Backdoor:W32/Maha.E allows the attacker to acquire system information and allows for the uploading, downloading, and running of files on the infected computer.
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
Backdoor:W32/Maha.E can record keyboard activities, keep a list of applications that a user has run, as well as archive URLs that a user opened. It steals logon IDs, passwords, PINs, check words, and other info related to online banking. Backdoor:W32/Maha.E arrives on the system as an embedded executable file inside an attached RTF file from spammed email messages.
The spammed emails appear to come from the U.S. Internal Revenue Service (IRS). The attachment contains a file named "COMPLAINT.rtf".When this RTF file is opened, it will display a fraudulent message that the original document was not loaded and will prompt the user to double click on the embedded object to reload msword.exe. Below is the sample message:
The embedded object is actually an executable file and when the user double-clicks, it will automatically execute the backdoor file. The RTF file is now detected as Trojan:W97M/Streedom.E.Once Backdoor:W32/Maha.E is executed, it will create the following files:
It also creates the following temporary files that will deleted by the malware after use:
This backdoor installs itself as a service using the name "svchost32" by creating the following registry entry:
It also modifies the following registry entries in order to disable the firewall and its notifications:
Backdoor:W32/Maha.E connects to the following site and awaits for commands from a remote user:
Upon successful connection, the following commands maybe executed:
This backdoor also has key logging functions. It saves stolen information in the following file:
It uses the following format:
In order to maximize the amount of typed information from the victim's machine, this backdoor disables password save features. It sets the following registry entries so that the user will be forced to type user information and passwords: Disable Save Password and Autologon for Yahoo:
Disable Auto Complete in Internet Explorer:
Disable Storage of Credentials and .NET passwords:
This malware may also steal online information upon visiting sites mostly related to Banking and Online Payments:
It then sends log files containing stolen information to the following sites: