Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\AUTORUN.INF
- <Drive name for removable media>:\msdll.exe
Malicious functions:
Executes the following:
- <SYSTEM32>\reg.exe add "HKCR\Directory\shell\LEOPEN" /ve /d Ouvrir /F
- <SYSTEM32>\reg.exe add "HKCR\Directory\shell\LEOPEN\command" /ve /d "%WINDIR%\ms1rep0.exe ""%1""" /F
- <SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\Directory\shell" /ve /d LEOPEN /F
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run" /v msdll /t reg_sz /d "%WINDIR%\ms1dll0.exe" /f
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run" /v mssky /t reg_sz /d "www.dz####.sitew.com" /f
Modifies file system :
Creates the following files:
- %WINDIR%\ms1rep0.exe
- C:\msdll.exe
- C:\AUTORUN.INF
- %WINDIR%\ms1dll0.exe
- <LS_APPDATA>\MS1REP0.OK
- <LS_APPDATA>\AUTORUN.OK
- %TEMP%\a40787.bat
Sets the 'hidden' attribute to the following files:
- %TEMP%\a40787.bat
Deletes the following files:
- <LS_APPDATA>\AUTORUN.OK
- <LS_APPDATA>\MS1REP0.OK
- %TEMP%\a40787.bat
