Trojan.StartPage.57937

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'alavpdxqnzirzrazkbtcaticq' WindowName: 'lbtpdhfituifbplrrjthynguwzzrcd'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsb2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll
%TEMP%\nsb2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ktixzjdqwspxfptqbtuuyfuloqjaoldqrckk' WindowName: 'hipreutccyguyezcdifjrjix'
ClassName: 'cmsapvuswyndsnwzcnnitxtznrfwgfe' WindowName: 'gfbvtwpdwnqnljhpwunfsxsfh'
ClassName: 'zqebfcstsufsuinevktuicenoondvjsjksocud' WindowName: 'aoqfbadrvbcyyudnctrtrwykfeyzyrv'
ClassName: 'wvjpxjnncimixotbldcfv' WindowName: 'orfrzesfpxmfzescso'
ClassName: 'seeqyumaugetlvdqdvydc' WindowName: 'juestvqtjnahcciswpkagrdtxvqhjnaqawroh'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'eokzpkcrkriulsfmrhpieilmrmqzzdmtuoz' WindowName: 'bmvyweoihiupyirdjwncptwpxxpbfbnhom'
ClassName: 'tbsfbqemdyguanpymzbcshat' WindowName: 'ugnapiebjkqzvlrlpyue'
ClassName: 'egvynufhkiwxacbtqudygfafndqw' WindowName: 'yumcenrwxowzpohjyqgssjchpybavxatwzxfhu'
ClassName: 'tdrixrhoshhxcodcwjncmvir' WindowName: 'epzvlsqdxinyztmggthtj'
ClassName: 'hvvsbeqriissfzfnyfmsewrj' WindowName: 'ggoshkcdsrqzdcuydrgp'
ClassName: 'qjrmmhbccpmzbprngsoubvcvkpgntwp' WindowName: 'nrrhqglrlbdhyxajenstydk'
ClassName: 'gkyortrekpwlcawrdbvius' WindowName: 'xpwamebmqwwdahjaujxhmzxyknjlhsyz'
ClassName: 'wfxjqdozvlayfafx' WindowName: 'xrjiaasouiatqvdxd'
ClassName: 'oaoyuctcexmalzhfwjmrqpaesy' WindowName: 'zgmuqxobccpbedgmyiairqylnajizjl'
ClassName: 'angctgmrlcnwzfezjlcniw' WindowName: 'ytavooptvnsfkdfntiz'
ClassName: 'ybgyyatobabbqkniuszkgkgsgye' WindowName: 'anjxaxbakyqjhjzbvelrut'
ClassName: 'lrhpzrdzufpokuoxmqvf' WindowName: 'kkgsrgafyzqifslvdublmgbiolddozldzrja'
ClassName: 'tkndanjgkzyfvdtftsimvsmpgq' WindowName: 'rhdbsdyueljfwvfnxhjdtpvbbvk'
ClassName: 'mojqdaaeiyjysecduhrvmnbbox' WindowName: 'zeunkgnvlhhcdhhoghtdschkccbbrfiojmijzoz'
ClassName: 'tlawmeqyvvrztuk' WindowName: 'nifopoghtksodfyfvicgddqogijvmjp'
ClassName: 'etaawjkyeshicyfsstwjnnactysorekqas' WindowName: 'bjzffpbnthyksdjulghhgpzmnzcinotqrj'
ClassName: 'lpxfketsddcmoomuvaoijsomdxxibjcwygygoc' WindowName: 'njnvjhsizqrysykqmuknubmkwer'
ClassName: 'swekhpmncnpzglrgkaxxh' WindowName: 'kcygcpqxvkydndxkyi'
ClassName: 'yrzcsdjgvuyxlhlbaqpexkopsysjmjwebehj' WindowName: 'maqvmphscybeuetifpgndzstwa'
ClassName: 'ovaegthkgmsecyogswcsgkpizctemjvnmoer' WindowName: 'eddnkalwmkedjtmnvwr'
ClassName: 'czwsalbzfxoodjfjfhid' WindowName: 'kdqtwpfeelncitinhpoyjsejyew'
ClassName: 'ujrwmfcvmuopzpvcpviuiarl' WindowName: 'cfsrdhfifuzyqdolzenxuszte'
ClassName: 'afnntehgvsfmgopkwnpramie' WindowName: 'ibhshhlxgxolxdhmvyjlbfnahe'
ClassName: 'vevgeziiriavocbehj' WindowName: 'mybvqopovazxbangzikjjnauubicltstucus'
ClassName: 'olbfoncbpcuwuczcwawn' WindowName: 'tptlecdizjqqpawtkhgurxampcfdoljox'
ClassName: 'awtvlqmqjlkctcnstmljimfm' WindowName: 'ghjzoyfanbfxxbfsdburojklgz'
ClassName: 'neptmjwroezqdqabqnfmzuubnfritklc' WindowName: 'tkgkmyubtxpsnqqxrzqjnygwlxrzus'
ClassName: 'pbvejatrmgriuzpt' WindowName: 'ayyxuhpjowcovhdgxgagbdr'
ClassName: 'cjovovhhnjczxetqvh' WindowName: 'uosqqcnytiprzigmnchygshstrbm'
ClassName: 'serhpmadrqhcgapelqdhgwfpftaopzjuztrlrs' WindowName: 'zcyuckoblmxxjwy'
ClassName: 'yxvedfhgsksqemkkozknymdj' WindowName: 'hdnlyryzloalvfypuiemiivrnl'
ClassName: 'jpuxoaaocjooxumtlavt' WindowName: 'gtsinatzfeohvmhrb'
ClassName: 'qlozrpcfudimcsdtccvmuzmwklogcm' WindowName: 'egdheejldixhkqlmwyswejxmlpgrzkejj'
ClassName: 'vvzqmnjlkbohypnpywbaljvlnzicfax' WindowName: 'xmqqvumnoenpexab'
ClassName: 'phuuowpjsatvyjoosseivxqdunshroymhqp' WindowName: 'lxbedcotgpxhhagslque'
ClassName: 'wbtnaxoeuvirulri' WindowName: 'izjodqwlvdkztnlxvcfueazy'
ClassName: 'dxdvwvfnzhtxetewelfwvjmemnglxiyruaijtgc' WindowName: 'gmjexuhjykdhyjvtybhszdregpohd'
ClassName: 'yhfbqyripusjhtrncwijgfouhkldq' WindowName: 'dvrrtrnrvdnyrqxuzjkqy'
ClassName: 'xcusgariiurrvnplnkocyixt' WindowName: 'klsbwnyrgkoszcowewuvgawfjigxll'
ClassName: 'ylktzhxgbkhqonnlctteg' WindowName: 'txrcvfdaxxuzdhckdgvwiprglhkszhg'
ClassName: 'jtjddoudgzegziecutdkvsyygaurwfipkmg' WindowName: 'afeeqhyuzspgmlegtlozbdwrqewytqgrsmp'
ClassName: 'kiuyreqdnhwmhsdgxz' WindowName: 'kijohqokloxeibkuppfisnrtcnxivqem'
ClassName: 'opjcvrcrgktrvtygmffdismrhipornnfu' WindowName: 'begqkeyybvzrdng'
ClassName: 'jgicunvrzkjorkmk' WindowName: 'qwdtkccfhhyfouwpzclhefzfjfk'
ClassName: 'qsjwowhhiusnyiwehfhjbsef' WindowName: 'rfesvvzuqdrbqugexqseolukjawpajonziu'
ClassName: 'gtbjbvhnjderusyxkfzfh' WindowName: 'jrjmveieaygsxcjtbuhkuigrnuscsytr'