WORM_MORTO.DI

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any backdoor routine.

It does not have any information-stealing capability.

It deletes the initially executed copy of itself.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

• %Windows%\Offline Web pages\{Current Date} {Current Time}
• %Windows%\Offline Web pages\2.02_0401
• %Windows%\Offline Web pages\cache.txt
• %Windows%\clb.dll - detected as WORM_MORTO.DI
• %System%\Sens32.dll

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It injects itself into the following processes as part of its memory residency routine:

• svchost.exe

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\WPA
it = "{hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\WPA
id = "1293D1C15VAVUJTN"

HKEY_LOCAL_MACHINE\SYSTEM\WPA
ie = "%current folder%\{malware name}.exe"

HKEY_LOCAL_MACHINE\SYSTEM\WPA
md = "{garbage code}"

HKEY_LOCAL_MACHINE\SYSTEM\WPA
sn = "6to4"

HKEY_LOCAL_MACHINE\SYSTEM\WPA
sr = "Sens"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Windows
NoPopUpsOnBoot = "1"

Backdoor Routine

This worm does not have any backdoor routine.

Process Termination

This worm terminates the following processes if found running in the affected system's memory:

• 360rp
• a-squared
• a2service
• ACAAS
• ArcaConfSV
• AvastSvc
• AVG_TRAY
• avguard
• avgwdsvc
• avpmapp
• BDAgent
• BitDefender Antiphishing Helper
• ccSvcHst
• cmdagent
• coreServiceShell
• F-Secure Manager
• F-Secure TNB
• FortiScand
• FPAVServer
• freshclam
• fsdfwd
• G Data AntiVirus Tray Application
• GDFwSvc
• IKARUS-GuardX
• K7RTScan
• knsdave
• KVSrvXP
• kxescore
• mcshield
• MPSvc
• MsMpEng
• NSESVC.EXE
• PavFnSvr
• RavMonD
• SavService
• scanwscs
• ShStatEXE
• Sophos AutoUpdate Monitor
• SpySweeper
• V3 Session Process
• Vba32Ldr
• vsserv
• zhudongfangyu

Download Routine

This worm downloads updated copies of itself from the following websites:

• {BLOCKED}1.{BLOCKED}q.co.cc
• {BLOCKED}1.{BLOCKED}q.com

Information Theft

This worm does not have any information-stealing capability.

Other Details

This worm deletes the initially executed copy of itself

NOTES:

This worm creates a backup copy of its dropped file, %Windows%\clb.dll, as %Windows%\clb.dll.bak.

The file %system%\clb.dll is a legitimate file which is used by regedit.exe. That is why the copy of this malware is placed in %windows% directory is to trick regedit.exe that this is the component that it needs. Therefore, loading the malicious clb.dll into the system.

It listens to port 3389/TCP, the port for RCP, for possible enabled Remote Desktop.

Once remotely connected, this worm copies itself as a.dll to a directory in a temporary drive A: in the remote computer using the following remote command:

• rundll32 \\tsclient\a\a.dll a

It does not have rootkit capabilities.

It does not exploit any vulnerability.