KAYAK.EXE – Trojan Banker removal

KAYAK.EXE size: 88848 bytes
KAYAK.EXE hash: 0FB134182627F3A99A2D74B7E022279C

Created files:

C:\Zurna\logs\Hostunuz\UnicodeFile.bin
C:\Zurna\logs\Hostunuz\UnicodeFile_1.bin
C:\Zurna\mirc.exe
C:\Zurna\nHTMLn_2.95.dll
C:\Zurna\remote\dialog\UnicodeFile.bin
C:\Zurna\remote\dll\bars.mdx
C:\Zurna\remote\dll\BASLIK.DLL
C:\Zurna\remote\dll\ctl_gen.mdx
C:\Zurna\remote\dll\dialog.mdx
C:\Zurna\remote\dll\mdx.dll
C:\Zurna\remote\dll\POPUPS.DLL
C:\Zurna\remote\dll\rebar.dll
C:\Zurna\remote\dll\views.mdx
C:\Zurna\remote\resimler\dialog\UnicodeFile.bin
C:\Zurna\remote\save\cinsel.save
C:\Zurna\remote\save\kufur.save
C:\Zurna\remote\save\reklam.save
C:\Zurna\remote\save\telefon.save
C:\Zurna\Resim\UnicodeFile.bin
C:\Zurna\Resim\UnicodeFile_1.bin
C:\Zurna\supersevda.dll
C:\Zurna\system\adon\script1
C:\Zurna\system\adon\script2
C:\Zurna\system\adon\toolbar
C:\Zurna\system\dll\amp_in.dll
C:\Zurna\system\dll\bars.mdx
C:\Zurna\system\dll\BASLIK.DLL
C:\Zurna\system\dll\ctl_gen.mdx
C:\Zurna\system\dll\dialog.mdx
C:\Zurna\system\dll\in_mp3.dll
C:\Zurna\system\dll\mdx.dll
C:\Zurna\system\dll\nHTMLn.dll
C:\Zurna\system\dll\out_wave.dll
C:\Zurna\system\dll\popups.dll
C:\Zurna\system\dll\rebar.dll
C:\Zurna\system\dll\views.mdx
C:\Zurna\system\Emre\awayset.mrc
C:\Zurna\system\Emre\oyunlar.mrc
C:\Zurna\system\Emre\script1.mrc
C:\Zurna\system\Emre\script2.mrc
C:\Zurna\system\Emre\script3.mrc
C:\Zurna\system\Emre\script4.mrc
C:\Zurna\system\Emre\script5.mrc
C:\Zurna\system\Emre\script6.mrc
C:\Zurna\system\Emre\script7.mrc
C:\Zurna\system\Emre\SuperSevda.mrc
C:\Zurna\system\Emre\SuperSevda10.mrc
C:\Zurna\system\Emre\SuperSevda11.mrc
C:\Zurna\system\Emre\SuperSevda12.mrc
C:\Zurna\system\Emre\SuperSevda13.mrc
C:\Zurna\system\Emre\SuperSevda14.mrc
C:\Zurna\system\Emre\SuperSevda15.mrc
C:\Zurna\system\Emre\SuperSevda16.mrc
C:\Zurna\system\Emre\SuperSevda17.mrc
C:\Zurna\system\Emre\SuperSevda18.mrc
C:\Zurna\system\Emre\SuperSevda19.mrc
C:\Zurna\system\Emre\SuperSevda2.mrc
C:\Zurna\system\Emre\SuperSevda20.mrc
C:\Zurna\system\Emre\SuperSevda21.mrc
C:\Zurna\system\Emre\SuperSevda22.mrc
C:\Zurna\system\Emre\SuperSevda23.mrc
C:\Zurna\system\Emre\SuperSevda24.mrc
C:\Zurna\system\Emre\SuperSevda25.mrc
C:\Zurna\system\Emre\SuperSevda26.mrc
C:\Zurna\system\Emre\SuperSevda27.mrc
C:\Zurna\system\Emre\SuperSevda28.mrc
C:\Zurna\system\Emre\SuperSevda29.mrc
C:\Zurna\system\Emre\SuperSevda3.mrc
C:\Zurna\system\Emre\SuperSevda30.mrc
C:\Zurna\system\Emre\SuperSevda31.mrc
C:\Zurna\system\Emre\SuperSevda32.mrc
C:\Zurna\system\Emre\SuperSevda33.mrc
C:\Zurna\system\Emre\SuperSevda34.mrc
C:\Zurna\system\Emre\SuperSevda35.mrc
C:\Zurna\system\Emre\SuperSevda36.mrc
C:\Zurna\system\Emre\SuperSevda37.mrc
C:\Zurna\system\Emre\SuperSevda38.mrc
C:\Zurna\system\Emre\SuperSevda39.mrc
C:\Zurna\system\Emre\SuperSevda4.mrc
C:\Zurna\system\Emre\SuperSevda40.mrc
C:\Zurna\system\Emre\SuperSevda41.mrc
C:\Zurna\system\Emre\SuperSevda42.mrc
C:\Zurna\system\Emre\SuperSevda43.mrc
C:\Zurna\system\Emre\SuperSevda5.mrc
C:\Zurna\system\Emre\SuperSevda6.mrc
C:\Zurna\system\Emre\SuperSevda7.mrc
C:\Zurna\system\Emre\SuperSevda8.mrc
C:\Zurna\system\Emre\SuperSevda9.mrc
C:\Zurna\system\Emre\SuperSevdaNet.mrc
C:\Zurna\system\Emre\Zurna6.5.mrc
C:\Zurna\system\icon\UnicodeFile.bin
C:\Zurna\system\icon\UnicodeFile_1.bin
C:\Zurna\system\icon\UnicodeFile_2.bin
C:\Zurna\system\oyun\ABCD.EXE
C:\Zurna\system\oyun\HANGMAN.EXE
C:\Zurna\system\oyun\JEZZBALL.EXE
C:\Zurna\system\oyun\kayak.exe
C:\Zurna\system\oyun\same.scr
C:\Zurna\system\oyun\slam.exe
C:\Zurna\system\oyun\tavla.exe
C:\Zurna\system\oyun\WEP4UTIL.DLL
C:\Zurna\system\RadioSYS\RadioSYS.mrc

Detected by UnHackMe:

KAYAK.EXE
Default location: C:\ZURNA\SYSTEM\OYUN\KAYAK.EXE

Dropper information:
MD5: 692da354578053e414489b2c7f30c38d
File size: 4192781 bytes