Trojan.StartPage.58241

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\NSISdl.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\NSISdl.dll
%TEMP%\nsa2.tmp\Math.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'pnccetvprshgndlwojiyj' WindowName: 'gjxzfbgwxyswglzozvjfsklumu'
ClassName: 'qlljobiddfnjqwxscwrtyramjzapdo' WindowName: 'yrloeilbthfikxs'
ClassName: 'teqoqfhmsdkvgtry' WindowName: 'zkkbvtnvnuotyfjjfujxxxepjuzlejbgo'
ClassName: 'niaatrfcbtjkboftjtcmmpx' WindowName: 'ycsjpdpmuoykbkgtjpionlonzpzos'
ClassName: 'mjvszlongnzmneemykbksn' WindowName: 'qfmrmvwyfkgkfhlcgpphgecodsmi'
ClassName: 'zaxtpebujwbgdqbwaoceg' WindowName: 'bvnucwzzqmusipbddqb'
ClassName: 'iwdnjunkzeejqylzel' WindowName: 'amumkydsaphzzgeesyhudtetilr'
ClassName: 'nebdjckalwechmutlowvwehhadzpwpjdpju' WindowName: 'faeuztttkqrxmydbvdlkqf'
ClassName: 'vydugmtaxmzqdfyfpumfgyrcqseqqfk' WindowName: 'ccreejnsxbpiuhs'
ClassName: 'xzqejjgpzrrwodbkafwbpiy' WindowName: 'guobohqtpfkkfmjnjrpqdmiqhznvulbubgtjzb'
ClassName: 'tihejzezatuuyjivxu' WindowName: 'vcwbfxcxlvrdjiepgtigxuyipxywfl'
ClassName: 'bvgihycusjtsggpcjujbiumbiboxyeyrfzt' WindowName: 'lkhiuhjylwiwsdalzyniimhoqhcevqkielvi'
ClassName: 'dspcwabkermrucioxvpszpywyvbrcamsybj' WindowName: 'mumckpzgjdaaywoewjmbimt'
ClassName: 'azrvkotyaglvepmcfplvznsl' WindowName: 'urhumaakuxpzkfpjorrhxkulnxktxtskxpliw'
ClassName: 'otpnyoepqskmpqiwtbspvpvjsyiehmgzqjcm' WindowName: 'spjclzphlcczeqxno'
ClassName: 'tklqryndblpiuxqyrio' WindowName: 'hrtryprljrmenuspptbatlrmbblkshv'
ClassName: 'xvjvxgqaswdoygunyjvb' WindowName: 'ysovbsijwtwxqotswnazrpafbwsmulg'
ClassName: 'xgewpcdpfbzotubdkygxjwsaprjptqtssotolab' WindowName: 'jifmpstctfludubialoyhoqxcbsuyqjidyu'
ClassName: 'ulriugvfahmoigqwqsn' WindowName: 'lpamuqculoezciasezsbwn'
ClassName: 'tussqdtxxlqjzpsibivhksglwnvvixlpv' WindowName: 'qraguonzlgstmwmwzlzqxm'
ClassName: 'yrgyiohmbezudbvzigyilwdks' WindowName: 'peyutochdilxtqq'
ClassName: 'vfbayseuedkwlygzsfvnb' WindowName: 'kfaklnmcdhyonratqkfaljelpadx'
ClassName: 'eheoasdqmhxqyitpuukxyckvyddj' WindowName: 'nplskbhriaaevvcvliewgpgyuiidbiysqyquf'
ClassName: 'qhuhsnqdhudubdmbujlrxpxec' WindowName: 'qoincjhzgyaanhzlttyerxtbotkxzkbsdh'
ClassName: 'dedvqknyootwlecbwjwklsq' WindowName: 'diboyiozcwtjdmwdhmgizsikjwluhvwg'
ClassName: 'lcshvpaemwtzgqgswklcguywjhbpvj' WindowName: 'umgrivjizsjdvnbimyetcnti'
ClassName: 'ediibsvmwacdacivpjrzpb' WindowName: 'lplhatchpdsnmizhtfptkgjtcqepgec'
ClassName: 'lqsvjdyyhlxmrfurstlolifnppzmcrxyd' WindowName: 'fnkcswwspvyzijkafywhulyqwvtve'
ClassName: 'oqwnexyzjkigitmoskkabqbusuvepmbepofaxne' WindowName: 'xfylmupzilvrayjnfkxgsbnsfanurevyb'
ClassName: 'uezpmmrbnmjmmkmuqduvg' WindowName: 'asmkauvxxifgydlbhktbmtpbgeqhczlyd'
ClassName: 'lralypfphlwqhqqbdvftayebw' WindowName: 'frldpdppthkgiqulgeysgptgmxksphwn'
ClassName: 'qneqoqvzcdlnzlpreus' WindowName: 'dxpfmrocvovedytersyuodxis'
ClassName: 'ufiocfhuiqypmjltxkqpqokxaaxndhaluxywzy' WindowName: 'spwnxqmauqjnxjrchymayl'
ClassName: 'gwrauaocbbukcmawlfwdnqcvnnuosgxvpzpyyqi' WindowName: 'fqocldnguvofetrojounlpfetwwhuudwb'
ClassName: 'vqmvuvcmodzsnohhsmrhdovqxyhto' WindowName: 'civznmjhallkreshgheoqx'
ClassName: 'zvwffaqooolvemvikrzemiqrwfncvzavefnaw' WindowName: 'seimnqgvhnxsoldfsuqzuntswixcjntnwrqkq'
ClassName: 'prwcutszxfjhaaiismdjnjunuhiscucfpnheh' WindowName: 'ijmmtjgkkszratqchp'
ClassName: 'sahauhvyracfnqxaxpqiopibwxzueudl' WindowName: 'iugckvrjiovkbfpqygfesgnurdzrwlrf'
ClassName: 'lbgjiiegxirbmgbghtlzogmqeqvtmdnqup' WindowName: 'leeoobqfvpjnwmbmdirpbfrkgclwaovyqzyq'
ClassName: 'ljiggxpmoygczkekqxvrhqcqlgdkommffmgygd' WindowName: 'djjgdduilrivcdpbhiftiforedalva'
ClassName: 'rewvmvyopsnebbslcwmpwjmeenkmgwlcapyd' WindowName: 'ekwwxgjavqrnzkhm'
ClassName: 'gswsfsqcrjvfjavyiqkzvdguwxjurgivwmh' WindowName: 'rlpaipqxsvttcrnlsnggjdtziowagevowidxod'
ClassName: 'trxdlicklodsgfraezjv' WindowName: 'tsungjqzafxvmckawexwwznl'
ClassName: 'mqthfqglsckunemvqmxnvepykcolbsptm' WindowName: 'iwanxrsenprevfvqhwoxubmqisbjzjc'
ClassName: 'jibqefxxtxbbdwrjmoaoimmdfivigzvgvz' WindowName: 'zloerseeaysccjbwtmapcbhopkbawczfmmm'
ClassName: 'dugfbnqngekzwmsefsayjxsqlyjmra' WindowName: 'yqmmikselheqdajjcrf'
ClassName: 'vrrotrkvxoyrxbwcjrzrkxt' WindowName: 'yvdnlkhykrhdtluactmkoalkidatgtaq'
ClassName: 'qpcfuhytohnvhmzomk' WindowName: 'vcsbbdntoisswjtwkfvgvtndide'