Fandom

Malware Wiki

Chango

1,319pages on
this wiki
Add New Page
Comments0 Share

Virus.VBS.Chango or Chango is a virus that made using Visual Basic Script (VBS).

BehaviorEdit

Chango is a Visual Basic Script trojan that has been spammed as "Men & Women.html".

Part of the code is encrypted and decrypts on the fly. If a user open this file Chango first checks the Visual Basic Script version. If it is more than 4 then it creates two files: "C:\WINDOWS\LOGOS.SYS" and "C:\WINDOWS\LOGOW.SYS". Those files are scriptlet objects and contain the string "TROJAN.Chango".

After that the trojan attempts to create in the Windows startup directory of English, Spanish and Portuguese environments the file "TROJAN.CHANGO.HTM".

Further every time the a system is rebooted it will run the IE and open "TROJAN.CHANGO.HTM" that looks like:

Chango

Chango doesn't contain any destructive payload.

VideosEdit

Virus.VBS04:40

Virus.VBS.Chango

SourcesEdit

F-secure, Virus.VBS.Chango

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.