Virus.X97M.LAROUX.F

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Backdoor-Routine.

Diese Malware kann keine Daten stehlen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust eine Kopie von sich selbst in folgende Ordner ein, wobei verschiedene Dateinamen verwendet werden:

• {Excel Application Path}\XLSTART\mypersonnel.xls → if the malware file is not executed in this location.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Datendiebstahl

Diese Malware kann keine Daten stehlen.

Andere Details

Es macht Folgendes:

• It disables the Escape key to prevent users from cancelling the script's execution.
• It checks for the following conditions:
  • If the file is in ".xlsx" format.
  • If the version of the file is Microsoft Office Excel 2007 or newer.
• If one of the conditions is met, it will create a copy of itself with the following filename and version and deletes the original file afterwards:
  • {Malware Path}\{Malware Name}.xls → file version set to Microsoft Excel 97-2003
• It remains active every time Excel is launched, infecting any new workbooks created and previously saved workbooks when they are opened.
• If the first sheet is not named "Kangatang", it copies a sheet named "Kangatang" containing the malicious script to the beginning of the active workbook to ensure infection and propagation.