Worm:W32/Morto.A

Classification

Malware

Worm

W32

Morto,Morto.A,Net-worm.win32.morto,Net-worm.win32.morto.,Net-worm.win32.morto.l

Summary

Worm:W32/Morto.A propagates through Remote Desktop Services on Windows servers by brute-forcing the login credentials of the server.

Automatic action

Allow F-Secure Anti-Virus for Windows Servers to disinfect the relevant files.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

For more Support

Community

Find the latest advice in our Community.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Worm:W32/Morto.A can be viewed as having three components: the dropper, the loader, and the payload.

The Dropper

Upon execution, it sets the data of the registry value HKLM\SYSTEM\WPA\ie to its own full path, then deletes the registry key, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU.

It then saves a copy of the embedded encrypted data to the registry value, HKLM\System\Wpa\md. This encrypted data is actually the payload of the malware.

It then drops a DLL component in the Windows directory named clb.dll (which is the loader) and executes regedit in the Windows run command, then terminates.

The Loader

The clb.dll or the loader gets triggered when the regedit command was executed. This happens because regedit normally loads a normal Windows DLL component from the %systemdir% folder named clb.dll. Due to the nature of the Windows DLL loading mechanism, the clb.dll file that was dropped by the malware in the Windows directory gets loaded instead of the one in the %systemdir% directory.

As it is the malicious DLL that gets loaded, the regedit command does not show any graphic user interface (GUI) as it normally does. It decrypts and loads the encrypted payload saved at HKLM\System\Wpa\md registry value. This is when the payload takes control.

It renames clb.dll to clb.dllbak so regedit will execute as normal and will not appear to be suspicious to the user.

When the loader is triggered by rundll32.exe, it tries to read the following file-like objects: \\tsclient\a\moto and \\tsclient\a\RIR1.

The malware also does the following modifications:

Adds files

  • C:\WINDOWS\Offline Web Pages\cache.txt
  • C:\WINDOWS\Offline Web Pages\<Date> <ID>
    • eg: C:\Windows\Offline Web Pages\2018-09-14 0141
  • C:\WINDOWS\system32\Sens32.dll - (Overwritten with malware file)
  • C:\WINDOWS\Temp\ntshrui.dll

Adds Registries

  • HKEY_LOCAL_MACHINE\SYSTEM\WPA
    • it
    • id
    • ie
    • md
    • sn
    • lscan
    • rmd
  • HKLM\SYSTEM\CurrentControlSet\Control\Windows\NoPopUpsOnBoot
    • dword:00000001
  • HKLM\System\CurrentControlSet\Services\FastUserSwitchingCompatibility\Parameters
    • "ServiceDll"=C:\Windows\Temp\ntshrui.dll

Modifies Registries

  • HKLM\SYSTEM\CurrentControlSet\Services\SENS\DependOnService
    • hex:0x0
  • HKLM\SYSTEM\CurrentControlSet\Services\SENS\Group
    • SchedulerGroup
  • HKLM\SYSTEM\CurrentControlSet\Services\SENS\Parameters
    • C:\WINDOWS\system32\Sens32.dll

The Payload

The payload contains the worm propagation routine and infect other system using exposed Remote Desktop Protocol (RDP) Services. It will brute force the administrator login using hardcoded password list and proceed with infection after the successful login is achieved.

It does this to the computers connected to the local subnet and publicly exposed RDP services in the internet.

Embedded passwords

!@#$%%u%12*12340000001111111111111123123123
1233211234512345612345671234567812345678912345678901234qwer168168
1q2w3e1qaz2wsx369520520654321666666888888aaaabc123
abcd1234adminadmin123letmeinpasspasswordservertestuser

On successful login, it will attempt to copy and execute the loader component and a registry file to the server, with the names \\tsclient\a\a.dll and \\tsclient\a\r.reg, respectively.

The registry file contains these entries:

Windows Registry Editor Version 5.00

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
    • ConsentPromptBehaviorAdmin=dword:0
    • EnableLUA=dword:0
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers] 
    • <Drive_letter>:\\windows\\system32\\rundll32.exe=RUNASADMIN
    • <Drive_letter>:\\windows\\SysWOW64\\rundll32.exe=RUNASADMIN
    • C:\\winnt\\system32\\rundll32.exe=RUNASADMIN
    • C:\\win2008\\system32\\rundll32.exe=RUNASADMIN
    • C:\\win2k8\\system32\\rundll32.exe=RUNASADMIN
    • C:\\win7\\system32\\rundll32.exe=RUNASADMIN
    • C:\\windows7\\system32\\rundll32.exe=RUNASADMIN

Note: <Drive_letter> consists of "C" to "I" drive. eg: C:, D:.

Since the loader is expecting rundll32.exe to trigger itself, this seems to give the rundll32.exe Administrator rights, as well as the loader.

The malware also monitors processes related to antivirus and security software and terminates them if the following strings are found:

360rpa2serviceACAASArcaConfSVAvastSvcavguardavgwdsvcavpmapp
ccSvcHstcmdagentcoreServiceShellFortiScandFPAVServerfreshclamfsdfwdGDFwSvc
K7RTScanknsdaveKVSrvXPkxescoremcshieldMPSvcMsMpEngNSESVC.EXE
PavFnSvrRavMonDSavServicescanwscsSpySweeperVba32Ldrvsservzhudongfangyu

The malware also attempts to communicate to:

  • ss.qfsl[.]net
  • test.qfsl[.]net:1031
  • 74.125.71[.]104:80
  • ms.jifr[.]co.be