Trojan.StartPage.59647

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nst2.tmp\NSISdl.dll
%TEMP%\nst2.tmp\Math.dll
%TEMP%\nst2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nst2.tmp\System.dll
%TEMP%\nst2.tmp\NSISdl.dll
%TEMP%\nst2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'yendezbprxdrupxiieuhplhpzd' WindowName: 'hqeanvoppjobmzvbchrsrohvcssesozznocvyel'
ClassName: 'jvbglvnlevmnpfytcbqxshpnjhvieod' WindowName: 'yoqtingchtwiqcsi'
ClassName: 'rvdekurjqmiyxazb' WindowName: 'gwtvnystpllkkkqzjdowmn'
ClassName: 'vauzysfgbhcpncsvjaqzuecuqnuxewn' WindowName: 'ykywzydffdxrxnoeqpoteebmaswxmoxdaaxr'
ClassName: 'zrndgiepnskmhbxokqjlgeleguxt' WindowName: 'lvsgnulwqhmxlctvaioooc'
ClassName: 'rqwdulkekayskgeun' WindowName: 'wcfluniuoutleoctlvkowhhofietlfm'
ClassName: 'jblmnvkszrwpxmuvoxrgqsni' WindowName: 'anuzvtapszvstdsqhxmlycwdtdvdovc'
ClassName: 'qzofdyenrtvmcttxomqlkkykllm' WindowName: 'mbqgjwpveaiicolsvjaqcaflqduw'
ClassName: 'vyngqdlusriqwroymntv' WindowName: 'ibrwptiwyokfwwtdjnxeabyuupvmgvkurcubb'
ClassName: 'duugusjaioedeutmxflsmielrvckpomivm' WindowName: 'recuaezxocqdlvhioqesfizupxxzgq'
ClassName: 'vucvjrtxnqbdpkgypotocjgvagmcsnke' WindowName: 'oggjubffmhfryskwnzib'
ClassName: 'xupnpwhajlaigfwbnpmievewfwfbkf' WindowName: 'lospnxrflfqeuqmng'
ClassName: 'aulzikdifyruqmyqdzybjvpbipji' WindowName: 'zxfuyxfwvamyjckawdnmsjmgjknmwsxblq'
ClassName: 'ebewfxwtzfptkhfcikdqdsiduxsvqoqt' WindowName: 'xwryxwcxwdjdsfzgt'
ClassName: 'dydoliizewsbtvzb' WindowName: 'lbgmryamllvbgymltnmxzykjxtqehdx'
ClassName: 'lyckelqafnnxzdbanobztuizqusrmnfiy' WindowName: 'dxsbwfhirspzqqnyghpvtnrphr'
ClassName: 'gbklxcoayqvgwhdcdogohmzsnkmdmrigaglsyau' WindowName: 'kgbdjpxvvubgilhfqbxrqxiyzprb'
ClassName: 'yblqlwcmydryovcjeawukpjghmbfcoeadgxp' WindowName: 'sbviwobbdefyhprwtqzgkaomrjv'
ClassName: 'ufbfirejnoiankewxnlkieyizwufawgb' WindowName: 'thlktkkqdttoozeaukconupj'
ClassName: 'amzmcphlgeifcqdkroapzxfqvvmdyvibvarz' WindowName: 'alcndqpepiiwqbcbvqngfamx'
ClassName: 'pgojzciehnkpmgwmhjpemevvwhnyjtnycdjdss' WindowName: 'itjimtqbijbijevwmapuglkls'
ClassName: 'cozuxolvdjuxdfijraczfmosvye' WindowName: 'fshiutcmnglhhqvvbx'
ClassName: 'fuhsmmctivegzachhqvpqngcn' WindowName: 'hvqlewseqxamukooagauyiqgtxcthtu'
ClassName: 'fuecexdldqpmidujfxechnyac' WindowName: 'njxaschymunyqtkxfozaafkbncngqgmrhvdwpe'
ClassName: 'lgdetdjhbuzevligqasklihbtodezzuhzmsvg' WindowName: 'vujkfkzmfzbasmdfwjhslrnnhqytyxkbjpo'
ClassName: 'sssyydumsnrbyyupslhvoniwhmpbmzvqkowim' WindowName: 'iifpxutwajzgiomstgaqvefcrfxvnmnwts'
ClassName: 'jovnqekjfprobmssbvdwnhtuzwilfwgowaf' WindowName: 'bqmkfndjlervxhpkueyaq'
ClassName: 'vwandnjvzzqqjmxluupwvjin' WindowName: 'uwuwkrxhdgggktxekozf'
ClassName: 'qbplfaecqcsbztmgsoge' WindowName: 'naccouoroqwskragydwffqtdyixzf'
ClassName: 'mkpzekwjgbrblabrewaxokfvxrknyhexknbf' WindowName: 'ndyoqixcdhgcoqlxewaptymjqvighfnbmzjegwk'
ClassName: 'qfmqfcbggnbiljgciahozybqhkmtr' WindowName: 'xkxgrjfdktjktygnrxtqouebzrtzwjwfartk'
ClassName: 'wjtkpdjtwdlfhtksbxkkj' WindowName: 'lkhrpmtugnjztjkbvautjbahedlczyjbb'
ClassName: 'rfjmqdmtrbnkwnishrzgxznbvhrixbvhvrijb' WindowName: 'rmjafnlyvmzgpcwvyreonhah'
ClassName: 'djjrnbxqbjwicnfaysfrlkolg' WindowName: 'gxjqcaumpbnvmeuvvjojctuvysygbi'
ClassName: 'jseueuvpjshanfhdciezfsgldtmwujvywkdqzx' WindowName: 'lmbptgdmvgndvwzqsjdwozdpfsjufscqykodzr'
ClassName: 'htmlhjhtiwykuvfwgfndqkgv' WindowName: 'pvhazvjydeolmrfgykcfytuqilocdojbcczohkd'
ClassName: 'skosikjeeyzwoqchskpsqgjtafiemnmypcv' WindowName: 'eimwuuaflmitsbgwsjvcnvrnjlmph'
ClassName: 'snccsjlywqlwkkgjedqxvlepdlrhwfrrsnwm' WindowName: 'rbkrgoixpmnwgwsbuokswtfl'
ClassName: 'vlnikwanovumnyfdfuwlxtjuj' WindowName: 'hujsmuqbzycldipmifztzahhpdsqitdpi'
ClassName: 'rqbncydkabgsviq' WindowName: 'ndojyklvxwofzthbwbqedvsrntnkybcdclrkfd'
ClassName: 'nyvisgrlcnsxwdiucdemjesmmdq' WindowName: 'jpyqwcncxwsehgdjlznsjkwgryojenlwhvj'
ClassName: 'gnlncxapdvpdxxauzxrrtfdrtvktzq' WindowName: 'rxqryqfoqetddhkqofgdynpgk'