NIRCMD.EF – Unclassified Malware removal

NIRCMD.EF size: 29696 bytes
NIRCMD.EF hash: B8CB05CFCE09E64C715175E7D59367E2

Created files:

C:\EF\AVTest.vbs
C:\EF\crc32.ef
C:\EF\DeviceHFile.vbs
C:\EF\download.exe
C:\EF\DUMPHIVE.ef
C:\EF\EConfickerRemover.ef
C:\EF\ERDNT.E_E
C:\EF\ERDNTDOS.LOC
C:\EF\ERDNTWIN.LOC
C:\EF\ERUNT.ef
C:\EF\ERUNT.LOC
C:\EF\fdsv.ef
C:\EF\FILEVER.ef
C:\EF\getdisk.vbs
C:\EF\getfilesdate.vbs
C:\EF\GetUSBDisk.vbs
C:\EF\grep.ef
C:\EF\ListDisk.vbs
C:\EF\lnk.vbs
C:\EF\main.hta
C:\EF\md5deep.ef
C:\EF\moveex.ef
C:\EF\mshta.exe
C:\EF\mtee.ef
C:\EF\NirCmd.ef
C:\EF\NirCmdC.ef
C:\EF\NULL31132
C:\EF\NULL8110
C:\EF\option.hta
C:\EF\pv.ef
C:\EF\reg.ef
C:\EF\restore.vbs
C:\EF\script.hta
C:\EF\sed.ef
C:\EF\services.vbs
C:\EF\SETPATH2.vbs
C:\EF\streams.ef
C:\EF\TW\main.hta
C:\EF\TW\Option.hta
C:\EF\TW\script.hta
C:\EF\vfind.ef
C:\EF\WU.vbs

Detected by UnHackMe:

NIRCMD.EF
Default location: C:\EF\NIRCMD.EF

Dropper information:
MD5: 976ecd785cbcee98da2a940f8e176748
File size: 954433 bytes