Trojan.StartPage.57946

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'tvgxwghgildsavpbcxkikyyxmhzsidsdebxro' WindowName: 'dxvhcphxqakthpfnquwbrrluzjridqxn'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\NSISdl.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\NSISdl.dll
%TEMP%\nsr2.tmp\Math.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'fqcnztpycloiqxaipmqdxnfudx' WindowName: 'ddtisisuycnqjpmybqmryhudevtwwg'
ClassName: 'aiixajzlxneylvdstorfqkpscuz' WindowName: 'spittfxezmmtzfqvmogm'
ClassName: 'ffbisatnylkejllfgnolwmlclc' WindowName: 'akdidkcuawcfaane'
ClassName: 'elolodteqlehtlpxdjzybttcsfcmhhdkorja' WindowName: 'diugpiufoobalsjeegsnxhzyj'
ClassName: 'xkxjxwziybuzsmggwbfi' WindowName: 'dkrvdjbmpzzyvvdhlsmyysyrnjozarnltmsgqyf'
ClassName: 'mvsvkzhknpcnclhfiwjxvgqwvqzcbpuktlzsm' WindowName: 'fkzyefiimwcmpmcjmiisenqyicojzbnxdha'
ClassName: 'cnicvsouplsfkorrkturoxnqseeflkctbzb' WindowName: 'ozfarhlewmrpzwuroopicfmbjavpixtlkcipai'
ClassName: 'xajmtpukkdlxdegeye' WindowName: 'ciobwdqvxmspqgewxpi'
ClassName: 'pshnlmzarajnutejcrfszceehrdpesltt' WindowName: 'kpgxsvcuanvfrzdphkxivwvy'
ClassName: 'scauvgcywxjtuicojfbnnpg' WindowName: 'etpikpskeyhacarvvlrmq'
ClassName: 'tmucakirvlwgttjmmpl' WindowName: 'bxwbfygelzjogzqerrchrznu'
ClassName: 'gqrjpzruskqkddvhrpjgrwc' WindowName: 'loalkmtgybrnleyx'
ClassName: 'qvznihamnocoemechsyefaupcselzlmfgphs' WindowName: 'rmjapmgmxxkcfvddwijbz'
ClassName: 'vhcyxebpfqrndxndlwqisv' WindowName: 'shjxyirtyavmmmvhzwuit'
ClassName: 'kfcbexjnjhsoyiulpd' WindowName: 'tpwzilqelfqsojclnhpyjdhbjir'
ClassName: 'xxfaseoztjatxqoqtgmf' WindowName: 'fhwxchowppywlohufhkjfmsny'
ClassName: 'emkvadmqhlwsarrjzqsltmoyqegkgrjxvlyz' WindowName: 'gopufcmphftyzwitiuoefnbcr'
ClassName: 'wgnflajwfjutdgfhenhpugkapbpvguykcxfn' WindowName: 'uxodmxbytwskgvxbqyealykcbijexghrmjjiq'
ClassName: 'efmifjqmufttfbllkkkpwdwcrqwfavoslg' WindowName: 'sjepjaprpcvwjesyvzltwlmdfey'
ClassName: 'edwubmcxtfdrgglxomqzvmxswwkur' WindowName: 'fwwxedpvfsafbmhlbadyoaxxlycznt'
ClassName: 'kiqguzfdpcvjbhkfwhpktw' WindowName: 'ohhdegohiohwbaqukdxqfdvsbdcmp'
ClassName: 'ensoeuzmrpfkuvmdmdmqil' WindowName: 'baznftjrhjsnjzqpuheneeqsjxsli'
ClassName: 'khxipaaquvnhpttpwroddmdzmvbzxms' WindowName: 'ytatoetrmdjvjmfmcooedjbsrgfao'
ClassName: 'wpyueasdaxkvahviutzchsrbukdhhqrycw' WindowName: 'aqatqucxkdavxpzklyvjtzosl'
ClassName: 'cktculnnvrhyxfaemswkarjerryzusnp' WindowName: 'iolphujuujjpqtkdgmszlpczugithzokfuwhym'
ClassName: 'aakrzqeatwqimzphmvrgtolxdypfygrylhgwmin' WindowName: 'rjkhjhvvzdrdtbvbrw'
ClassName: 'ibrnlsqibofhexhymtlnaudtsujjh' WindowName: 'gmdvvckmivjnsdhtcqodgrgp'
ClassName: 'lyuvobekpohhpcjodiugdksczaameqgr' WindowName: 'umpsxfsunzhtdrkwvuxgb'
ClassName: 'alvxiolrbhzxodxdseq' WindowName: 'patykrdfsweyposbvwgiugbirb'
ClassName: 'drysmdpyyvkzycliwanh' WindowName: 'vgvvysuppqeiyzrfvajewrmoaxrfzpjjpylm'
ClassName: 'potuyauowllqgdeyghwqrzodaz' WindowName: 'qcotamhrjmrwwdcrxvtivabelmyofffnxpi'
ClassName: 'pubpbcmvrhwvzbw' WindowName: 'vgwwjatkfdzgmmpxitpclnlytrrienhpglys'
ClassName: 'cgudsgbhuyuyqrtbcjjudpckyp' WindowName: 'nhwlowphtkfkryaee'
ClassName: 'mppfxufejknamnlect' WindowName: 'vhirzlefpxsmceszpxfewqjijxcproltggagkb'
ClassName: 'cmvunziuzfnnmmssoiycldyoi' WindowName: 'auqnxtahmxxydtekbqaijtvk'
ClassName: 'notbyqdqsigebioajqdpq' WindowName: 'fgttrergltysvtlldmdppehj'
ClassName: 'wkfvoqbbyczahixbaskkkalmkyrncnajqea' WindowName: 'agkyksjorwuppertscyjpguymwd'
ClassName: 'hurfzbcjkepsygxva' WindowName: 'teqiituwcatfuvfkiwjbqb'
ClassName: 'ennzczjkaxsagfdudntvfnkansmi' WindowName: 'vbgnduztgqrgslnakqlgxb'
ClassName: 'jbrbfmvfaxxzdtkgdnxuytx' WindowName: 'kyeghwmboxtlgqgeserxpcbcwpczd'
ClassName: 'earncnkoygghsehp' WindowName: 'qsimafjywqxvxbhgitsmyrfqoklulxgcmzwhv'