Trojan.StartPage.56184

Technical Information

Malicious functions:

Creates and executes the following:

'%HOMEPATH%\Desktop\Packed.exe'

Terminates or attempts to terminate

the following user processes:

iexplore.exe

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

<Current directory>\0605黑信\浙江1[250].txt
<Current directory>\0605黑信\浙江2[107].txt
<Current directory>\0605黑信\浙江3[50].txt
<Current directory>\0605黑信\河南7[96].txt
<Current directory>\0605黑信\河南4[296].txt
<Current directory>\0605黑信\河南5[178].txt
<Current directory>\0605黑信\河南6[213].txt
<Current directory>\0605黑信\浙江4[91].txt
<Current directory>\0605黑信\湖北3[168].txt
<Current directory>\0605黑信\湖北4[183].txt
<Current directory>\0605黑信\湖北5[114].txt
<Current directory>\0605黑信\湖北2[201].txt
<Current directory>\0605黑信\浙江6[25].txt
<Current directory>\0605黑信\浙江7[28].txt
<Current directory>\0605黑信\湖北1[344].txt
<Current directory>\0605黑信\江苏8[74].txt
<Current directory>\0605黑信\江西1[477].txt
<Current directory>\0605黑信\江西2[94].txt
<Current directory>\0605黑信\江苏6[77].txt
<Current directory>\0605黑信\江苏3[130].txt
<Current directory>\0605黑信\江苏4[77].txt
<Current directory>\0605黑信\江苏5[188].txt
<Current directory>\0605黑信\江西3[196].txt
<Current directory>\0605黑信\河南1[801].txt
<Current directory>\0605黑信\河南2[582].txt
<Current directory>\0605黑信\河南3[366].txt
<Current directory>\0605黑信\河北5[16].txt
<Current directory>\0605黑信\河北1[383].txt
<Current directory>\0605黑信\河北2[202].txt
<Current directory>\0605黑信\河北4[80].txt
<Current directory>\0605黑信\辽宁1[239].txt
<Current directory>\0605黑信\辽宁2[58].txt
<Current directory>\0605黑信\辽宁3[29].txt
<Current directory>\0605黑信\贵州1[481].txt
<Current directory>\0605黑信\西南1[889].txt
<Current directory>\0605黑信\西南2[278].txt
<Current directory>\0605黑信\西南3[78].txt
<Current directory>\0605黑信\重庆1[375].txt
<Current directory>\0605黑信\黑龙江2[83].txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\loading[1].html
%WINDIR%\Fonts\Guanggaopz.ini
<Current directory>\0605黑信\黑龙江1[324].txt
<Current directory>\0605黑信\重庆2[85].txt
<Current directory>\0605黑信\陕西1[770].txt
<Current directory>\0605黑信\陕西2[167].txt
<Current directory>\0605黑信\湖南2[319].txt
<Current directory>\0605黑信\湖南3[206].txt
<Current directory>\0605黑信\湖南4[160].txt
<Current directory>\0605黑信\湖南1[467].txt
<Current directory>\0605黑信\湖北6[66].txt
<Current directory>\0605黑信\湖北7[36].txt
<Current directory>\0605黑信\湖北8[54].txt
<Current directory>\0605黑信\湖南5[217].txt
<Current directory>\0605黑信\福建3[116].txt
<Current directory>\0605黑信\西北1[383].txt
<Current directory>\0605黑信\西北2[150].txt
<Current directory>\0605黑信\福建2[148].txt
<Current directory>\0605黑信\湖南6[133].txt
<Current directory>\0605黑信\湖南7[254].txt
<Current directory>\0605黑信\福建1[235].txt
<Current directory>\0605黑信\江苏2[167].txt
<Current directory>\0605黑信\华北3[34].txt
<Current directory>\0605黑信\华北4[72].txt
<Current directory>\0605黑信\吉林1[197].txt
<Current directory>\0605黑信\华北2[139].txt
<Current directory>\0605黑信\北京2[96].txt
<Current directory>\0605黑信\北京3[25].txt
<Current directory>\0605黑信\华北1[158].txt
<Current directory>\0605黑信\四川1[477].txt
<Current directory>\0605黑信\四川6[168].txt
<Current directory>\0605黑信\天津1[50].txt
<Current directory>\0605黑信\安徽1[618].txt
<Current directory>\0605黑信\四川5[150].txt
<Current directory>\0605黑信\四川2[264].txt
<Current directory>\0605黑信\四川3[180].txt
<Current directory>\0605黑信\四川4[168].txt
<Current directory>\0605黑信\上海2[96].txt
<Current directory>\0605黑信\上海3[119].txt
<Current directory>\0605黑信\上海4[102].txt
<Current directory>\0605黑信\上海1[250].txt
%HOMEPATH%\Desktop\ТщµґІҐУ°КУµјєЅ.html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\97jianzhan.taobao[1]
%HOMEPATH%\Desktop\Packed.exe
<Current directory>\0605黑信\东北1[210].txt
<Current directory>\0605黑信\云贵1[36].txt
<Current directory>\0605黑信\内蒙古1[53].txt
<Current directory>\0605黑信\北京1[147].txt
<Current directory>\0605黑信\云南1[175].txt
<Current directory>\0605黑信\东北2[153].txt
<Current directory>\0605黑信\东北3[129].txt
<Current directory>\0605黑信\东北4[36].txt
<Current directory>\0605黑信\广东6[116].txt
<Current directory>\0605黑信\广东7[144].txt
<Current directory>\0605黑信\广东8[153].txt
<Current directory>\0605黑信\广东5[152].txt
<Current directory>\0605黑信\广东2[308].txt
<Current directory>\0605黑信\广东3[303].txt
<Current directory>\0605黑信\广东4[169].txt
<Current directory>\0605黑信\广东9[80].txt
<Current directory>\0605黑信\广西5[75].txt
<Current directory>\0605黑信\新疆1[48].txt
<Current directory>\0605黑信\江苏1[261].txt
<Current directory>\0605黑信\广西3[505].txt
<Current directory>\0605黑信\广州1[232].txt
<Current directory>\0605黑信\广西1[782].txt
<Current directory>\0605黑信\广西2[478].txt
<Current directory>\0605黑信\山东3[88].txt
<Current directory>\0605黑信\山东4[34].txt
<Current directory>\0605黑信\山东5[71].txt
<Current directory>\0605黑信\山东2[195].txt
<Current directory>\0605黑信\安徽2[277].txt
<Current directory>\0605黑信\安徽3[142].txt
<Current directory>\0605黑信\山东1[277].txt
<Current directory>\0605黑信\山东6[77].txt
<Current directory>\0605黑信\广东12[73].txt
<Current directory>\0605黑信\广东13[58].txt
<Current directory>\0605黑信\广东1[401].txt
<Current directory>\0605黑信\广东11[87].txt
<Current directory>\0605黑信\山西1[303].txt
<Current directory>\0605黑信\山西2[42].txt
<Current directory>\0605黑信\广东10[45].txt

Deletes the following files:

%HOMEPATH%\Desktop\Packed.exe

Network activity:

Connects to:

'www.97##g.com':80
'97#####han.taobao.com':80
'localhost':1035

TCP:

HTTP GET requests:

www.97##g.com/7298dy/loading.html
97#####han.taobao.com/

UDP:

DNS ASK www.97##g.com
DNS ASK 97#####han.taobao.com

Miscellaneous:

Searches for the following windows:

ClassName: '#32770' WindowName: '????????????????'
ClassName: '(null)' WindowName: 'iexplore.exe'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Internet Explorer_TridentDlgFrame' WindowName: 'Internet Explorer ????????'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial