Trojan.StartPage.59358

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nst2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nst2.tmp\System.dll
%TEMP%\nst2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nst2.tmp\System.dll
%TEMP%\nst2.tmp\Math.dll
%TEMP%\nst2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'eelklwppzwldvhrgnqqusrneycghtubywwob' WindowName: 'tblbuqbxftsprrwgblhrjdewigzqxbs'
ClassName: 'oaazodaihodtczjjzaagnf' WindowName: 'ntkdllfcqaghgczyhtdsbwtlxsriehggharttva'
ClassName: 'yeyhkgkmxiitacgyw' WindowName: 'aemnqgwzpzgtfffvjsvginlkiqdvvpdwjyg'
ClassName: 'zmdswcoafaxoviijxpwrfynt' WindowName: 'wslolzherjtlljutm'
ClassName: 'pcoeevacskskcgbmcyerfltayhdpyxfsjrscomg' WindowName: 'fwanavuwvkpebazfbgtdpi'
ClassName: 'abdmtqnthinuheliogrfsgylzdroqfqhbha' WindowName: 'ngbbkpxakqstqzsvxn'
ClassName: 'vklkugjafbsacytjbqcluiqeadvmojhvitwklda' WindowName: 'ctbazqswetnprrbwrxxnmkgttsetisz'
ClassName: 'vuqqoogfxsgblxbkoov' WindowName: 'dxhhedqvkbfuquxdtoaeszavqrzgbp'
ClassName: 'ytymzojtosszroq' WindowName: 'fswviaxvminnnjjexkjcpkhzfmzral'
ClassName: 'ethlvvxqulvogrqswwfe' WindowName: 'mxpbytevjxessjizuessfv'
ClassName: 'ikpofomaiduuooidpdjsbt' WindowName: 'ayqezltboxnmyoobgp'
ClassName: 'ucfhykoioagwgslroswbsebabobiipckcsd' WindowName: 'porvhmxllibcwfftv'
ClassName: 'lxaabjrfswgevlcoerkt' WindowName: 'cebpqrqgkbbvbevuplmpfpvnceyveigrp'
ClassName: 'gpgbbgehdrabeqadnzjcqmmpdwpyzzubqjy' WindowName: 'cnlndssgztruoxtxaakiqzvzayjlbbfan'
ClassName: 'mrnywksztzalbjvalqcudjczgxwh' WindowName: 'fjphitootuqyhlm'
ClassName: 'howwvjvzttxoldqlmncnlzknkckypruepgxg' WindowName: 'tciizcqxpvnmkukmkyawjojvtldrl'
ClassName: 'uvxvhdlnewfhftljnwyshjr' WindowName: 'jmuwrlaqwdbvoxjpeopqwxwvb'
ClassName: 'metufdkxfzwbycjjraqgvzx' WindowName: 'vfkirevzirbzgfmotd'
ClassName: 'lmledmtbdzdlodopk' WindowName: 'hsgvxshdwobfmccnypejugadndmtws'
ClassName: 'prwedhjymukfvxkrlxjlchs' WindowName: 'czwzvybkbidoprzletqpnvtlyvoo'
ClassName: 'yonznyzdthdhtihsneej' WindowName: 'wfaailxuskabrrzscvpameelqbkxuzgoggpaqqv'
ClassName: 'uyztgerhitejkmysnxuwqo' WindowName: 'pskjirwthgupfaqlxsdkgdmhy'
ClassName: 'nakwpifwhtsgznwfngmhskptaolslnpjlrx' WindowName: 'ubpqfvbwpslsvktvowtoyxayleng'
ClassName: 'univdsfetnqrtxcuqzrlhfg' WindowName: 'dlkvkrfptwqmelcfbdttltnhhkiqnvhzbgpbo'
ClassName: 'qaqnkmvqbfqczhqenddzihtxilbkxnyqkwas' WindowName: 'kmvngiobryoonrkkiamdpzdvf'
ClassName: 'zvvkpdwyfoocrrcjtylknief' WindowName: 'tkvdyxufaulujpnhjpqbtq'
ClassName: 'rkmquglwwcldnagymeqkjceblzftubwzz' WindowName: 'ftxthyfgtseuxccrjaubdbjlkztpqzklhtda'
ClassName: 'yiplxsqrzdfpmtujvndcnzifmky' WindowName: 'homywuanotakmnkepkgjhgjkaedmyosqqq'
ClassName: 'lsgqnwaaqiyfnyduvkhtygtglpmf' WindowName: 'lqebrirdjrphdtoemtncga'
ClassName: 'kkwfgkzsvwhsvvnec' WindowName: 'irmhykcvnyjybcwhqpkugdubbmlm'
ClassName: 'dhzlclibolwvyypoztdwgyinadutktqlbdnmva' WindowName: 'sxvzovlxvcasizypshrnghzqkauob'
ClassName: 'eswgegmgihntzoicrm' WindowName: 'tdrnvsnpslmhjoq'
ClassName: 'aywjxbobqyhxqcmqgdgwhurhohqgvvdf' WindowName: 'etdgjxqfvfonejkd'
ClassName: 'zqmjfsxiuaesvrkomevqpnk' WindowName: 'uzzqojihqsilrmfntamkhrc'
ClassName: 'vypycuenxsvshislkso' WindowName: 'qkqrdcgcrxsrebmsxgijiwsrncpebo'
ClassName: 'bfkbmnkxhtqjdqiqryopjxojpjyhwmgxoadjjg' WindowName: 'jypbpwfpkyxyhwqfpo'
ClassName: 'jtdzqibimzodbyzf' WindowName: 'hrjaghvbgpqlpgrpmldbajbotx'
ClassName: 'nwukyrrkywwzxvytftefsqxaweunhouofkfl' WindowName: 'utmwwqioylosvlutarg'
ClassName: 'dgstttcgccuupauwuxodyjahqzmatfur' WindowName: 'ehqlxxkngecdvztagpjrylikppurkqltaqlv'
ClassName: 'msyfmtsluaiqolqxtk' WindowName: 'fgejrsjtxwlvfzrwgscrpwxuflknmuzfdv'
ClassName: 'cklhqmgnwtplshtoyhulnkhnyvhtizobszjzryp' WindowName: 'cqnvdovsgzsycscihweueosnex'
ClassName: 'wibtixzdswqzrnlnnsvzjghbxgl' WindowName: 'awsdwbkdcuudbijypsqznyg'
ClassName: 'lsrdadqqqqpvevfmchatuqfj' WindowName: 'ezgqjyomihywjuriqraotgbnwu'
ClassName: 'lvtmngixoxpnwghrmnogycjsy' WindowName: 'uvhakautuqznpohgsppvuaatzimglceeeohulj'
ClassName: 'rlljivounqgotcevjiprf' WindowName: 'xfqgsolfvcmkibqqlyntxthplneftftzeca'
ClassName: 'wctrsyjyqsmodkzex' WindowName: 'vibbmycxwvohspo'
ClassName: 'tsvutcaqiyvpxuniehbfauzxb' WindowName: 'frxrertprvrfxojecoyisxpxumy'