Virus.X97M.LAROUX.F

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de puerta trasera.

Este malware no tiene ninguna capacidad para robar información.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Este malware infiltra una copia de sí mismo en las carpetas siguientes con diferentes nombres de archivo:

• {Excel Application Path}\XLSTART\mypersonnel.xls → if the malware file is not executed in this location.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Robo de información

Este malware no tiene ninguna capacidad para robar información.

Otros detalles

Hace lo siguiente:

• It disables the Escape key to prevent users from cancelling the script's execution.
• It checks for the following conditions:
  • If the file is in ".xlsx" format.
  • If the version of the file is Microsoft Office Excel 2007 or newer.
• If one of the conditions is met, it will create a copy of itself with the following filename and version and deletes the original file afterwards:
  • {Malware Path}\{Malware Name}.xls → file version set to Microsoft Excel 97-2003
• It remains active every time Excel is launched, infecting any new workbooks created and previously saved workbooks when they are opened.
• If the first sheet is not named "Kangatang", it copies a sheet named "Kangatang" containing the malicious script to the beginning of the active workbook to ensure infection and propagation.