Threat Description

Worm:​W32/Morto.A

Details

Aliases: Morto, Morto.A, Net-worm.win32.morto, Net-worm.win32.morto., Net-worm.win32.morto.l
Category: Malware
Type: Worm
Platform: W32

Summary



Worm:W32/Morto.A propagates through Remote Desktop Services on Windows servers by brute-forcing the login credentials of the server.



Removal



Automatic

Allow F-Secure Anti-Virus for Windows Servers to disinfect the relevant files.For more general information on disinfection, please see Removal Instructions.



Technical Details



Worm:W32/Morto.A can be viewed as having three components: the dropper, the loader, and the payload.

The Dropper

Upon execution, it sets the data of the registry value HKLM\SYSTEM\WPA\ie to its own full path, then deletes the registry key, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU.

It then saves a copy of the embedded encrypted data to the registry value, HKLM\System\Wpa\md. This encrypted data is actually the payload of the malware.

It then drops a DLL component in the Windows directory named clb.dll (which is the loader) and executes regedit in the Windows run command, then terminates.

The Loader

The clb.dll or the loader gets triggered when the regedit command was executed. This happens because regedit normally loads a normal Windows DLL component from the %systemdir% folder named clb.dll. Due to the nature of the Windows DLL loading mechanism, the clb.dll file that was dropped by the malware in the Windows directory gets loaded instead of the one in the %systemdir% directory.

As it is the malicious DLL that gets loaded, the regedit command does not show any graphic user interface (GUI) as it normally does. It decrypts and loads the encrypted payload saved at HKLM\System\Wpa\md registry value. This is when the payload takes control.

It renames clb.dll to clb.dllbak so regedit will execute as normal and will not appear to be suspicious to the user.

When the loader is triggered by rundll32.exe, it tries to read the following file-like objects: \\tsclient\a\moto and \\tsclient\a\RIR1.

The malware also does the following modifications:

Adds files

  • C:\WINDOWS\Offline Web Pages\cache.txt
  • C:\WINDOWS\system32\Sens32.dll

Adds Registries

  • HKLM\SYSTEM\WPA\sn = 6to4
  • HKLM\SYSTEM\WPA\sr = Sens
  • HKLM\SYSTEM\WPA\id = 1254D6C6EK6GWQQS
  • HKLM\SYSTEM\CurrentControlSet\Control\Windows\NoPopUpsOnBoot = dword:00000001

Modifies Registries

  • HKLM\SYSTEM\CurrentControlSet\Services\SENS\DependOnService = hex:0x0
  • HKLM\SYSTEM\CurrentControlSet\Services\SENS\Group = SchedulerGroup
  • HKLM\SYSTEM\CurrentControlSet\Services\SENS\Parameters = C:\WINDOWS\system32\Sens32.dll

The Payload

The payload contains the self propagating mechanism of the malware. It does this by brute-forcing the administrator login to Remote Desktop Services (TCP port 3389) using a set of passwords embedded to the binary. It does this on the computers connected to the local subnet.

Embedded passwords

  • !@#$%
  • %u%12
  • *1234
  • 000000
  • 111
  • 1111
  • 111111
  • 123
  • 123123
  • 123321
  • 12345
  • 123456
  • 1234567
  • 12345678
  • 123456789
  • 1234567890
  • 1234qwer
  • 168168
  • 1q2w3e
  • 1qaz2wsx
  • 369
  • 520520
  • 654321
  • 666666
  • 888888
  • aaa
  • abc123
  • abcd1234
  • admin
  • admin123
  • letmein
  • pass
  • password
  • server
  • test
  • user

On successful login, it will attempt to copy and execute the loader component and a registry file to the server, with the names \\tsclient\a\a.dll and \\tsclient\a\r.reg, respectively.

The registry file contains these entries:

  • Windows Registry Editor Version 5.00
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] ConsentPromptBehaviorAdmin=dword:0 EnableLUA=dword:0
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers] c:\\windows\\system32\\rundll32.exe=RUNASADMIN d:\\windows\\system32\\rundll32.exe=RUNASADMIN e:\\windows\\system32\\rundll32.exe=RUNASADMIN f:\\windows\\system32\\rundll32.exe=RUNASADMIN g:\\windows\\system32\\rundll32.exe=RUNASADMIN h:\\windows\\system32\\rundll32.exe=RUNASADMIN i:\\windows\\system32\\rundll32.exe=RUNASADMIN c:\\windows\\SysWOW64\\rundll32.exe=RUNASADMIN d:\\windows\\SysWOW64\\rundll32.exe=RUNASADMIN e:\\windows\\SysWOW64\\rundll32.exe=RUNASADMIN f:\\windows\\SysWOW64\\rundll32.exe=RUNASADMIN g:\\windows\\SysWOW64\\rundll32.exe=RUNASADMIN h:\\windows\\SysWOW64\\rundll32.exe=RUNASADMIN i:\\windows\\SysWOW64\\rundll32.exe=RUNASADMIN c:\\winnt\\system32\\rundll32.exe=RUNASADMIN c:\\win2008\\system32\\rundll32.exe=RUNASADMIN c:\\win2k8\\system32\\rundll32.exe=RUNASADMIN c:\\win7\\system32\\rundll32.exe=RUNASADMIN c:\\windows7\\system32\\rundll32.exe=RUNASADMIN

Since the loader is expecting rundll32.exe to trigger itself, this seems to give the rundll32.exe Administrator rights, as well as the loader.

The malware also monitors processes related to antivirus and security software and terminates them if the following strings are found:

  • 360rp
  • a2service
  • ACAAS
  • ArcaConfSV
  • AvastSvc
  • avguard
  • avgwdsvc
  • avpmapp
  • ccSvcHst
  • cmdagent
  • coreServiceShell
  • FortiScand
  • FPAVServer
  • freshclam
  • fsdfwd
  • GDFwSvc
  • K7RTScan
  • knsdave
  • KVSrvXP
  • kxescore
  • mcshield
  • MPSvc
  • MsMpEng
  • NSESVC.EXE
  • PavFnSvr
  • RavMonD
  • SavService
  • scanwscs
  • SpySweeper
  • Vba32Ldr
  • vsserv
  • zhudongfangyu

The malware also attempts to communicate to ss.qfsl.net, test.qfsl.net: 1031, and 74.125.71.104:80 probably to report, wait for commands, or get some updates.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More