the malware has XERATUTA string, https://github.com/wouters-frederik/help_me_clear_this_up/bl...

google reveals several posts about this one