Trojan.StartPage.59564

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsd2.tmp\NSISdl.dll
%TEMP%\nsd2.tmp\Math.dll
%TEMP%\nsd2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\NSISdl.dll
%TEMP%\nsd2.tmp\Math.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'tfzfmzyjgtfkaowdudjezknzrid' WindowName: 'tckciucyzlmazxernsx'
ClassName: 'grgzokspgjlohapnexcnbagbooh' WindowName: 'snigiqdebkbrtzaxzbkcdeelqhqnaru'
ClassName: 'ddichzsrfmharpmhfjjoibzpew' WindowName: 'hapdgofgtsepzdlwdwkwcmedey'
ClassName: 'wzokawerjcccbdmxquba' WindowName: 'juluclftrahwshowlkrsxfvt'
ClassName: 'kbiwfehdadenefzbczylxhncvawo' WindowName: 'bbqlbcfjoinylzu'
ClassName: 'iisorgwpcndmuuxmsjscplhkqsflim' WindowName: 'yqbbiliuvbcbrip'
ClassName: 'opnbdiwqmpwngqobuinjwwfwqxvihsi' WindowName: 'obfanozsrqofvovyggbt'
ClassName: 'mmxjcxjmaubwtfksujseno' WindowName: 'lqgtkrhabetiyzcsotomfhvyvcrm'
ClassName: 'eyuhwjtgvuebryerqublxxmhixfvcnpn' WindowName: 'gypgixgbwptjvzifwlihodklzcofohcykleybpn'
ClassName: 'phcorvyouvomzcpz' WindowName: 'yszcaumyqwyainoafxoqetfwjqfkdbcuf'
ClassName: 'obgiebvsbddoyufziyxzwi' WindowName: 'jolviffqwhjudnzdq'
ClassName: 'yuowcvriwctyfouymgefuczsv' WindowName: 'xdyjeoaxzyrfkttzfubemqvxxopnaezwxnynb'
ClassName: 'pvmxrmbxcambulvccczewzuvtssqmov' WindowName: 'glvvncnuguygnryjdazrauxveluejilanimhuxv'
ClassName: 'sijsbepsizhgczniucrcylhlgtykbxuuesej' WindowName: 'tisdwvygehpgmlehprsjqwc'
ClassName: 'vblqoqgvrkntjnyuqmncfoljob' WindowName: 'zwfmtbgrquwrraxbhqudfpzxhrgwhr'
ClassName: 'ueuggkszhfzfmgdcnyinfwcspyoxitrwrksfx' WindowName: 'fmpeltbfbdtdthh'
ClassName: 'vlqhpyxxiuudllnkghffqlpajf' WindowName: 'yjhiliilgiwvfrsiryqflzuabizlucfqi'
ClassName: 'zmymtxhcyudxsnmpxsxqiaqlaoecjtjwl' WindowName: 'ndkgplqcystkdexnl'
ClassName: 'vfbmktynnjzwryo' WindowName: 'ypkfupfdzjxpcvzanqznrkvunqbfdyd'
ClassName: 'cvahkzwuqbzwzvjowszjicdekvthtqbb' WindowName: 'rldhasezgtdfwzefqclfjuucrfh'
ClassName: 'xcipbujgtswqswfvrtskgvsgyjvnrovjptl' WindowName: 'razkrjxghyxfqwipoxlz'
ClassName: 'bivdomonrgcutxsjgppo' WindowName: 'wmokmgfoxgsupscuos'
ClassName: 'otqvbvgrpetsfkm' WindowName: 'byqclfyswdpexiw'
ClassName: 'fckjudwpzgnnsqyfdoiluiqdbhgs' WindowName: 'ujtnyogvncegqotedcl'
ClassName: 'mygajgujrdwnlxp' WindowName: 'nwpghbscfjqbibvoqmmerex'
ClassName: 'gzcifdduxbcssydvvmaaobt' WindowName: 'dbyyixmomugcfsudopmczkfxgsietwjldtpa'
ClassName: 'fdptmgdoiiysoutnyzxr' WindowName: 'upnvkjepwulrmoq'
ClassName: 'nevjazgkhvhhxzboseeesszvfvgdtfah' WindowName: 'xcflftqvnhppljyleahuqxltzf'
ClassName: 'rnyokvwvwvyxdzngbz' WindowName: 'qhytnqlxufkbbjn'
ClassName: 'cldizedjcmjrffdrwmjbphytxvstccdcdjnu' WindowName: 'fjwnkxljcgpznsndnshtsxziujfumtg'
ClassName: 'pccjpahoexnrzdxyazvtvpqfsisac' WindowName: 'eiabidfvdoukkyjzfzuropznbvtuncjolxkvsj'
ClassName: 'hklrswohxxqmmpatxidmjblm' WindowName: 'zhefjmwpubhxgucepvgwd'
ClassName: 'vikscmfpexqaiiewxyiuydmraoq' WindowName: 'lsbjdkjaemssnppkjnwzihhmrqr'
ClassName: 'ranxoozaowevpof' WindowName: 'ehkoadpwcdpcbahlkfm'
ClassName: 'tqiivsalehyimvhatmrsvwruchxecgdxe' WindowName: 'ppvdugywgyrabuwkguatpuzlmlihchbdeo'
ClassName: 'oqxnewuxplmhnqdxhsdcweicwffk' WindowName: 'uylumgmhkzbwkacjrk'
ClassName: 'kxcqxmgnlithuqrvgvkmdkdnkymhnqlo' WindowName: 'gfqbtgqodrsuxovtkwxloddcsc'
ClassName: 'itekvyfknugoladfuztzlykoljpi' WindowName: 'tnfbamrlqabocufoiaz'
ClassName: 'wxbxsqrgmwleyvziksid' WindowName: 'wymsencmhhwrkgakjnliflyk'
ClassName: 'ttzfujmjekiyqoqncft' WindowName: 'lhdropyugpxbajvmrrsdhqhmk'
ClassName: 'gvpjlvwvuxmhdezeribtajefkrgqfl' WindowName: 'dqogkoimkqjlwdmozi'
ClassName: 'rabvgeryywtolkafgfbdbc' WindowName: 'ksyouyzavvsounrjnbesf'
ClassName: 'fshzrkffpelvincujnrosteyrwxwpgoyeoe' WindowName: 'ywmgwzglpnvfbxbtodfjlyhhsxq'
ClassName: 'yqisbpurzydmijbyt' WindowName: 'tmcfmnqbkivqnyighabbrxwubryyfwvjdg'