Trojan NSIS – enumerate_gt.dll – c13bff18c09e9a61bc631fe3865c3189

Trojan NSIS
SHA256: 281d93f4542961b4630b6984f3d0b9e8ed29f6eb2f60674aaf4a36dd0c226f9e
SHA1: 7e3a805d84653a29c1ef135f66b6e6cf9bc70630
MD5: c13bff18c09e9a61bc631fe3865c3189
File size: 459848 bytes

Created files:

%Program Files%\enumerate\gt\enumerate_gt.dll – Trojan NSIS
%Program Files%\enumerate\gt\enumerate_gtu.exe – Trojan NSIS
%Program Files%\enumerate\gt\uninstall.exe – Trojan NSIS

Trojan NSIS created autostart registry keys:

HKLM\Software\Classes\CLSID\{A6DBA346-DB0B-4C41-A016-0B9D119DA78A}\InprocServer32 : %Program Files%\enumerate\gt\enumerate_gt.dll
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Enumerate_gt: “%Program Files%\enumerate\gt\enumerate_gtu.exe” Runcmd