Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'rundll' = '"%APPDATA%\rundll.exe "'
Modifies file system
Creates the following files
- %APPDATA%\ntldr.dll
- <Current directory>\syscheck.bat
- %APPDATA%\rundll.exe
Miscellaneous
Creates and executes the following
- '%APPDATA%\rundll.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\syscheck.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\syscheck.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V rundll /D "\"%APPDATA%\rundll.exe \"" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V rundll /D "\"%APPDATA%\rundll.exe \"" /f
