Trojan.StartPage.57853

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'hdtzghqwavpmswrr' WindowName: 'cvhpwmneshzehumzomrfegbnjokcuceq'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsi2.tmp\NSISdl.dll
%TEMP%\nsi2.tmp\Math.dll
%TEMP%\nsi2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\NSISdl.dll
%TEMP%\nsi2.tmp\Math.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'rzuhbffvtbzvsnkzsfnqvthazrwbyfh' WindowName: 'llaqvhgfecvmfjsovqpztgmsnv'
ClassName: 'evxewfdjfmpygjyt' WindowName: 'osbxntujkipezymhncaihdwmfmbl'
ClassName: 'vsrdimqlwwvbmqnfoilpwxfzsetkdotuvpy' WindowName: 'wowwbldlbrmgsgmyircrryvxa'
ClassName: 'jkwtxbwelkpzhxcovfnfmrkdikqgncfyefxx' WindowName: 'hgkkityjwarntpiyfhuddiwohvotjgskndkj'
ClassName: 'frcafxzspwfpfqljcnxvotrwqhaffcbjmvxsfqw' WindowName: 'afktwafekqaxktvfhabytrq'
ClassName: 'ctmjpriuxytmoloeafrajhyscdkbvm' WindowName: 'gmbnnooccawtqpgxxxefhaeaxlljcmhxoewd'
ClassName: 'feqgahunzbivqogmxkbxbjleeaclxwzpmixxs' WindowName: 'jnfqabrhyoybtsermbuhfkjijw'
ClassName: 'yukzjbkrzpqxjongaqcnufcjogtxrce' WindowName: 'gxcrzpfjhhyfjyynlontiqhgntheju'
ClassName: 'jsbelcgitraizqi' WindowName: 'vbnyzzlksfvwywcrhxmkgc'
ClassName: 'lnrsszxatvydlfhmvvycmtvqfjuucobmcprqxrx' WindowName: 'pgyicxbtggszlollhhbvuslqmf'
ClassName: 'dywbggnqbbhauppzw' WindowName: 'cvetcqlghrouhbdtdhgzz'
ClassName: 'hgoadzqxnjlkcihrficuqfsmzs' WindowName: 'hxvnndjbqphlfajltuqv'
ClassName: 'zncytcyseaevaqppdapkglklopilujrdz' WindowName: 'exsvweoimzijrauwqcnwzxvalhtfomv'
ClassName: 'gwibpjgnalweqddfqzfwqftfrpieiyepxebdpg' WindowName: 'xipgrzajuztbsubnvqymchooodapuldtaxy'
ClassName: 'inkuqrtuiatttpjxskijnnpuen' WindowName: 'zrlvzevhlqiqmykonhoiek'
ClassName: 'ddhxsdcacdquzftbpf' WindowName: 'pgbgkrlwcffxjfiaviiideqbkjmh'
ClassName: 'ilibefhphfbzjjemthbdhqajykdhpapvqzwgxn' WindowName: 'xlasoigkrjalvtqkqcqejobuztccz'
ClassName: 'fgoraaogxedkhusfvecvx' WindowName: 'tgudrneqfbcrsgaithvsynvadsptj'
ClassName: 'vymnpqkzfkcwmtjxtfm' WindowName: 'sljkglyljdfvqkbyspdctqdkvgejyn'
ClassName: 'sksczlngzavazmdnbftsnplpvckwkcrvc' WindowName: 'ccoubabuybdwduun'
ClassName: 'ynaykohcsvuvvqomrqvwgswuow' WindowName: 'ejndxfbmohshgbaueumtqyc'
ClassName: 'tlunazllcbbsbsrdmrrmcwkzedwgmbaqwsozv' WindowName: 'yjntlkrlmdflzgcybhbhoeoceigatloayddf'
ClassName: 'nprdshmpmluuutrmk' WindowName: 'zsivwgyahqmgjyhmitvcqpi'
ClassName: 'lvrufiijqhaykebcsfyjvjnvcvgzosduw' WindowName: 'xuvwwipzduwdujmeluminpvjoaintaymdeeiwa'
ClassName: 'bhsrjpccjthogtn' WindowName: 'itljkdfyrmfkpzftsttxitqwoqhqprf'
ClassName: 'scjqwbemjpgnxlfxtmozlgdttmdhr' WindowName: 'jldubefqzysupxbirzofkenkkmlvjfzgyytzab'
ClassName: 'pycylkfepvjfiumdthjzcmdpomvks' WindowName: 'dzsjrcrkfpjgellltciybdnisxovtee'
ClassName: 'nromhbvaurugqtgmoclztnkizo' WindowName: 'qvlgweuhaxmsdreqhwn'
ClassName: 'hxmnukvapfxmdohbznjioudkjnrdvue' WindowName: 'hmosukdbijeqzvcpbvkazmdgwnyu'
ClassName: 'jlommtpirpmltcaenphpe' WindowName: 'tjfrvbykkfaawrg'
ClassName: 'ynaxetpyvyqnjzzyfh' WindowName: 'vgdeozjxmhmlcqiimwwexysgrgpqpjtac'
ClassName: 'kdhmoowxvfaczwfxtupomeohz' WindowName: 'runqypselpxgtxzbupvvllbqammdy'
ClassName: 'opiyfynexovttiiezmshmcnavgddkbv' WindowName: 'gobqsqczhcgsbjuurkxawjomseqfgdnlkboax'
ClassName: 'gccqzpakcivqdumbpvksekglkxwheqtdify' WindowName: 'iqesvttadtknoycxbkmt'
ClassName: 'ypitobmiwfehvofstdrumibw' WindowName: 'zqvhxufjsgcxaoupcyfteaizmwtva'
ClassName: 'bcmlmwqqxykygzqhzjrbpjroekmoshc' WindowName: 'qovqqrewzmpumvwcgutapabm'
ClassName: 'xfhrvhvjabeiluwkwylkfhwkofqezgoub' WindowName: 'wrmkaavktkhybyhodtzyrebgs'
ClassName: 'ukaicelzgvuuyloyhckogwitfjegfaino' WindowName: 'wxplzbhpwhtofjsy'
ClassName: 'nuibtsbnbsurbmfgxzwdkgj' WindowName: 'ikckxmkiopbthkwhi'
ClassName: 'pbonqsxxiycbmlxhdvwbvnhxsol' WindowName: 'rafjtmqafcnsbmueedcmnxivyn'