Trojan.StartPage.59143

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'dwdxcavpudttezudsjyxafouysfmuzznudnpy' WindowName: 'foegbparpnnbdzxivxpyoxcsm'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'hbnazqipnxyzqucmalgxflu' WindowName: 'rzktvnqpjhnxcahzsdpnmvtjesm'
ClassName: 'bxqstqxbtthobdzi' WindowName: 'evcdlzdpzkpzgiukwx'
ClassName: 'wwwknmekhcskathemnf' WindowName: 'cbzviweydcdxavbfkeuyxbbgfrdspwmnaecjo'
ClassName: 'xamnwxacenwhgqmivkircypbxmqb' WindowName: 'zkbkwrdffiuwmqkrtjkbvlhmygkcrobb'
ClassName: 'sfpktlnzakmrrzsetyfkzzfaduz' WindowName: 'jctgdugmexavmrwjgoncox'
ClassName: 'vbwilmxcwvgtcbsx' WindowName: 'otjuxgokikrufubpsxp'
ClassName: 'poblwkjxsewuejraaiyimnrtthwhsoyusm' WindowName: 'jclkoowuobhruldrybbaiyk'
ClassName: 'bekwwklvjyelxzqnmsexg' WindowName: 'lvqotscvioaxrdswobyqvgzlqptbbjbdcjcrip'
ClassName: 'fuigxgrcfuunljpdfurnbmhlpx' WindowName: 'vcecxfedlyhpiigtocbgdedhqdkeyyqzzxk'
ClassName: 'jflmanydrnqiglpqgoudznwbqdtdne' WindowName: 'sznblcheclgzxikcuv'
ClassName: 'qcgrkvemdvwbxlwrgn' WindowName: 'pfgcnqrogtgevcoaa'
ClassName: 'rzshrfoahfreweykuleluxm' WindowName: 'mfeuqeszkunedyam'
ClassName: 'kkeqtuqhpbngxvwhgjckrdewbknmrqidcd' WindowName: 'exyuatzpjrtypiuuowrzl'
ClassName: 'dxmsjihydraajgdlkitqpgkhoqkliz' WindowName: 'gxacyjlnvtsdgnfsulasxpblkhihwofqbb'
ClassName: 'nufdushuytemqunqodivdtg' WindowName: 'swscbfkfzzxoovnwqlgjlv'
ClassName: 'vdrssccojmwshlpkwuglmmv' WindowName: 'djigghmfoftdvhmjabdzonprvrfh'
ClassName: 'tgqypvuxgnpcyglhcudpme' WindowName: 'wpdpipbbyqovwvklrozmuefvhuncmmh'
ClassName: 'ejrqnymwfdshvifplbfojtyumfeamtdevhe' WindowName: 'nsqiuczgbheciwlb'
ClassName: 'iddtghujrykwurrjcedblhgyiusyo' WindowName: 'zscqrospnwlqthvfhspxhivdludljaomkchcmhu'
ClassName: 'ugelxviyiczfaov' WindowName: 'zgirdqcpjienomgcfmbuzbxxwixxdmkhlnrs'
ClassName: 'iqsnnsqaygzinqabqecmhsvjqyhaaolxa' WindowName: 'mqwuyazpicejvthyqihiqygpewhicyol'
ClassName: 'mzrjarmniqdntllnw' WindowName: 'ahdfescedffazwdwbqkrepziixkzsvgotup'
ClassName: 'esnmfeshksskokyy' WindowName: 'ffzgbmoflighydi'
ClassName: 'iavslzzmffxdjlfahbqkjroxpguy' WindowName: 'pxtbbmfgjnprfznozthsrqfswzgsmkorkzsg'
ClassName: 'wpphnqwanbahbhy' WindowName: 'fjbzrwwcdesjbecugr'
ClassName: 'cgrchksxiqwhgnmj' WindowName: 'svwoxncsnlgzklouivydniwchmyv'
ClassName: 'rslffebiofcasukvu' WindowName: 'poqbvggcpdokgdhfvzjibrt'
ClassName: 'xwmldylxopmahnxaitpejgiizhgvnqwyrgshfi' WindowName: 'myefagewmhcggkrofiirl'
ClassName: 'vsjgrremyeolnrpdqnchtcrqtvkgte' WindowName: 'ouwkymswlmnktytwhquzlozeekqppgpwsxuzg'
ClassName: 'urrjczqtabsxtsfnkkjgwkjqhmw' WindowName: 'umdaagsllukxmmhfqgmcljcpfjdzhwjklpskfc'
ClassName: 'ucffmtcohdhrthfsiswr' WindowName: 'ulytghdqqbbfvucnjlnebyvkekzjpssotjezswy'
ClassName: 'vkssageqgghveny' WindowName: 'foxqbqbiqnrmztlbqrmaxzkmtbwmufhfl'
ClassName: 'qxqbebuteufaltvckzyniwgtlmttgliacujgxa' WindowName: 'xaqjvzymtumegvxvchaarboeuridjtwhtgc'
ClassName: 'vkyisnclkqgjfcevpmmytppcyecnjon' WindowName: 'rjvyreepkmrefmoetnnozcluiarmdz'
ClassName: 'izyzoqypsdkdhbccbpjerunkg' WindowName: 'egsfpyskapihubysacelq'
ClassName: 'vkznxcglywgqypueylatzgubtwxn' WindowName: 'gwavldiolowiuplsscthngzctcacygnsemgyvi'
ClassName: 'sgdbjdwzujjehlvh' WindowName: 'ttwlvmxsatcikyjippkenybkwiukpml'
ClassName: 'flvyivrceoctrvthzzflpuapv' WindowName: 'veshjduxhuzcmalywpjktf'
ClassName: 'hagpbifxwkowiwgupbrqmwbtmlabxixn' WindowName: 'yazlsxyqkwfbuhahleeeheo'
ClassName: 'tufpjsauglauydwicnehwbvzez' WindowName: 'dtogvllybuzxebiqqeygscle'
ClassName: 'zzdhizzrcbkljmbwmmvmifph' WindowName: 'jicccjotllugqiwgavkyfrfn'
ClassName: 'mdiuratvtahwtbga' WindowName: 'glcxsmzixqviuwstrndlfw'
ClassName: 'xwjcqweskkssndxtdmumbxuatxofnn' WindowName: 'jlovikfftzslmjnd'
ClassName: 'ioxbcvbyibmarnowprjvb' WindowName: 'dmffdgykfjgdhainjterbtlafkuwrqt'
ClassName: 'acrqhpyiclmxzzr' WindowName: 'mvlfpwfvqtiddur'
ClassName: 'tajkpfycpyxakddeajyaanlmsodqlmtsjy' WindowName: 'kdrllwcqlmkqonpdqjdhpioqmnemoiiuvia'
ClassName: 'rkvryutuwnqeautsvacrdmhlolp' WindowName: 'qcxbsrlggwnxfmrjmonzhnnyw'
ClassName: 'oapmaemapgqoqswlnrztpbszgmgvbt' WindowName: 'cxadjvtgeyzjkqextauardnydpuxhppk'