Trojan.StartPage.58408

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'hylqgktmwaluacrguccbcavpohjromcjdyfv' WindowName: 'jjwlmkqgiwkesel'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq2.tmp\NSISdl.dll
%TEMP%\nsq2.tmp\Math.dll
%TEMP%\nsq2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\NSISdl.dll
%TEMP%\nsq2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'cqvudehizjnihasdchwrhjkxtcunpilkaknauj' WindowName: 'oicpgorkyrpffvtqqoebjeb'
ClassName: 'hafyuzphwdjvzicrskfykkc' WindowName: 'bxxucrbtaamhcswgbbvepsigqb'
ClassName: 'kivwfkbswfptrmlrmtydll' WindowName: 'kvjffyegdtkpdvixfulafrmnkbilm'
ClassName: 'wruqrrvqzhvzuzrqratoz' WindowName: 'xvrpbllwitugfcbosrqesqaddohe'
ClassName: 'gfijceadxrvbrcecsczqlqvia' WindowName: 'swmpaspwnpsabqbvhteyuyxsg'
ClassName: 'ntspdxsnwpapixwdypuiuikvnc' WindowName: 'zhvkokemdupstmjeduxrhrbwzxu'
ClassName: 'paladfegrxoysyyqxw' WindowName: 'qzbqhplmxantuhos'
ClassName: 'awobvcgoiffirbzuvsxvguaibwcfudiwkiqo' WindowName: 'ngpgtqtniwkbvpyfelqfmyzdiijn'
ClassName: 'ewnfyjuvpqqjwaqajxbql' WindowName: 'zpzztlblhxpavabdyeqtcccfnnyuo'
ClassName: 'rhpvzbbgquzjmaadtlwqnmfkelgkcpnbe' WindowName: 'lrmxedwrmrxzlhifzshyzfvfgf'
ClassName: 'scyduawskbiroaaaeczazxesaqdhfux' WindowName: 'wpbkqmametohxagdnsll'
ClassName: 'ssiswcrojdaxibgjubvnguolkcrvrdapogzazj' WindowName: 'ehrojtjiervvzgbh'
ClassName: 'pookvipvvsjsjjtgdzlmwptm' WindowName: 'inqcuroxmuytzpbbzwxstci'
ClassName: 'ialuotoyffbrivlfkwxnxu' WindowName: 'todryldtgzkaguj'
ClassName: 'xcfxccjpuqqksumtrnnmgvmfwcpxymoumpwf' WindowName: 'ruftmiwbwvqzopkovwcqzpfqkwtrwjbz'
ClassName: 'qultaemtqrhdyrnvo' WindowName: 'fflxodsmsykrwruucvyiskykatdbivktkwvwsy'
ClassName: 'xcmpcrtfrznbztbacjnuhepdhzmqtfun' WindowName: 'gbuqwejxylttqwantskijedockhilqvhuit'
ClassName: 'ncevidfvqgyaguphgox' WindowName: 'vcicawpqqkadqpjsudfiy'
ClassName: 'ezhoonekidzhtjuqhmgxqo' WindowName: 'igcjgpxdcanxpekmcbvdqtholquebkvqoqfc'
ClassName: 'ucdxzdzzwlcgicprkfou' WindowName: 'anknwjsehtfeynsnltvosfxklabanbsrtocmco'
ClassName: 'ldbvcrtvzyluxxftxmglizlltxyxfdto' WindowName: 'saoqvbvenilazjze'
ClassName: 'npigrnppvfpuyltththjbfh' WindowName: 'ixtnjmgjnuefnbwffvkkn'
ClassName: 'ewfyfmhvvpklnivetexbbyvrejhhhu' WindowName: 'pfqzewabmrzpwqpvka'
ClassName: 'yxudlgodcsvcbjbrjzdm' WindowName: 'ecdlueanblxidhgmjfzmfezusxzxbyrqleljlt'
ClassName: 'hhaokskbalyfbkuvq' WindowName: 'tnvzwjbltzfrvssfbbcmfnzsvyejmhwce'
ClassName: 'guxajhnahpzefrxvpjmt' WindowName: 'dmscetxrjhvofdlqeklosdgruecptbxx'
ClassName: 'lcguwowlslaeuwzhcnql' WindowName: 'esapvzgmjfmstuonfxikchfimnaxalbuogzqxi'
ClassName: 'unzchzfcyeptbjrzyeweeqriunywthmd' WindowName: 'lgosxrjxghlghkpfpljmzjpqccpztg'
ClassName: 'txspeltlqglldwxalpabtxgburvyv' WindowName: 'dgehlvhcjncqwcphmdocillqvjpdfkexlokcgcw'
ClassName: 'iulaibqbvjgetbhwbmyzmqiuae' WindowName: 'lgbqemokxcuuyfsu'
ClassName: 'kebilhhicdmwlnpqbumwvdkvuusimsurymuou' WindowName: 'svemzgcxjirkzonspxphdnygxojkzcozkf'
ClassName: 'khhyoyexiwckpzsvyiidw' WindowName: 'fnfyrnlefxrmlwasiclzpjtpp'
ClassName: 'dudupazsywgagnckxhzfjmeo' WindowName: 'jifkxfbksrhbnppeluwvnnt'
ClassName: 'heqklyojbujqfgoc' WindowName: 'bjygzlrizqjnweey'
ClassName: 'utlzplmpoexiftufugypopnliyba' WindowName: 'censacedsfvqimwiocivgtpwpuje'
ClassName: 'spsqtuegrtzuldfitozkxk' WindowName: 'vhyiqrrsrvefdervyeaxzv'
ClassName: 'roklkfocsnzbkmxnzlwqfcimnvvp' WindowName: 'rxfuispegrbxahjosjcdlqrwuhdxwwmtmxjz'
ClassName: 'mruqcjnlzeffvae' WindowName: 'uhsepjnadvohrrbifopedcakogsxygsjmakif'
ClassName: 'bgutlxywcpihqunzqtnxalgryt' WindowName: 'hvdlizdpzsnjqmoyburnr'
ClassName: 'hadycvdzagjmrruhgunkpojsuwvccoxnwvqkaw' WindowName: 'vnsgpxwoivgizzdyljvpf'
ClassName: 'sircjnlmozgyirhmovmyldqxfqaj' WindowName: 'jkjbhragwxwgkbishfnwaaebhwubmbzuyqdbii'
ClassName: 'aspltohesujbhgchwxxnqzpasjehdknrba' WindowName: 'mohlicmmjvzhxygkbshfulgnywgpzyvtnkbp'
ClassName: 'fkolsghidlikcjaxtevpcszhpqkqrhjkywmjwzi' WindowName: 'bnltcnkejkvhmxqbrmj'