Viral Rewind: Virus.VBS.Chango
Visit my Linktree to access my socials and other channels: https://linktr.ee/mausolfb
-----------------------------------------------------------
. Chango is a Visual Basic Script virus masquerading within an HTML (HyperText Markup Language) file (which makes it more like a trojan) that exploits vulnerabilities with ActiveX controls with Internet Explorer to run malicious VBS code.
The payload: If the version of Internet Explorer runs the ActiveX control upon loading the webpage (or with newer versions the ActiveX control is granted permission to run) then Chango's VBS script writes a new HTML file to the Windows startup directory (which in turn makes a separate webpage load every time Windows is started) and two system files named LOGOS.sys and LOGOW.sys to the Windows directory. It is not entirely clear what the purpose of the two LOGO system files are meant for.
----------------------------
Like the Facebook page: / brian.mausolf
Follow me on Twitter: / mausolfb