Trojan.StartPage.59640

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsh2.tmp\NSISdl.dll
%TEMP%\nsh2.tmp\Math.dll
%TEMP%\nsh2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\NSISdl.dll
%TEMP%\nsh2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'lxgrmbnnsttsafyorangca' WindowName: 'hyriacumbladliifwsozuxvownyeuzybihooe'
ClassName: 'cqazkgjbaugixszxolcrblnstqiir' WindowName: 'gxpclmeohcdwdzhtkjmthkxpxkcf'
ClassName: 'dundtxqfpuzepegfw' WindowName: 'gsnyzpyveqcxhzjxdsi'
ClassName: 'bgbarpukrtwlxzyprejcdflcpeyredk' WindowName: 'qljzkknqkpcpnqtvifbw'
ClassName: 'mutaroulteirqvwwfjxhnsvoycqo' WindowName: 'ymxyxqkkhllspazvjhdvhasqbinmvcdrhf'
ClassName: 'sozlgdstkjicpocp' WindowName: 'apnioujsddbgeykbvvjm'
ClassName: 'zonfzrcydlpbvqtwqcqv' WindowName: 'zryiymkrcqidkqhbcnxzjycvwlgjkuvttn'
ClassName: 'euapniiuhyefgbmtyymnbyszkqp' WindowName: 'ramayzmvyrctgnyurievzepd'
ClassName: 'hdhdyelzaivvhvulevsmihuuxdvqyufz' WindowName: 'chgvnrhjeamaperromymyfowdglwsuqbdyrcvkk'
ClassName: 'vpayldyzxuquqmf' WindowName: 'lubzmstuefzmrmkbhzwgzpwhnd'
ClassName: 'gtwrypjyatezzegv' WindowName: 'mhleoqfritzqytcvufbkixcqoivjuiwpsescfk'
ClassName: 'rvnkjhclkmafemcrujyjad' WindowName: 'sesesfsnzhkczrudgehs'
ClassName: 'tixvwexgadbyghwfajzrlmovhoifk' WindowName: 'kjbpifxfvehntvgxfkcxztq'
ClassName: 'wlvpyfwfxiufvsyxpgycaqsomzyrzetyxr' WindowName: 'hjjtmdmkvrwsjshaxydizkwvuridrwpnli'
ClassName: 'mhqgvicogwpynyzeklmiozniitr' WindowName: 'qdqdkuusuvrtbezgncigd'
ClassName: 'uabvtqvbrsnurcnwyibnqonbbpcvuu' WindowName: 'tyrrxbalztfiuwumbvqaesheyqy'
ClassName: 'roenwfnelymxcbjtuvruljrodfputp' WindowName: 'akwtjiwbhqgypbjpgmfnfn'
ClassName: 'oxeunkeqqcvkspjseicbtjeuaslnptfjbqq' WindowName: 'cumtnuhrglrnanxeprewhv'
ClassName: 'fzkwgevaeoeafrgpudzxijrcgy' WindowName: 'zlomvthxeyqkdlehnxhlqjj'
ClassName: 'yjqfdcrahxdhnalosrzdngjd' WindowName: 'rridluuzjwrbbvuobnluzuncchtijolcxynlsi'
ClassName: 'vyrgmkgevbgdyeolkgmrzxtcxpfbdbiteo' WindowName: 'swmzwjgvrulqrdznwmqgojfpd'
ClassName: 'aniejnxmsdojntxhsjyrwavgyhsgwrtdiailwza' WindowName: 'mocxwdpysaawwdhivcq'
ClassName: 'vweqkjxdiqswjgglgexj' WindowName: 'bcwipsahnbqpkwnvmbdmaekr'
ClassName: 'hzpsklnhanbeglqqt' WindowName: 'xanrgkhsmqzkqbhhyelhxzeihc'
ClassName: 'azwxtkcrybmvmovtxxsjap' WindowName: 'mjnoxtqqlohhrhukjqaukqmcquqezizpubhs'
ClassName: 'donfxdjckjuwpyrtvdw' WindowName: 'sfpaajfesvysyncuiijkhjlqchbaolfjezt'
ClassName: 'ylcopowdeoqkzwszdvqnaxeqxranyiwqnqyrf' WindowName: 'zyrafvgxjpymbftsgvaadsgkgdsvardh'
ClassName: 'daemhcznqdxfgitncyaylsalmclchkqfgjwutf' WindowName: 'nxmcpnklgkgdvdzplngixjwlipl'
ClassName: 'ekzhvwmsnuxaqwvttszbrzappasdgcothz' WindowName: 'fcahxbttaylvnmmavzhwpjdtagzojzxkwkr'
ClassName: 'ihbxvbnsfzuchwmv' WindowName: 'tpfkqbohlvhosiaduipdcykrujhdebj'
ClassName: 'lgnymhlkkwiscfbmkuoqhs' WindowName: 'rtiojervwctpemsmfhwfkqldmzdho'
ClassName: 'mfkpeiiwcansklulymowfbkfhssyiurf' WindowName: 'hpwplfnefyncsvqsuxbxsa'
ClassName: 'ilqzlugzumfkanlvsnaqbffwawotpayxrcb' WindowName: 'hfhnoiornoemjrrzmjpyne'
ClassName: 'blnmgfsdszidxzzqtvxeproylbsrgnbegk' WindowName: 'kftoryrlfqxszfvoxvjdwxc'
ClassName: 'vbmdxfeztijrskzqjftah' WindowName: 'mpvhbkykqojuhuydumjclpuak'
ClassName: 'dpohfqyupntfarclhhjkmipkfeaolqpbpd' WindowName: 'poucjvmjehbtsbregbdo'
ClassName: 'zuvlfgttxavkyrcxlteiofuj' WindowName: 'aungshugvkdtidikadti'
ClassName: 'gtfeviakjzwnekqphcwhvbxptvez' WindowName: 'xtcefczooksavbruytbo'
ClassName: 'grkifhvfbkxaarq' WindowName: 'jxzgfxejndylwcprfjel'
ClassName: 'egmygsnpsqmaxubpyykonrpdaeotmde' WindowName: 'nfcqmezwjymmswutsurmrdsdfcpijqoavp'
ClassName: 'zwuhbmnyxougncamvpdzbagablrcuvudw' WindowName: 'gmyhpasybnnpwnmrrstkrgynns'
ClassName: 'ambkpntemtpcmujsflzcllhthxfskx' WindowName: 'zaigusmukuttksmvehnlgskgbqdx'
ClassName: 'rhkhkylwbnxfdusllkqutpgexijgopfmw' WindowName: 'zsldfppejknwttuzjn'
ClassName: 'ilvgvytflhbzyieuj' WindowName: 'luddcbzyrpqijhfkhyml'
ClassName: 'xllussstnfapclyezgxqgrewlrhjzldtjv' WindowName: 'wdwwjadlzypdbxwiyxssmahimvegy'
ClassName: 'bqukglvhjhaqnjvqmdspqoee' WindowName: 'cpuacbmblphckyjuqfkyxxzgqfv'