Trojan.StartPage.58317

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll
%TEMP%\nsq2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'okymdbeubdgorfuxi' WindowName: 'decqdfcjwxelxbanzjmhrsrcybiqawqfaqtbzi'
ClassName: 'ojmgfdkwdkucaoppieokvlzm' WindowName: 'chccrcmfyxvdyqhspdedoipwbbbjmg'
ClassName: 'ursuwuksgoiyqklyjezckchqlwrfjzdjmjtde' WindowName: 'qhuuedafzqerbrvqfkcqxvbhhptigmgjlmhf'
ClassName: 'dokhbknzipkorzxsjuatrmkrftkyirkidx' WindowName: 'mfxzjylkhujxjhlxartbztejxhtkwjuwmp'
ClassName: 'cpxkepsdslhhfylxmowmjgxcyhhufy' WindowName: 'kyikyruiuyyzcbpcgbyoogtbbcxmlmxkkehrk'
ClassName: 'soxyjhpwhpuqwoevkvcbzn' WindowName: 'xbscgsgklkjqohjcabpshnpyhvpeekaotu'
ClassName: 'zmayqmhmdmvxjiypazpfblti' WindowName: 'glgvllewvsvzitbohrswaofco'
ClassName: 'vshpbkpgoibpuvyqnhocndfjdtzqactv' WindowName: 'qlrdkttvuefjzkkeoymcircjrumctdon'
ClassName: 'creglkprtdqalrbukqdtlxrxuzibvrjgdpqzll' WindowName: 'mbablimspmibjfgdskmb'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ounbmviteqhelughgnsqgtqvnonxuldqmiis' WindowName: 'wrhkexjbavdhcyytfuvrceonhktclipxzwvm'
ClassName: 'lqtnyccgyceldcnzmmwgddxgiolrbhbdcn' WindowName: 'yenpjzdqlogkfviyfhe'
ClassName: 'ltufkiblchiflwiyuk' WindowName: 'vtbsepxizccnsim'
ClassName: 'jaadaghkegrforlpemhhjwwzlduszkacymp' WindowName: 'bnjnsdvvdsuzyppmcqcvfhbydcnwszz'
ClassName: 'kyfadvdamscpilh' WindowName: 'hkmtkldgukcackbmfblthcqgfebpdyyzlhwlv'
ClassName: 'tbwafcyzjnsiwowdaqvrrb' WindowName: 'syshrqpqkblncqpjdplcxbnblgaetbwcntim'
ClassName: 'vbeqqaiehnytosblvpxcpnvv' WindowName: 'dryeeprxhenuzceggqruttsmisc'
ClassName: 'plchvvvkngmrtire' WindowName: 'ijcgphtmpghagtqcbjolqaj'
ClassName: 'ckrzzrtffyxzinjwelcenqtrx' WindowName: 'intcusukgnkfygwpxgkgqnbovcxzxnqsjae'
ClassName: 'ahqfpplyrbbnkqrkegaxbpa' WindowName: 'dukvsxyfaqtticujmwkrbybyxcx'
ClassName: 'wyxavwojhpdumikeiicbdaxhgefliccaetnrl' WindowName: 'rppukhwjzjiejigv'
ClassName: 'psfqcobwfeobtwuwv' WindowName: 'rqteylqfodzsalwgtbymdosinwhytdninmxye'
ClassName: 'ziziqxyyapsvlprsbplgazn' WindowName: 'xbwmolixaekxphwgn'
ClassName: 'lbluztrhblocflwmkdwzfprbzz' WindowName: 'cskmgxnstqpgzaiqvhtlknjecqqp'
ClassName: 'dgcvzoykoaakzbkteuizxqtjsgcah' WindowName: 'jsckdfexdtsecgmmiwhzjmnbdvsrxrah'
ClassName: 'umxejtcolamgjxdkwyydaoohbqllieetyaafjz' WindowName: 'prqtgxbmciurzsoixvrnfqxqaju'
ClassName: 'stwjjwkislroicnseffpuwtss' WindowName: 'syxhxoxpifjfcnrmwliemdqbsvndwxgc'
ClassName: 'yoyimaoahjdlmkwibmgcnexixyrvyblcbyuh' WindowName: 'qiberwgvuwlyxsst'
ClassName: 'rqcwnnppuosvpttwveidfasspnoturl' WindowName: 'nltpxqiywxcgskavwp'
ClassName: 'ymdqrwizxfcewqdbjdckluhxauywuqm' WindowName: 'ltioxlsqubybqwzmajyqffm'
ClassName: 'nlefnjevksjrocxzyxhgoduvawoyogrwvnvm' WindowName: 'dvqcxyziavgspnezembbjhq'
ClassName: 'whfmiuynajdvsfatn' WindowName: 'madegrqwhzorgkfvfibsfagqlvqkunwhfzlboj'
ClassName: 'fvwavmfqdohdbgfhge' WindowName: 'ymdhzlfxjqcraufmwqddrknrcipmzwcwneowz'
ClassName: 'tfjsxoiwvhnnyudutujdykuinmmasgvgwu' WindowName: 'spmmokwcxfwhqsqcb'
ClassName: 'remegzuogahjyqfieargkjjcb' WindowName: 'wwzpxcgphuucbhsqcxj'
ClassName: 'mspwpiriyjkxmuvoa' WindowName: 'qetlfiyihxlltuomrgjrxduguw'
ClassName: 'prpztodptikveieycewuhkidqaeothhpy' WindowName: 'dbzmllxllmldnzmbwxltpisjxlbijbgj'
ClassName: 'mhytzrmfbvevganymkzmleznl' WindowName: 'ckmsvtlqrybarjngutcghdqondqnltety'
ClassName: 'solwcidjonysrnef' WindowName: 'kualtkkolkiwfqquutgaqmknwfigopjm'
ClassName: 'screiyvtmqifmvmjb' WindowName: 'nwcssepfwvsfwxbafojavgvaigabqblgrcomp'
ClassName: 'nwhdjcnmhfdtijtwzgihgszhmjxoyjqlorvl' WindowName: 'sdosabnagfrfbnizgixcggxbgv'
ClassName: 'etzdjwtfbfclvgeexhhmbvueqbzphvrhwz' WindowName: 'qmdjxmbzariddkezfmaokexrksktlxnwu'
ClassName: 'hlnzuswxztcefvjretxbgbopaozouusylhhh' WindowName: 'fhntbxorkyecdnkblotybhitnaqcvbrymr'
ClassName: 'rngpsncddmtaspssecz' WindowName: 'ntvpsipjgsuydkzepvfoedtudcplhxzltx'