Trojan.StartPage.50533

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\InternetShortcut\shell\open\command] '' = 'rundll32.exe ieframe.dll,OpenURL %l'
[<HKCU>\Software\Classes\http\shell\open\command] '' = '"%ProgramFiles(x86)%\Internet Explorer\IEXPLORE.EXE" -nohome'
[<HKCU>\Software\Classes\https\shell\open\command] '' = '"%ProgramFiles(x86)%\Internet Explorer\IEXPLORE.EXE" -nohome'

Creates the following files on removable media

<Drive name for removable media>:\zuxzt6.exe

Malicious functions

To complicate detection of its presence in the operating system,

modifies the following system settings:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system

Creates the following files

D:\ghost\tx26kjj.exe
%ProgramFiles(x86)%\steam\0javar.ini
%APPDATA%\telegram desktop\czxo6.exe
%APPDATA%\telegram desktop\czxo6.ini
C:\totalcmd\nstj12xc.exe
C:\totalcmd\nstj12xc.ini
%ProgramFiles(x86)%\winamp\uc1u3.exe
%ProgramFiles(x86)%\winamp\uc1u3.ini
%ProgramFiles(x86)%\google\chrome\application\znbc.exe
%ProgramFiles(x86)%\google\chrome\application\znbc.ini
%APPDATA%\icqm\zitumsc.exe
%ProgramFiles(x86)%\google\chrome\application\co0pqi.exe
%APPDATA%\icqm\zitumsc.ini
%APPDATA%\mail.ru\agent\0xdmrc.ini
%ProgramFiles(x86)%\mozilla thunderbird\kpk4cz.exe
%ProgramFiles(x86)%\mozilla thunderbird\kpk4cz.ini
%ProgramFiles(x86)%\qip 2012\bm6kv1c.exe
%ProgramFiles(x86)%\qip 2012\bm6kv1c.ini
%ProgramFiles(x86)%\winamp\k1kbn.exe
%ProgramFiles(x86)%\winamp\k1kbn.ini
%TEMP%\112db4.tmp
%APPDATA%\microsoft\internet explorer\userdata\index.dat
%APPDATA%\microsoft\internet explorer\userdata\e1fkaejn\userdatabidupsid[1].xml
%ProgramFiles(x86)%\qip 2012\odh5klt.ini
%ProgramFiles(x86)%\steam\0javar.exe
%ProgramFiles(x86)%\qip 2012\odh5klt.exe
%ProgramFiles(x86)%\opera\dcuu.ini
%ProgramFiles(x86)%\opera\dcuu.exe
%APPDATA%\microsoft\internet explorer\quick launch\Г¦ГґВ¶ВЇ interent explorer Г¤ВЇГ Г Г¦Г·.lnk
%HOMEPATH%\desktop\acrobat reader dc.lnk
%HOMEPATH%\desktop\google chrome.lnk
%HOMEPATH%\desktop\mirc.lnk
%HOMEPATH%\desktop\mozilla firefox.lnk
%HOMEPATH%\desktop\mozilla thunderbird.lnk
%HOMEPATH%\desktop\opera.lnk
%HOMEPATH%\desktop\steam.lnk
%HOMEPATH%\desktop\winamp.lnk
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\dtl6ak.exe
%APPDATA%\microsoft\internet explorer\userdata\u3w1b20f\oxmlstore[1].xml
%APPDATA%\mail.ru\agent\0xdmrc.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\dtl6ak.ini
%APPDATA%\icqm\tuwvsy.exe
%APPDATA%\icqm\tuwvsy.ini
%APPDATA%\mail.ru\agent\65dnwdd0.exe
%APPDATA%\mail.ru\agent\65dnwdd0.ini
%ProgramFiles(x86)%\mirc\pqas.exe
%ProgramFiles(x86)%\mirc\pqas.ini
%ProgramFiles(x86)%\mozilla firefox\sq9np9p.exe
%ProgramFiles(x86)%\mozilla firefox\sq9np9p.ini
%ProgramFiles(x86)%\mozilla thunderbird\jozdu.exe
%ProgramFiles(x86)%\mozilla thunderbird\jozdu.ini
C:\users\public\desktop\interent explorer.lnk
%ProgramFiles(x86)%\google\chrome\application\co0pqi.ini
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020020120200202\index.dat

Deletes the following files

%TEMP%\112db4.tmp

Network activity

TCP

HTTP GET requests

http://www.ba##u.com/baidu?wo######################################################
http://t1#.#aidu.com/it/u=1788751378,476321524&fm=58
http://t1#.#aidu.com/it/u=3760686831,3163030177&fm=58
http://t1#.#aidu.com/it/u=1443541025,499094636&fm=58
http://s1.##static.com/r/www/cache/static/global/js/all_async_search_395fe1e.js
http://s1.##static.com/r/www/cache/static/plugins/every_cookie_4644b13.js
http://s1.##static.com/r/www/cache/static/home/js/nu_instant_search_baaa58d.js
http://t1#.#aidu.com/it/u=1227352997,2426930988&fm=58
http://t1#.#aidu.com/it/u=693474960,289806734&fm=58
http://s1.##static.com/r/www/cache/static/global/img/quickdelete_33e3eb8.png
http://s1.##static.com/r/www/cache/static/amd_modules/@baidu/search-sug_b3528ce.js
http://www.ba##u.com/nocache/fesplg/s.gif?li###############################################################################################################################
http://se####.baidu.com/wb.gif?ty################################################################################################################################################################...
http://sc####.baidu.com/union.gif?q=#############################################################################################################################################################...
http://www.ba##u.com/cache/fpid/ielib_0108.js
http://www.ba##u.com/undefined
http://www.ba##u.com/cache/aladdin/ui/tabs5/tabs5.js?v=########
http://www.ba##u.com/cache/aladdin/ui/canvas/canvas.js?v=########
http://t1#.#aidu.com/it/u=2504893722,3779554284&fm=58
http://t1#.#aidu.com/it/u=4065302325,1671106037&fm=58
http://t1#.#aidu.com/it/u=1735992584,1858613227&fm=58
http://www.ba##u.com/img/bd_logo1.png
http://m.##idu.com/se/static/font/cicon.eot?t=#############
http://www.ba##u.com/img/baidu_jgylogo3.gif
http://www.ba##u.com/img/baidu_resultlogo@2.png
http://www.ba##u.com/aladdin/img/stockdynamic/arrow.png
http://www.ba##u.com/cache/global/img/aladdinIcon-1.0.gif
http://s1.##static.com/r/www/cache/static/global/img/icons_441e82f.png
http://www.gz###jun.com.cn/_soft_update/startpage/update.txt
http://s1.##static.com/r/www/cache/static/jquery/jquery-1.10.2.min_65682a2.js
http://t1#.#aidu.com/it/u=252366856,456453071&fm=58
http://cd###.baidu-img.cn/timg?wi################################################################################################################################################################...
http://t1#.#aidu.com/it/u=2241125157,1764805695&fm=85&app=52&f=PNG?w=###########################################
http://t9.##idu.com/it/u=761414504,2461299728&fm=74&app=80&f=JPEG&size=f121,140?se###############################################
http://im####.baidu.com/forum/pic/item/aa18972bd40735fa5a4e5ed69f510fb30f240826.jpg
http://t1#.#aidu.com/it/u=1755516740,1661727382&fm=58
http://t1#.#aidu.com/it/u=3041974434,2967904780&fm=58
http://t1#.#aidu.com/it/u=3866575268,1482141620&fm=58
http://www.ba##u.com/search/error.html
http://ec####.baidu.com/ps_fp.htm?pi###########################################################################################################################################################

'ca#######images.cdn.bcebos.com':443

UDP

DNS ASK ba##u.com
DNS ASK gz###jun.com.cn
DNS ASK m.##idu.com
DNS ASK s1.##static.com
DNS ASK b1.##static.com
DNS ASK t1#.#aidu.com
DNS ASK im####.baidu.com
DNS ASK ca#######images.cdn.bcebos.com
DNS ASK t9.##idu.com
DNS ASK cd###.baidu-img.cn
DNS ASK sp####jp.baidu.com
DNS ASK se####.baidu.com
DNS ASK sc####.baidu.com
DNS ASK ec####.baidu.com

Miscellaneous

Searches for the following windows

ClassName: 'Static' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial