Trojan.StartPage.59347

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'acruaebfavpurqmwflgxibbc' WindowName: 'jbkawtbgkyuynhrrcioog'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsx2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsx2.tmp\System.dll
%TEMP%\nsx2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsx2.tmp\System.dll
%TEMP%\nsx2.tmp\Math.dll
%TEMP%\nsx2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'oauggcxnuxrytiqewqtu' WindowName: 'ivfexkmmcgxepkysxraxsoyikdfr'
ClassName: 'syecmtpouxzpplfxxlpcdr' WindowName: 'wrfzmlfsijkcxdmjhnanofmtgay'
ClassName: 'lepotrcquizgmyrkdgjuti' WindowName: 'wbafteczzmqjzjarjkzntyu'
ClassName: 'xsmfmyyfawyaysbxfn' WindowName: 'vlidxxvtiooiuhfsbmalgiyivmdwnytvvowyc'
ClassName: 'tdgveytbkndjzdityzsjsasrvtlmex' WindowName: 'zseprhknwiqbgtxscxbhyttql'
ClassName: 'zadnvckhdhbszmqdeszarygv' WindowName: 'klyntdcgqvsbfqyghvrauclprpctrlyioje'
ClassName: 'luatfmsykysunmeqn' WindowName: 'ggmzyndcbndpczgarffwugxkqpmwsyjj'
ClassName: 'tlzmdqqxzclfccelfxawwserathdxlsqp' WindowName: 'ftyymfydeoskhqpabzf'
ClassName: 'jlsmlvukwlhlsjuheueas' WindowName: 'jyxsodzkziiwragzldoygcsrdpqq'
ClassName: 'hadoezfddeojokufyzpvnogdqibwejgxc' WindowName: 'wwbcwsakqszxfagqepdhzo'
ClassName: 'jzfgneaysmvcaec' WindowName: 'gxaemjxgftcunkqski'
ClassName: 'hyckvkripittyigvqknjkplmicce' WindowName: 'skcqqyatcgokyujsgjypyknpwkrta'
ClassName: 'cjmeppgfstolefzkjlmxwzqzspmatafyqym' WindowName: 'whpgwiipjtyltlvgezkbnmoinmysvwmionx'
ClassName: 'gmosvyzdhdejaxotwodvycdau' WindowName: 'elbveiegfzghffvuwvosfmlghgcyxercblgpq'
ClassName: 'fqzvuojvnqupluswbpubdds' WindowName: 'irgmdvlhqbyqhxifyusgan'
ClassName: 'apjcumhjhqpkjjxzkvqah' WindowName: 'yqvngaxvyqhavlujwstgkbjjqtqhuk'
ClassName: 'mtjibaccacjbttfqoggpciwg' WindowName: 'vtpdpssvgkdmffkvcskfnp'
ClassName: 'bxksdaqstfpfxusvqxdtlj' WindowName: 'wbkqnvivmvgwicbjrzckcqkahnwmbfayiljsu'
ClassName: 'fonobtkhkqndknxjir' WindowName: 'arnrupkfbivyhaclmwpsqecwwvrhdkqamnu'
ClassName: 'kbckkkmpdbsobkzjcdhdanzrbxomh' WindowName: 'mwbyvdftdkpwloqwygveawu'
ClassName: 'talscopfyufhbxysgclcstjbm' WindowName: 'paezkefyogkzgggua'
ClassName: 'gzsugxkhdcgtenyozbgzoo' WindowName: 'tsjoremvlqpbvkqsf'
ClassName: 'jatkzrfmwfixteclxfdraweerrin' WindowName: 'fsmmoszjrbnwrjk'
ClassName: 'xislunldweqbvclhkqqmdhjxlewyttm' WindowName: 'qpsugzjutbsmhghwzpuaofjdxla'
ClassName: 'inpstcjqbtrhpzkhnrgdlgl' WindowName: 'ysuazbzzltfsathbvubnfrgtxq'
ClassName: 'dqyqlqyvnobzppbptuanj' WindowName: 'pnjyiuesxjjjmdtseaqqazcdzbctw'
ClassName: 'rwwdfdbsdkqocrr' WindowName: 'lhazemvpqneusrtpatvd'
ClassName: 'ckdtqsfkcexzynnybtkuaadgzdlcgxroy' WindowName: 'fnzeimmejusgvtgpau'
ClassName: 'wjyzbmqrnpyprvrhdaixytqvicbgjjskbsy' WindowName: 'tjynuemswdahkvufuh'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'llsgpeesomhjbqwdoyuozwfirsokeprqtyg' WindowName: 'drzmzlqyybdjjttfrlajvarmkciqotcqttjrgjz'
ClassName: 'gghmxucmhfuwwiqswbey' WindowName: 'xkplfomllhxovrgxxdkiikrmgrgezebguoyzn'
ClassName: 'fwzbttpuqznpdrqnugaea' WindowName: 'mrumeblxemwlcnlglhrnflhupheoffpfilfyfe'
ClassName: 'ryakxqqkcqknasxipnvcfiwgpq' WindowName: 'pbnvxwynebuovhdqcltbpvhftf'
ClassName: 'hrnvmhflepurbnnqllhizh' WindowName: 'yxcjatybjiychbgexhybogzuokgpsps'
ClassName: 'aionjpfuxxiunkkpdykggqizvx' WindowName: 'ysgjipycgbwxuxvyzrdnqzbmgmdkvqtsqrn'
ClassName: 'twnfvfgjvegpejocbnlus' WindowName: 'prkjhadewuurdhsggprgocidltthpeilwguiys'
ClassName: 'kfvyybhgijzzdrqbfjzrbuyzkafnipssf' WindowName: 'tcflsuvdbpkoymzvhwvojgpqtdqbcqa'
ClassName: 'hggreoervcsndrtaumkrtbgc' WindowName: 'ibexoxrhuoxqzlojnjcbzhqaakwyjiycfkbd'
ClassName: 'bbfnkajrocxikhajdvrodwnyr' WindowName: 'xhbbezmnwpdnftxaumpu'
ClassName: 'atjbxnrpltwcohxyukxuxry' WindowName: 'wevxxtswmwdfcykiwoybblqd'
ClassName: 'jwyroqgtpsmeazmz' WindowName: 'lsafkvzywkqfbansdgn'
ClassName: 'efwhngffmvwchpxsafkljmz' WindowName: 'jbabdqzgrqgtndbgxnxfgpvagtbijfotviqs'
ClassName: 'lvydknrolwpmawebvdflnwpirhjow' WindowName: 'tosbdsgtiwembzhhvf'
ClassName: 'etjdrjxflfidabtu' WindowName: 'zqitjkzknsadepvjeswwplaclumqccb'
ClassName: 'ayirgycwqrncfpbfkxzyipbhejxbxqaek' WindowName: 'vnqcswwipckpmfz'
ClassName: 'aswboyvrgbvutlw' WindowName: 'gpmllmxooijvuutxhjresql'
ClassName: 'rhcatpdbrchsdbsnpfqdqjyvcqxcwodnyyvugim' WindowName: 'chqvcwkcmcmiqnd'
ClassName: 'bbuaesxdhvujpkxttmeuokylhgmicaawrzfnk' WindowName: 'mzlvdulqnvxuzglbiphx'
ClassName: 'nxyagfnczrqwnrw' WindowName: 'nwntzvkznwxbnmeewigmtplgzczhzlpprcdpwj'
ClassName: 'kajxdjusmhkspaxiturtaaotuajbw' WindowName: 'fncoxtrvyusxvpclchy'
ClassName: 'fqeqnesoytinvnhlfqtnzwnefqnsbswm' WindowName: 'nhrjcpolmnnnwnewwepnnthyjh'
ClassName: 'wrukhqcdixfyldouxbyqqjmpuoaklnqpeu' WindowName: 'yrsohrgmfnpxsvi'
ClassName: 'lvhtqycugxgmpornhgqijtl' WindowName: 'dorjoaxsrhuhmssriowrewgndncphjizz'
ClassName: 'axcmqpmwepgbritnppaczmeyz' WindowName: 'uekdpwhmwznbdgfpudxej'
ClassName: 'mdvjgsjcgpyhgzanfbhmtxgjdopmb' WindowName: 'ojuttnvepgfrlwntrwymdkpqxcyio'
ClassName: 'qynyfwbaaczvoyvfjblciqkx' WindowName: 'gdyereusuphewnwzvedyu'
ClassName: 'nhqncveervzecxgarxvbclrtorcbj' WindowName: 'ixkgxnitfpffbkywdlunn'
ClassName: 'toeeqbaezdmsqhvm' WindowName: 'aiwqagvnmmaaxekfhkemusjxtboaccvnnpkgkvd'