Trojan.StartPage.59376

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsb2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll
%TEMP%\nsb2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'vdotgoouiwxfewuetydgbpojyf' WindowName: 'boewwdlcqrxgjzcz'
ClassName: 'krtshdafbkapnymxlwdsbzlcjptiltygbm' WindowName: 'voojqhvgjyqomhtkgtbu'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'pijuhkanxvlhbmrbs' WindowName: 'teagepkcwygejxotmj'
ClassName: 'mibcamxtxftobeevwarttrduc' WindowName: 'insgvriqvnysehjdlhmy'
ClassName: 'aousfsuugtiddtqxjyplksohtxepyyxqmfgb' WindowName: 'iztgdiznnndwhxabvvfmjzypqp'
ClassName: 'wysaqulukjdsfbb' WindowName: 'qstekwaptkunrqavcbtuwwecrbukuyztva'
ClassName: 'ybqearxrxmcpwyuwwbmrpvwujjgzergjemzoih' WindowName: 'xqbczuwwfumbnbytctibvredxankqhtnsycjex'
ClassName: 'jdpoctciivilpsadisgnbkswnwn' WindowName: 'rajnpsbkwugebuptqwf'
ClassName: 'kwcmplfacvgyhgotstcxmnkxcfhknivtsgfayi' WindowName: 'txrmgypqkhxkvxpczqiadkzpqunhpkwgeko'
ClassName: 'lpbegepxnkhhjstgztjkofwqahz' WindowName: 'thegulacazlfmkwzrmfxzvasi'
ClassName: 'uyoibpvowzzggdkzmrzvxyxoczxbajwxifs' WindowName: 'nvhkdcmncinonaqltlkqadyaixudbzkuuqfsg'
ClassName: 'iifuyvxcymneobsswndqboeycnpllxixculfwyh' WindowName: 'qoleqjjwhflljdcduyvhracylyfoyarvvopa'
ClassName: 'dqebbbcxovnmdhzbgwqpdxvbheajqx' WindowName: 'mtljveitxaojprbfooomxqddvspdfnk'
ClassName: 'hblzydgcdgpivmmlnthnemepqvyzbskc' WindowName: 'jokzvddaiecfcgnhttcyxvnoqyuxxod'
ClassName: 'mcvrsiganqbydpnogjlgqaydzgfifeabopclg' WindowName: 'xwjyjkmbqdujsnzxzclkplafglloyjknwciie'
ClassName: 'dpxmxatlhdmyozgujonpadloybgpxu' WindowName: 'eybnspoticlqtrwdfzwsbckpanxr'
ClassName: 'clglcbgucbwyeinmlqdtdpiulspierfriufrct' WindowName: 'nfjwyibfhvqfcrlqjspmyrpx'
ClassName: 'czlvfqspmicquuqumoxq' WindowName: 'fxbjjpejmgcykrtultgy'
ClassName: 'cyvdkadqesaedsebigungjixhwb' WindowName: 'hkyzxfoxalfgzaoounbqhvrddbmsxzzzyxbqoj'
ClassName: 'htbagubuqmngpaxaeyxa' WindowName: 'fzyamyxkywygiayczevpek'
ClassName: 'lujxukdwwaldnfhqyanffotjjfgl' WindowName: 'gqofusacjijigmygqxrgywyqkuyoehcasf'
ClassName: 'hugoaipvuzjiryedyzgkfq' WindowName: 'psirtxxrebbyfejy'
ClassName: 'hvhfkhluepetyvsysyvceyzsxtznkkvvthxqzeh' WindowName: 'ubhcrsekbvfrngstv'
ClassName: 'uipfmytlmlxaymyxgcpazwfukcvznzkaefcgj' WindowName: 'pqepmbpfdkjuutjedfxkjg'
ClassName: 'knqnylgfeojkchhhq' WindowName: 'yrjihumnnjagklcpxamxzybkhjpwqzgqei'
ClassName: 'xmpwtilkkvzewkypsjh' WindowName: 'xebdhbauwlkvzqfdqpqfuyqdd'
ClassName: 'gzfxthfczcddbutchpmfs' WindowName: 'tlseqdwonceezzbxxbpzkexpqlpssclcbtoxnlm'
ClassName: 'pnugglihoahbpyfeafunh' WindowName: 'rojvertxexpbjlic'
ClassName: 'tzchtxmciygguxdnxycjiptdyigllmsbjazxeb' WindowName: 'xrqjtjiaesafhbewkzdjpcxzbsm'
ClassName: 'xukllhhxlmepkkamxgltdytpxabzgeow' WindowName: 'pyetyjmmbnknxryudxifevnqdeswltrlyxn'
ClassName: 'genvpwjkoppphbsxhxrqzjgeqy' WindowName: 'hbobztytfzvncgbnwezqcgzasodcvlg'
ClassName: 'rslctitypulntpecqgswxyznzby' WindowName: 'inpleyuymxfnhnvsmkbflouvbujadwjwwm'
ClassName: 'sjbrrrczrydrkboktnub' WindowName: 'cbxsyhpbzbqxomsovumchnx'
ClassName: 'wfvvfwxajfqmuvhxovdarsszysgmsoilzy' WindowName: 'vwawatutgxpcnuageaogjewona'
ClassName: 'fuzufhpkrbkowqhfrnldva' WindowName: 'blictkpblnruvxecyz'
ClassName: 'zkjqdikaabhqhglyjurlsdaxnzjungm' WindowName: 'zxwpqqhkfvlsioueszllifabcombn'
ClassName: 'lgfqqqempkyavbmgzfzwwohlkaaixbeyq' WindowName: 'uggtkldpijttkloowhmjghjbhngdzvncjt'
ClassName: 'zbrxzsskzkirmqhxinjbamenia' WindowName: 'ydrmypjlqukalljxnucaveazfahdajcr'
ClassName: 'dcyqhilkcefaeepombiqyczbswmoyfxiztz' WindowName: 'ankuqlxrjzbomlbrxbyejiun'
ClassName: 'rvosyisnobhxzjlkpdmwgskpeha' WindowName: 'xprlszlsdsvezwtwvbwpugdmzrgeeiqpupp'
ClassName: 'gphjdkvqdonstkcn' WindowName: 'mvviopgbsfrvbwrawg'
ClassName: 'oapvfmmurnuhmngyj' WindowName: 'reoupkuqprxntaophditupbkqpnnyznkaeycfu'
ClassName: 'gprgvtkoatikrxetfywftqeoyitwmmynqeizacp' WindowName: 'boeveqthliybmiziecgcrsosmmiamslgt'
ClassName: 'lbjtfrbyhsyoshisrwlgcskuhbdbf' WindowName: 'udrlnwtxlgarqeinmljvk'
ClassName: 'twfimghacaxnayrenvnwtcvqjttwwnzihla' WindowName: 'zgvztkndcveaalecbb'