Trojan.StartPage.59018

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\NSISdl.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\NSISdl.dll
%TEMP%\nsa2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'fsycauepxefcjazusczxwufthsfpw' WindowName: 'tejjawioyllnetqtpjpasadlihxlyxmdc'
ClassName: 'oztyympstddbbhy' WindowName: 'dxugganjwqpycjkf'
ClassName: 'cuyqqorvojxhwkkjrarsrxbpotpmholyktxvyd' WindowName: 'xeyuiwxadetwzykvdktzveqnm'
ClassName: 'razswdrzfirgeamnzjtfrfmqxwfftpyfxbe' WindowName: 'fdgtqobbmkgabobydokpacfrjwrhf'
ClassName: 'otbiugzashenfaiicrgxvxoqywb' WindowName: 'uhlywtxnpoqyoqfgxnminysd'
ClassName: 'hqbasdllwplnsnzuxtkqwhgleluv' WindowName: 'dnbzjovsbtdhudihcqsbilndookzlxvehvg'
ClassName: 'utazrjurrgdfyfanaytjqkxrrqegkwsh' WindowName: 'ymdzhpwvezporewqcziwclii'
ClassName: 'biirzkysbdfkpyh' WindowName: 'awahtnuunuzmigmcufv'
ClassName: 'wlktjnjrqgdmqjbqedodm' WindowName: 'fmjyugvzeipbxejjnpr'
ClassName: 'fxuqiotwhuuvfcxaksxxhraa' WindowName: 'dntarqthylbwrrtlwjsuefimjx'
ClassName: 'ejapswnouvvkkphsljdkibdrooxvcau' WindowName: 'slzhvpjibgddxsaiaweubrotdfbqhhep'
ClassName: 'dwbcxcipbjxplyphlqllddiqueaeg' WindowName: 'hsblrmhvsgazwgjezpunhbyyhbmpasekglyhgiz'
ClassName: 'ocmsgxwvujbswfrdpw' WindowName: 'klwomjioochgjzvnuavuxmwzyovamhzz'
ClassName: 'diyqukqsoykbggvjv' WindowName: 'phsnhfqoolpeeuvgcyuxeaqpcvn'
ClassName: 'imojyvapbopqqhwzzpqqlrmqhgbgwbuitms' WindowName: 'scwwkzcdkiodsneqctlwvtwrmwtgbfcfsu'
ClassName: 'woapkmwvmyfojfwocnxngbrqasfwvyo' WindowName: 'dchkbsqytaojtkfebtaxiyqceoprkcmuprlc'
ClassName: 'qekzazddpnrdztpbnkoyqwzektwtwqdy' WindowName: 'lnqbnppcuswuetohexkx'
ClassName: 'izywjtsoefirzvhtqqeiszbgzcfuqf' WindowName: 'uzlgxcnpizaqdcwmcsjppmlrqko'
ClassName: 'hqgoyyiygbwvpcpionftvkkovnjvuuxeotbexg' WindowName: 'plcnntyvzobphinoumwgrsjobqzlxy'
ClassName: 'nwzivwxvvuomxhbcqhneqwxoexdubhsqwfjpvl' WindowName: 'ficdvgtuqnmalsnyokodl'
ClassName: 'vjzcxwmwovuyhbedufaqxhdrsbcnemenkahgrj' WindowName: 'quieyutyzyscvhzauelvwjxqmmczbftep'
ClassName: 'cgyewfqcifcesbvzzpuexwa' WindowName: 'pglfekhwlcpqulhugadeanqdsbmxnwbqescwq'
ClassName: 'keyancbehmaepsgqxpvbivwamqflwupdchronc' WindowName: 'dxlmjxelyfxtmzymjpb'
ClassName: 'jrzutssgwkqltcnzghhgsmkjznzmcuxb' WindowName: 'awpginaqlfdqfmfimslilrctopzjd'
ClassName: 'tttxytojsiaeturgkwjzvsjpxiexuedf' WindowName: 'mtwpjnfdleyeqepnxwhgigraehpgc'
ClassName: 'osoxayqstsqapwpiwwlb' WindowName: 'npexsorvvnwgfxguvxodejaxfjwwg'
ClassName: 'umhbyoqnfmuabxdxzywyona' WindowName: 'umnlazxnqglycbxqshegsioj'
ClassName: 'blthtijroqobavmnbzyw' WindowName: 'jzlnhxuccgcxnuoiwytbu'
ClassName: 'rlvvhjmgfguxlbijvzdohuukwbov' WindowName: 'tmldatgsfsdkmczbikoliswpiczjiihiwdezzq'
ClassName: 'pssdmvuryziecdw' WindowName: 'jqtjjhakwlxbrorkkaduvvfmxzswejoajgj'
ClassName: 'dcmsigwfsmjhqmte' WindowName: 'asbfalrwuotalyvchxatoxxnxylfykphe'
ClassName: 'onjnwojshlxcqjawbrkcfj' WindowName: 'dvdjztijstpzfxehkqjm'
ClassName: 'mbewdjkwibpvcvwlokxrutfearrna' WindowName: 'mdacfagtrnwcvkpecxhz'
ClassName: 'xxnodiuqvdkjjzotpcoenhxbuojkfwg' WindowName: 'hucpyzfpenuoyvpuhen'
ClassName: 'ftijzwymbkndkmteq' WindowName: 'jfiyamuzbwhbqbmtdzmtyicqzsifstnyhcjculr'
ClassName: 'mgzpsaxhunnhvhkdktkqdpgkhrjojaaqh' WindowName: 'otzeydwucrldmhviiaygwi'
ClassName: 'ygsihrnbczqopexaqeynaweh' WindowName: 'osyifpwxsvbrpqwttirgkh'
ClassName: 'hnvrolvbjjyfrucu' WindowName: 'sicevcyaxiuzopsyzwngpjqnlsomur'
ClassName: 'mxptxlpsmyvnlxapcytdelvql' WindowName: 'mgduzkuwabbeiydptfvustapqrheuccezxlwnj'
ClassName: 'qdpuviqcluwrwnhtfrxierupthhtfutrewvuwfx' WindowName: 'nrualgorsrqmerpvvyduvjoytpqasdgk'
ClassName: 'mktxnllcnyidifo' WindowName: 'goindxgcuxvbqfmfufvcaqiasyhgpcboekrdk'
ClassName: 'slqvsmcnsvjifqpprueflidmmiqjty' WindowName: 'akaituibskortjjvqftwlmxhhrqtpiv'