkowuwznr'
ClassName: 'gthqnvtjxcijtzjhteijbmlrucpmn' WindowName: 'hqkctnyfakzybmbdwyyhvrslryor'
ClassName: 'fyassyppkkscpvrjhabdeggjaqrac' WindowName: 'qhohelfzhpmayvzkfrxlurwhmaeaqjvxqzfekep'
ClassName: 'bdmcjgycadnxxqfdtvvyeevu' WindowName: 'yjxbsdxmbweurtodfkqinbjos'
ClassName: 'uwnfmtojywhregghohrouxvebuktzmokifuyb' WindowName: 'ipjmmyjnqyiqthxqtxbzhcahsejbqfd'
ClassName: 'vnddvmhkivmveycsmzm' WindowName: 'mxknjlfzsigybslsqd'
ClassName: 'qknantmitavxmleflskggmycztmvbupjifoq' WindowName: 'swqrdmtcufhqcbstoop'
ClassName: 'odceibokvflnprrugslgoztov' WindowName: 'gpaxdcnniwcruorxelbn'
ClassName: 'hjtmrkjfqmeortcvvpyxrpfk' WindowName: 'adxsgxikovrqozxvv'
ClassName: 'gmkxxegnrrfrmkaxvuvgvuhf' WindowName: 'ftdiuyfalzwlllxntllxqqicaivjwlwqpbmd'
ClassName: 'oapowfcptrlgvfnakfxqermb' WindowName: 'sspktrdxoxrxxtydyyownsjcnaned'
ClassName: 'gvaehquvonppacbjjcdcuzzdqhjd' WindowName: 'gjmptfnhzcjsvbgecvnhkueloi'
ClassName: 'izlxylqwzmmdzvrvddnvw' WindowName: 'ldazpfxqmqbhklpt'
ClassName: 'twmaulnweglezsburmsmoahbdkiuog' WindowName: 'wuhxernypncjpavxhph'
ClassName: 'mcnxcoshuncozjqfhquavkt' WindowName: 'lixqtrpbikokzyyfmwyzxvsspgyocx'
ClassName: 'bnrgxozimldtchecwfcg' WindowName: 'mijdzfxodnsdzadxzsmooay'
ClassName: 'sfwvhjckazhdevzesd' WindowName: 'jfiyyuxaysdklmvgiig'
ClassName: 'idpgminzstcenakydnv' WindowName: 'hckblkwnycgrpstmhslfeewfruyzm'