Virus.X97M.SLACKER.L

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any backdoor routine.

It does not have any information-stealing capability.

Arrival Details

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Virus does not have any backdoor routine.

Rootkit Capabilities

This Virus does not have rootkit capabilities.

Information Theft

This Virus does not have any information-stealing capability.

Other Details

This Virus does the following:

• If the user opens an uninfected workbook or switches to another workbook (whose ThisWorkbook code doesn't start with 'OOO):
  • It injects the full malicious VBA code into the target workbook’s ThisWorkbook module.
  • The infection propagates to every uninfected workbook the user opens next.
• It drops the following malicious file in Excel’s Startup folder to maintain persistence:
  • Filename: %Application Data%\Microsoft\Excel\XLSTART\book1
  • Contents: A workbook containing the malicious macro code
  • Trigger: Dropped when the user switches away from an infected workbook
  • Effect: Auto-opens silently whenever Excel launches, enabling further spread
• It creates the following hidden backup of each infected workbook:
  • C:\TMP\{Original Filename}.xlsm
• On opening, if the infected workbook contains a "Controls" sheet:
  • It activates that sheet and scrolls to the "DashboardScenario" named range (if it exists).
  • If not, it defaults to the first visible worksheet.

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

NOTES:

It does not exploit any vulnerability.