Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,%LOCALAPPDATA%\linuxdapp.exe,'
Modifies file system
Creates the following files
- nul
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 36 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,%LOCALAPPDATA%\linuxdapp.exe,"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 36
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,%LOCALAPPDATA%\linuxdapp.exe,"
