Trojan.StartPage.57857

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'ogkydmdrgvvsvhvfafocvsrilavptfpktztsurm' WindowName: 'gunojfemyjtrtwuificjpzutgymzpmj'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsi2.tmp\NSISdl.dll
%TEMP%\nsi2.tmp\Math.dll
%TEMP%\nsi2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\NSISdl.dll
%TEMP%\nsi2.tmp\Math.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'judprajontsacqripwvinwqefrjc' WindowName: 'ihjjzfywhmmmylsjmauyntdyiavprngadufzz'
ClassName: 'soimzjpeohbxwdlcghqkngqxvtbuudaafr' WindowName: 'toezlzgdyfiqzdjstauvwncekk'
ClassName: 'gztdtwryxkkycygmc' WindowName: 'xxdtytjgfjfmvlgocwqcufgmj'
ClassName: 'gylascscckdnudrfexfpkrs' WindowName: 'lgiwxjiuhntnchtkotplgldphokjpqji'
ClassName: 'otahstsqnesjncmenmg' WindowName: 'ywzdmxbfypwmpjafwcstnq'
ClassName: 'hbssvrnvislruleystvplvt' WindowName: 'pjpoctwskhezppimjkhpjxuoiqmmtan'
ClassName: 'forvrtbqbofqmyqaoz' WindowName: 'fswihwrkivkzbvuluinbvgdrekxntrwrs'
ClassName: 'yqqmihtgpetiobhpwfoxcjqt' WindowName: 'qutgmnreruprgcemcdtbauczwssffvoodkavj'
ClassName: 'nnwewpzmooogghrcdg' WindowName: 'modjqfrmpuqfsadnrbvkiny'
ClassName: 'equwpewoejqdlaetkhorxuxam' WindowName: 'ofjcscygwoahvkoiazfr'
ClassName: 'exxqsmfztkunsofitrlefjcpyzgrm' WindowName: 'bemxjbxrdxbswixxtbfljktmvjckvmirwbnsusm'
ClassName: 'nxtzrkamstvubwpckwnblukiqmkkwvwjdxwt' WindowName: 'uihcjvhtybgtnbgwurkbyfofayon'
ClassName: 'bkmfvaiovwuyipyadoepnplvjaofylarykfwrtc' WindowName: 'wfgbbvomnzsdqdwa'
ClassName: 'vqvyujyjkdflsgjununvl' WindowName: 'ugsedkczaokhadsyejalpdlgmsheitkhtb'
ClassName: 'qhfmnpvbwibgakeykovq' WindowName: 'nzxjvthuwwxdxdmfschyiiknyshwnkmxdtypeii'
ClassName: 'udlrqlpxqsztpsdk' WindowName: 'blvehcbwfimahykuyhebvfymthnmcldkl'
ClassName: 'markuguyzrmgdfxncaotvntamcskdpsfxxqnmi' WindowName: 'kjucmdsjzjhwguqkjvvji'
ClassName: 'pwhjbefbefntdqssdmicgbqybmojcltncfl' WindowName: 'ajuzzlbakmhtuijrectzfdsoenkkgpxlygxqq'
ClassName: 'xsqraoudesdhuoadzivahpqg' WindowName: 'ytoqgmfolyrvtjcntqvfnvusldsfodbnyvop'
ClassName: 'lzwfsfqzkcxnugjimzfiwxnrfp' WindowName: 'hjzwgxlyaoatsnznms'
ClassName: 'dlsskwrrammyrlubdiksfofnxcqqujazlkqyd' WindowName: 'tdwfyrcohqhnnafaaprpb'
ClassName: 'vjexrwqazdvuqnafchgfutfjauqciwrlsvehk' WindowName: 'hsptlprapzrsrqdlktqv'
ClassName: 'pjgcbfsqfnghjrynmmzzfmjcr' WindowName: 'xxjspwnhqmssjhdjtqfuoxwggjjgwbrpyn'
ClassName: 'thczgpnljgwdqewkliwjd' WindowName: 'xrguljwcxrqnsdqstecvci'
ClassName: 'nvjegzzlpkhihpuwevigkmrxjaewzlchlkl' WindowName: 'zpdpdffplyhqkijgnqotswixcglazvnqzjfedmd'
ClassName: 'xlsadxprszmrgqjvhavtwyzzupwemgzspihi' WindowName: 'rfdzyqvizcrmuuqswkrlsuszzdganem'
ClassName: 'tlvacaqccouxviyihktmgzceugcsn' WindowName: 'qlfkafqwnulommvomjzxjsld'
ClassName: 'zaxdbewhugcpwrppcovxupruxig' WindowName: 'ayauowzhenizedzxbflqxsh'
ClassName: 'lnanarslbvorvmtf' WindowName: 'ztpcverucxedxuphic'
ClassName: 'loedihnreczcsqwpsm' WindowName: 'pdfzsztfvhqgddqlmghncnpi'
ClassName: 'dywglxippxacrdepeqvoupvnfgpckt' WindowName: 'uzyhmqjwfzkfusvubmtnbrysvshmrkhdl'
ClassName: 'ihzoizkrquvtrqmg' WindowName: 'lrnowlioxdnigvznju'
ClassName: 'ilxnmabxpeukizmlmoqsvkhqa' WindowName: 'rqghmiwrwzabjojkug'
ClassName: 'smxoowkwqribtafdlhwdobxgn' WindowName: 'lfftvlfcfrytdrwuqhmdlirmimimmtgbvu'
ClassName: 'ijkaljuemssqumpjsphhmfhtslystrvlbmulfx' WindowName: 'xsqugarodiumvcphuxan'
ClassName: 'ceobkurgwzmqanuhdycbvjljpvccclifhyudws' WindowName: 'jilacnotqerzhaenhkbxuvnhfz'
ClassName: 'tryiqlbxojfcemwixsjqchnooqomntpehpkrpg' WindowName: 'pvdykpezhfokajghhhrnwdceo'
ClassName: 'tjytpxqionoiobkp' WindowName: 'epynufuajaddoblsgkfyyjz'
ClassName: 'nztmzlwsbnhdqjhkephznzahbymljotmungpfxh' WindowName: 'npxupoewwzslddykguflsgbb'
ClassName: 'payooviymreoursoqhoupqkajozfty' WindowName: 'avbehltwhswxdionswqtutrkdpmsngxxpcfvenr'