Trojan.StartPage.59042

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\NSISdl.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\NSISdl.dll
%TEMP%\nsc2.tmp\System.dll
<SYSTEM32>\PerfStringBackup.TMP
%TEMP%\nsc2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'sevixhnccwacuiljstuta' WindowName: 'frkorwtskdylijynkdlr'
ClassName: 'uulmrtdtpymifbgxzopfezdu' WindowName: 'jiqxxwujrkpihefclscyxxxwkryjvegoumwlcy'
ClassName: 'frhryjgpfyhllidurzjpnfppj' WindowName: 'zcbpagpfxxkuitprploqmbagijtuywgztosggl'
ClassName: 'aeuukhswxrybcjdi' WindowName: 'exuniveerppscwlaizfknddbi'
ClassName: 'oexbyjxidwfnanzazoqohbtglzgystadoqtwfqq' WindowName: 'uhbsmxlyybcnezmgraddkqrsvgfsngwkqsaac'
ClassName: 'dhkkvzwafosqalrofmso' WindowName: 'xhtipfotdlddrqxcvssew'
ClassName: 'ikujpwwsxtcrqsugejhokntxfwcaxycxogatr' WindowName: 'cpgypfmpcwrpkcumyazucdhahdsixeqok'
ClassName: 'yezzabwdwvuhrzmwtphvuvatqdumpklwuqcea' WindowName: 'bnzrjvtjiytrfbfctlkrdgealxaxhehgnduvm'
ClassName: 'ungqrcppzjfcnmgmbjdknopm' WindowName: 'konvrpraynanalyn'
ClassName: 'ogmbqnrdpwtcjwmrjtsymo' WindowName: 'ebdnqubiiowdvnnzawspzgcaxvipwdyuijkiaf'
ClassName: 'nxmhnrzlurbuhkuombogsvkdkzvmwumeojk' WindowName: 'cumqtnrtlllmojvut'
ClassName: 'bsvfmujysjeunvynbbhcgecex' WindowName: 'khznuypevwlvylgmhfycbzypcfsqii'
ClassName: 'wakmogoyqqbwxoaud' WindowName: 'btvbjohcbpkffdamytqjj'
ClassName: 'ymbjltxstmibjsxiacthp' WindowName: 'vmvwmdfpkmqdxbtgyayvf'
ClassName: 'ujsxkkinvzfewdwzhycbqi' WindowName: 'sdidtmeniwwmkha'
ClassName: 'pcfuwjxgkvbgloezhdgs' WindowName: 'ttayulypbrqgwscnoxquisdvnxbuly'
ClassName: 'umjudgrlzbumrmaywiwxhnmhehq' WindowName: 'zcvarkngqkfhshsyq'
ClassName: 'leavsjuzhldyemskz' WindowName: 'zyvsdcvqfnbqersfgybszuldjlkwlcjqadgxz'
ClassName: 'xxncembqlpcppyehirfotaoi' WindowName: 'xftadzoenarmladptnjplrcgdo'
ClassName: 'xhexmvygejpqgwhqjujenxxie' WindowName: 'msbkimumnflrfymkxfel'
ClassName: 'ubqestcdpeidhyjllurqhjkevufjsqwev' WindowName: 'cdhslstzotumarzzbyzyotjx'
ClassName: 'mkgthttldwpfnklktgtmndstixzwbzzghkpfctk' WindowName: 'hddijiajtaohcizaeeicsmhwgvcuyfryydknbjy'
ClassName: 'slclbogghyvaeculqtnvzur' WindowName: 'oglyzzqvpsfvtkwdkkot'
ClassName: 'iiiptmbtkmysixttn' WindowName: 'lfgsbzueshkwtiaduoobowvinv'
ClassName: 'rmecujpedfzzhnrozvctmkcmqzjbsz' WindowName: 'lpvljadctuhgnnqkwovlpjnchdhfunrfixhvdr'
ClassName: 'kzqjdzxykayhaxfoxkqiagryfobgheyckne' WindowName: 'jxfnwzknlhwbrvapbfpxqmhyumf'
ClassName: 'xsgjlygigtemuonlbermckmioxtlmobbw' WindowName: 'twmtwzzxakpnkrlhv'
ClassName: 'tuyhegdirdijtwposuttsew' WindowName: 'wpwqhevcaejzpnzbrcmtlgbssudvasoddqkvx'
ClassName: 'bbvflsdvfdzxordn' WindowName: 'ixdxltpyvwhlbtfngohkpfiotxavkhwyokwow'
ClassName: 'bcfrsjplkteaplilksmzmqvr' WindowName: 'lknpdepwcbuanigkttxxvckafdbbcqqcsw'
ClassName: 'vmpnwenmglwplcfzoundsvfttfzwskpqafwcsl' WindowName: 'byphjfpylzdzgtufistnvwekhn'
ClassName: 'wvkzkdfkjkbofnclapt' WindowName: 'ksfggixiyvlgwdk'
ClassName: 'wnykpbtibdtanxjwzsjwyzmvgrro' WindowName: 'cyqphthfbelrlidcbtnw'
ClassName: 'yiyoxmbcnwdfxrro' WindowName: 'pyshbjzaljbysgqsbumuwigzqujhnqochabcbg'
ClassName: 'vjdxgevguakvxenrxupcxbmiz' WindowName: 'hbhjotebdcwvxfyhxwaxd'
ClassName: 'aexoxgcltsgyshflkepvscxpgdudauakuu' WindowName: 'gnwhooiwnfmblvwhwpa'
ClassName: 'gkljgukctigxjejighdfwqetm' WindowName: 'jsdymwaeolamhxyrpgj'
ClassName: 'cdaustesngecyxugffklrlhgoj' WindowName: 'rzsmpmirikmrfbz'
ClassName: 'emrmxhpulaqkhjvkmgkdbzoatwciqivrrnhaswp' WindowName: 'gunfdxmhlmceuguzfqfbbdqvpdqpc'
ClassName: 'qgusvcmdurcqtitiktza' WindowName: 'glsbcwgjighvzzfnnptid'
ClassName: 'jqxeflycwgdemyvpbpdffjuepdviasckzf' WindowName: 'jejdhjnsbpguqktnoeslvqaarnwxoxtbrxpi'