X97M_LAROUX.XE

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any backdoor routine.

It does not have any information-stealing capability.

Arrival Details

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Virus does not have any backdoor routine.

Rootkit Capabilities

This Virus does not have rootkit capabilities.

Information Theft

This Virus does not have any information-stealing capability.

Other Details

This Virus does the following:

• If the user opens an uninfected workbook:
  • It copies the a sheet with malicious VBA code to the uninfected workbook.
• It drops the following malicious file in Excel’s Startup folder to maintain persistence:
  • Filename: %Application Data%\Microsoft\Excel\XLSTART\PLDT.XLS
  • Contents: A workbook containing the malicious macro code
  • Trigger: Dropped when the user activates any sheet
  • Effect: Auto-opens silently whenever Excel launches, enabling further spread

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It does not exploit any vulnerability.