That is part of the nasty thing early on. Detectors only found it AFTER the payload had been delivered as it was some form of polymorphic .exe with scripting that just didnt get picked up. What did was URLs and keywords in the text files they make when they have done the deed. 

I't wasn't attaching to files to encrypt them, it was being done externally on a TSR. So unless you specifically had the definitions like you say at 0day which is hard to, it was easily missed unless you checked memory or odd .exe and reg changes.