Trojan.StartPage.59011

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsz2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsz2.tmp\Math.dll
%TEMP%\nsz2.tmp\System.dll
<SYSTEM32>\PerfStringBackup.TMP
%TEMP%\nsz2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'vwayhfcdmmkdnvdydjcmyespcwqq' WindowName: 'xquhgqekxrbcyyaeruzebaduoqklghsdswngv'
ClassName: 'stgwavvlshbfcyz' WindowName: 'isxjyhjkaytrxuymxtcplcwti'
ClassName: 'uhnbbslhgytvzxhezfdm' WindowName: 'aevpvnbugnteikdptukbkfdmtvjmgsoy'
ClassName: 'soyeujeltchntwisfxnowyw' WindowName: 'mpvcnnqvzjzrnwjgiuuekb'
ClassName: 'ikutvzdmxdspihctvderfgjstvdqrfmd' WindowName: 'djmskyiqbwjhpfnfgbwtewjvmmkgfqzf'
ClassName: 'sxsyaxqoeqcnpvwucrj' WindowName: 'jmmlxywldsihxqdpwzbtpja'
ClassName: 'kqbykfsjbqngyutbwbsouzsucgfvojivqcrh' WindowName: 'pzwrfjvcjjdocoapqxcuyih'
ClassName: 'sgcmmknwdepkkqramizegvexdbdfnebn' WindowName: 'opcwakiaeumdaudnyzwtdnlyeaqkuhnvkyaacg'
ClassName: 'zrelwgxqjwntefmkdqujkmlln' WindowName: 'yodwtthpjmhkaoiy'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'hdleuciosgzgxbfcwxssjwdadkwxf' WindowName: 'afbcdgihjgnksssegfebcuzdzojf'
ClassName: 'xsyuyoalurmraaitp' WindowName: 'ajgoadlufcdszpkqeapiwyfggcynun'
ClassName: 'vhavnomlarmvqbnpolytudcpttsh' WindowName: 'zauakijlailuikyjubelkkane'
ClassName: 'gxmiwahddsrehuwomoerop' WindowName: 'zdztjullgynpeloihslpfwkbeex'
ClassName: 'kbdcqtqbsqgqilfqtxifcjqyglfduq' WindowName: 'hrbmxeyljblagefcmbtfbtoq'
ClassName: 'nwyonyehnpokrggyidyypuwioyqxyokz' WindowName: 'whgnyfuqocqsblsdi'
ClassName: 'xurpapjglepmrkzfjqykwawcfpaqslrhy' WindowName: 'ynmfhfkhrwkaayvvcdwefahchkktkspunlzb'
ClassName: 'pvvucvsgichknvbbbemgzdcawdwtejhzb' WindowName: 'tdhoiwxnzprgsemmhkmrxodcawrowxusvq'
ClassName: 'jmmntobonnzszmxbwlztasdis' WindowName: 'vzasuoqcvgzqslsyaucymycctjbiaxxpdieahb'
ClassName: 'pwzpsovsnywieobvdstjbsfbqgtwwun' WindowName: 'smqmyzeekmpcmggaknejwwjfilyom'
ClassName: 'xhgspwmqqmsasplqxapbqtutcpijuxxlb' WindowName: 'zryrhzmopuighmwyvhebimmhbp'
ClassName: 'zsdolowqykbpbaqfdbspmzlcvysxl' WindowName: 'iuogklnqgrrhlvqyfqsjmnngnkyjafsln'
ClassName: 'fljhdvaopvyjqkvoapydigtayhh' WindowName: 'npgldjzjdfxxlywrczjcuxuyxbiftflmi'
ClassName: 'qbzovxplnzcqpnheojano' WindowName: 'imlqofstsfbvwplcbbwjypjvumdqylbgxzx'
ClassName: 'vapuebrhnyjvsunezm' WindowName: 'hcrowsxuvkqrvrjvfsmf'
ClassName: 'abnrefhrjuihrqanfzcmjaxkpmmllcgov' WindowName: 'ygmrpdnfjutgdrjmneywfwtae'
ClassName: 'ggdcgipzbtoyldtqzjtrcti' WindowName: 'xcazufvmxnhysekgsbom'
ClassName: 'lqoxmqfcqgcebffuyoovlehtnmdkzlqpqcruruw' WindowName: 'ituatieplqhlouzqrey'
ClassName: 'fjyaxdlqoqzzpmradfrhzeuaytyajvyqt' WindowName: 'fikzcxaixylhauysxesacbrgbbrzuxgl'
ClassName: 'cddhlarcuyjhkmjbputzfbjncmwovopldouj' WindowName: 'opwwehgwnvyqobzvmskhweeusrn'
ClassName: 'iksbnjgogrlbeezeywboibpxzmen' WindowName: 'dklchgcenqrpgiqjfbhhxaepbtwkmpwnuhtefqq'
ClassName: 'xqeckiwricxtllatog' WindowName: 'xbfacozgwddgczdpt'
ClassName: 'phdtkufukmxgtbbsvgbookznjllpnsads' WindowName: 'vxlhsmclwmkcobaabv'
ClassName: 'qqjuzuqhdpqefbvnicidoz' WindowName: 'tlnfwpcbfbriucqhcqhnzirmxqrge'
ClassName: 'pkttbrsziulbynxntrmnwrhrrryzxalnsd' WindowName: 'hnrqoktmmlkmtfqmssyhjfscoekgxsc'
ClassName: 'itgsawaisiwaozknzqhr' WindowName: 'fepjtoilwjblpuhrczbsxzcboeenztjbsg'
ClassName: 'hikbwzjdqfdvdjpldaganbkrfao' WindowName: 'uwqzfpvyzguomkabbptwrcsuzlprpuxh'
ClassName: 'dtatizdjdccfouedc' WindowName: 'eoohgiptpzaqrkpky'
ClassName: 'kxidrahblwrkrcuvhbgcbav' WindowName: 'rsrrywnacscvrmrjedmquu'
ClassName: 'kemizbxtmqvseuoxvvvxmrnpxbpfl' WindowName: 'ffvdftawmnlbzzfpqrbdvmanlzczmktvaypwl'
ClassName: 'yfwbryhqvwwbbuovdtinpozkqzg' WindowName: 'hmzctspjoogwofeabzr'
ClassName: 'ycxhhnzmtuqstcoquqfgkbjhbqhfmcggg' WindowName: 'vlnnmtgprubpymwqosywxcrpkzrjtspmwlzl'
ClassName: 'juzdkwibrypiroaabhigmetvwivhmn' WindowName: 'euqukbnemvkxzgpbanvebxd'
ClassName: 'cuqemjfykmgaxfldbmscm' WindowName: 'vuuophugbrfopfgbhuzboiigevrk'
ClassName: 'evjcvvxeuugucwhqdknssyvchfamsyicipfjp' WindowName: 'eaaujkguuxdjizfxvaptwmyxklaflq'
ClassName: 'zgouwpwyswoeqaylpryavhgwkycddga' WindowName: 'nbwetzskhakuplbqgkllkgesxvqzrjlutfled'
ClassName: 'sxhaqhunvqioqzoivcdoilwwnixzayrdwrzmyrb' WindowName: 'gsagbgniqmcanrrmrvdmphpcxnfzhn'
ClassName: 'ruqcvhjhyiywrtdoargbyjfh' WindowName: 'dovkoqpcefokalteczqt'
ClassName: 'ocsukgejiyaeavsapzsqgwithcmtotzkr' WindowName: 'veyyyakrunirynysvidgzoyckajegefk'