Virus.X97M.SLACKER.L

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Backdoor-Routine.

Diese Malware kann keine Daten stehlen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Datendiebstahl

Diese Malware kann keine Daten stehlen.

Andere Details

Es macht Folgendes:

• If the user opens an uninfected workbook or switches to another workbook (whose ThisWorkbook code doesn't start with 'OOO):
  • It injects the full malicious VBA code into the target workbook’s ThisWorkbook module.
  • The infection propagates to every uninfected workbook the user opens next.
• It drops the following malicious file in Excel’s Startup folder to maintain persistence:
  • Filename: %Application Data%\Microsoft\Excel\XLSTART\book1
  • Contents: A workbook containing the malicious macro code
  • Trigger: Dropped when the user switches away from an infected workbook
  • Effect: Auto-opens silently whenever Excel launches, enabling further spread
• It creates the following hidden backup of each infected workbook:
  • C:\TMP\{Original Filename}.xlsm
• On opening, if the infected workbook contains a "Controls" sheet:
  • It activates that sheet and scrolls to the "DashboardScenario" named range (if it exists).
  • If not, it defaults to the first visible worksheet.

(Hinweis: %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)