Trojan.StartPage.58336

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsn2.tmp\NSISdl.dll
%TEMP%\nsn2.tmp\Math.dll
%TEMP%\nsn2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\NSISdl.dll
%TEMP%\nsn2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'vcompnxmgornxryedt' WindowName: 'xxjzegfvqmgswbtlfdmizhxddxdybctxu'
ClassName: 'hsyjtoviooxbwtywdgsrp' WindowName: 'pnznszsqkqjbbpgdjbcxdz'
ClassName: 'scvgsgpxfpwklxbgiqqbyrztppbyvw' WindowName: 'yigwfkyygivbsatpjocrwmwzhos'
ClassName: 'vnihhwzcirxfbrkiystpdyjpvdrjowblhilrf' WindowName: 'muqdnegewtkuxcrscrwoqheyzzv'
ClassName: 'fudtfqoweluyxprkgal' WindowName: 'fkefjbowyijzqtfkplpwbchggpoyvosgc'
ClassName: 'kjlslguzwfyaspklqakjfwehnfkpsds' WindowName: 'pwkcwutrizrfxiazqzfmgxuzfyecycqkmjkm'
ClassName: 'nxwnjjtpihqfwlh' WindowName: 'djqckhvcjvrseuhkonrohudpgdsgnn'
ClassName: 'vsobxjhhccuvygkosgb' WindowName: 'swjffbpehkwpdorbnx'
ClassName: 'remfmyjmemuzlztvezqicelnucksdktvnotkol' WindowName: 'znzckgapihxajglmkqklptqoftirydbqpyafbl'
ClassName: 'jevdpbnwewryyaf' WindowName: 'rxcxerrwetzqbkcmymktyasa'
ClassName: 'edxtaaploldcpdexifruybmvwpramvstks' WindowName: 'jbmzbgidiuzvwfzmervjreevchp'
ClassName: 'dqjbdzobjatzvpcboqxnxrlfmelysdkihyzn' WindowName: 'zsveoqlcuzetscwsyuf'
ClassName: 'uzuxbuptdysksdo' WindowName: 'cjsdfvdjhavevjqnoq'
ClassName: 'utwfcayxxsgfkfzizrve' WindowName: 'zeeyophhdsxtsdqjotwlbv'
ClassName: 'swakunveuehzkuviu' WindowName: 'lwshziaxyzcxyzyvumtsbthneoq'
ClassName: 'eziqyfczrgtazhnprxqbjyosuykiwywahgnr' WindowName: 'bevtflmcokgkagalqnbhizumzbckxfxg'
ClassName: 'zglslzaoejmjzosczgmnbrdrziyca' WindowName: 'ciqacvfntpwakuywdnppjywkzwwzu'
ClassName: 'uqakawiefqcjpzzjnjnd' WindowName: 'ygivceyphrqpcnlvazonjksledrzedathmokt'
ClassName: 'tsapwiyngyuiyahkyd' WindowName: 'izewgzehpetblhtffhrhmpkntsltjgljb'
ClassName: 'toxlmbavlgxprcjc' WindowName: 'nqcqlcgrdkmidqebqzd'
ClassName: 'rsssnbicyztymstsolujytln' WindowName: 'lhtrrbwgzzkmvchlytkfqccvw'
ClassName: 'mgfmdsjutndmiodagzcnendkyh' WindowName: 'tvzcaaahgnrcpnqlcbxhbnxsya'
ClassName: 'mntmqnztsckbuiiiexuvmxavguz' WindowName: 'svbelylntzqvigwqsdlnsogpyvmv'
ClassName: 'djsvnvzzurowifsktowarna' WindowName: 'yfjnudrxvivwgoaodgmgsgwitjsrkatytrqsy'
ClassName: 'vvdiexgcgfaaiguqbuholkmtpihtqww' WindowName: 'wdzqmobrahydkihvuvcjoshkbkws'
ClassName: 'zlxbhlyilntjxzkocakyubmjxxxcxzfgjgw' WindowName: 'nhpmyhakfuhkynkcw'
ClassName: 'lmrsvbnrjtwaalhxvbgkeefihxpgwdbasy' WindowName: 'lqfrpubdgsyekyucwuctzfvftrhfeahqxlvsxri'
ClassName: 'qydbcvtduomximqtmh' WindowName: 'oeidbemjvequdavyeudjsllryohcw'
ClassName: 'mpvgzoyuskcsgjhtcglcsspd' WindowName: 'xbyheizmhwqxqepiellnwgmsksbrheaycdowyl'
ClassName: 'tmdryhsahzpxwknjrdiozfbicgztyzhzxtsvqih' WindowName: 'zrymcoadaefifqxszs'
ClassName: 'wsxdequeynaallbpmtctkyulihwqrrva' WindowName: 'edvecogymfkpfdpysqrpgfknhydnkgqjnoioxir'
ClassName: 'bbfjlbtplsgwmapizsashcepznlqoeby' WindowName: 'kfskdnneemeidouzwnrnfqcqbhatzuldmmx'
ClassName: 'ubmegbzosdyvrozncsdhrhly' WindowName: 'xeqotmmghgzbclxrwjp'
ClassName: 'bncidcennzwzdtgocttwqt' WindowName: 'gpsoqepxnjomxtugpllionbies'
ClassName: 'hszmgxbqmzkqohjketkhwjdjbcatafldwtkfco' WindowName: 'qhftcmaylzeemqmgrawolpqgr'
ClassName: 'inuxisulwzuvtlkdf' WindowName: 'ifyremktwuvkngcnvvjqiwtqjfwhlexvipridek'
ClassName: 'smsriwoeeumlujfkxonevfrizbqc' WindowName: 'vbpxurbkfadruttfpcxanccf'
ClassName: 'rzweemmlxjztvyac' WindowName: 'ougivvyedwbaysnzznkwuvyllmr'
ClassName: 'kcnrtkmlstkxnlvjuferudqlrdzib' WindowName: 'cthcgtneqnuejuqxztheogsnmdodmuhla'
ClassName: 'kwdxgnzgsnoqlgkqsxxxtbzzszvtdaywtop' WindowName: 'vercphmygqiwopwtjbyk'
ClassName: 'qlpgmjggrmnjxrzcqgdkonsvlfmshdaisrr' WindowName: 'ktdecajkifwshewuh'