Trojan.StartPage.59436

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'iwupreqfrtnxrvvxofjnmutbfsopcjf' WindowName: 'gmlqhmwymeksmbgb'
ClassName: 'hvqoyxblygnegcfjgvrno' WindowName: 'svtwltqikerkduvsfxxxudmvij'
ClassName: 'cqoyhnpciljepcrfkov' WindowName: 'fiebieknuqwvqshasyvbfmafbwzey'
ClassName: 'fomsmryetfqjdgx' WindowName: 'aowsjnblmzvdrhddkxqu'
ClassName: 'bihojozxjhlahpogmwbocbrbvxtqh' WindowName: 'heloeutwpsywuzvpongvu'
ClassName: 'qzjrzbsmrqmzqtedjaeuvyifofkasstrkkxswkw' WindowName: 'ewmbhprpnphcmkuespxtjrkcs'
ClassName: 'bkvhvmjqyfhszdyvifkgvhqvriaw' WindowName: 'nuqujodjpvnlfzdnqutkzmctj'
ClassName: 'vxbickydkwssjnafrkrvoknkszt' WindowName: 'dldxdcbfwlmxjhbnionbqjhnwznk'
ClassName: 'stcikxwsxahyjfyolmctpnpmvwldhymm' WindowName: 'jkeiwujwhgkgvrfgndyxrypjawudrceqnhwt'
ClassName: 'tvdojxbnpihfwlrtfuvicryicciulemc' WindowName: 'lsfnezfhyvogsmbesmnffwsqrpwfwa'
ClassName: 'lukxdkmixfotghzptaqqsyonnuedgloyxvqozpq' WindowName: 'gpnnicgpdhrejwdpfclnxsxxw'
ClassName: 'fjyxzvlxuukestsezbpguxevwgcqrgd' WindowName: 'dslajzrtanpaljpm'
ClassName: 'exdejhqtaknzyqsrqbjgtothmivaqyyhzl' WindowName: 'ggfhfpbmrxnjasaggvemreoc'
ClassName: 'dxiyqsoqxeonpdwytmkiyxeynr' WindowName: 'skbocnrwrphvicipwyjdzcp'
ClassName: 'orfzrxamndqxrpwjcccnndwlccaiyrahe' WindowName: 'ypxcyrdthzkptlsichggkykiwzvboqhdpjwbxyt'
ClassName: 'suopzcggsoiqolthkhdjek' WindowName: 'qpdcgkrabfuxrfdngeneaygkmcbgkwrxduz'
ClassName: 'yyuzgedwzgcnigzpfxlghsaan' WindowName: 'dyoukpxaixjkmjimnowbciad'
ClassName: 'ojkgcryibleomjzgiapnirjwifywdenwlpqyyo' WindowName: 'rflvhwapbuhqhsuzppckdbkxifiqrus'
ClassName: 'ztdtjicdcnqgrwh' WindowName: 'nrrkgiygfsytuguhxbhlvyc'
ClassName: 'kkdjbydyrxabixaundvuthqlxtordwcsltvaqpc' WindowName: 'ykwqookwcgfvgpwfxefxqepuxmof'
ClassName: 'mezwenfftsqisckeqrhioyaxtk' WindowName: 'dqlwxgfqrerjwmvgrvkx'
ClassName: 'cmhrghmffwmjlmjfpfzvvlaqfd' WindowName: 'vldnxerjulqjfjigjo'
ClassName: 'uehgnmlgckpqwbblvnijouvuqjxgkzmhvcpzq' WindowName: 'bsiyurormksofhd'
ClassName: 'foejoggtwlqfdqtmqqfshtgybrmkxxzwiozosy' WindowName: 'nytyodplsjqwereb'
ClassName: 'xbpcdkrvasytzgpkilerfypqyrcp' WindowName: 'ioupwzqlzxffwofnexkywbhaiasddepssdy'
ClassName: 'bakvfzqdosbikttpjmzlicmdhzpoveavk' WindowName: 'ysgnplgzrtxxfgwh'
ClassName: 'rjcnabevadbhaafazcoihuovigsczqyjad' WindowName: 'fbnthgqdwmoocnufcw'
ClassName: 'wfcyxqbxvnzytsgsrolmlnslqmqfuirukqjfcs' WindowName: 'bvyiyvqdocnijzqjcpimumppgwxxl'
ClassName: 'bteemotjqltjjkxxebggckxh' WindowName: 'zbqepztnjesyfxblgdviinyo'
ClassName: 'cpyuvhvznfibpgzzrrrnfehp' WindowName: 'aocoatjkjjykhrvhfbrzmebmthtgjzkhfcdx'
ClassName: 'ojizdxbrvnzxzuodtivqliozwotgclxpq' WindowName: 'orunkqmdgcpaukvesjvnzvnungelrylzki'
ClassName: 'jpaqiobdzgqicspiie' WindowName: 'plmvqghnyapvsdqflrvkqejj'
ClassName: 'fkipheedjswckfjjnnnwwziknr' WindowName: 'vaqfoedahxxzslrmwziflmenikaltajkf'
ClassName: 'truvunqzlwjifnzdoqzbsroyfv' WindowName: 'tzzaleffwrxiwvzohuzybtbkmjs'
ClassName: 'gttybndtthwnscxiu' WindowName: 'mprnaesrbkltiyllddusdcvicvpgiihdl'
ClassName: 'lopmwunolddsgqzmnvzfonndl' WindowName: 'ddsizeboxorgzbzfejbjaxldmwitskymi'
ClassName: 'ggveestkdnzelrnjaoidnnwmjqw' WindowName: 'rcsagbebmtsfwssh'
ClassName: 'ngelplsdhtsquyfcozrdqgcqkutuygld' WindowName: 'aroboyhopzgrwngxcpjabjrxpeamt'
ClassName: 'nofedxeurjymvspkmcwkoaulavdunakngrz' WindowName: 'seijgbhiilkiggzxqzzzopamvkftjlqenpdiciw'
ClassName: 'jyiuwfuvpfjrowhnwm' WindowName: 'mwmzprkdfuxfamumdfanyzjsixhi'
ClassName: 'gddwsmcnimdpneznooypkraokqxeeplrzcnph' WindowName: 'crdwxqrzqijvubrewmhafpyuewsotgnzasamh'
ClassName: 'qlfnkeuqqnfblmimxsoodaahhvpeembbwr' WindowName: 'daderfvxynrczsdnsbxxyefwyehtnahf'
ClassName: 'wtzziscpcuhiniizeewsd' WindowName: 'kgqiqlyxkcoiiomovadxjjrxaajxnbdlwuynpm'
ClassName: 'alludawgtvufpnqnxjs' WindowName: 'gysbwpkbkfyfooqskqbcaiez'
ClassName: 'bgwjzbqgqtyyobil' WindowName: 'cxekqdavxxllzcfgnklyjmujarabr'
ClassName: 'xazyltrqarkrosagzp' WindowName: 'zidarlyrnqdcoxmbolcgtbcnthljbbsj'
ClassName: 'kzlqqpilrltgqmzftbssmhakqtnvheylhmipgl' WindowName: 'gandwcqmlgygifagculfvcc'
ClassName: 'cwoamqxalatgaqbybvsmbhencv' WindowName: 'fytdolepjyocegpbvcpcgohaaqdwz'