Home Malware Programs Worms WORM_MORTO.SM

WORM_MORTO.SM

Posted: October 22, 2012

Threat Metric

Threat Level: 5/10
Infected PCs: 567
First Seen: October 22, 2012
Last Seen: December 14, 2021
OS(es) Affected: Windows

WORM_MORTO.SM is a worm, which uses Remote Desktop Protocol (RDP) to spread itself. WORM_MORTO.SM is distributed by other PC threats or dropped as a malicious file downloaded unknowingly by PC users when visiting malicious websites. WORM_MORTO.SM deletes the initially executed copy of itself. Once installed, WORM_MORTO.SM adds the potentially malicious files as copies of itself into the infected computer system. WORM_MORTO.SM inserts itself into the svchost.exe process in order to stay resident in computer memory. WORM_MORTO.SM modifies the Windows Registry by adding several registry entries. This worm deletes the initially executed copy of itself. This worm creates a backup copy of its dropped file as %Windows%\clb.dll.bak. The file %system%\clb.dll is a legitimate file which is used by regedit.exe. That is why the copy of this malware is placed in %Windows% directory is to trick regedit.exe that the dropped file is the component that it needs. Therefore, regedit.exe loads the malicious clb.dll into the system.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



file.exe File name: file.exe
Size: 6.67 KB (6672 bytes)
MD5: 1e1b189c39c0d8d5fbd72f05eb1cceee
Detection count: 71
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 23, 2012
file.exe File name: file.exe
Size: 6.67 KB (6672 bytes)
MD5: d856249f4a33f6c88b7c70e7968b976b
Detection count: 70
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 23, 2012
file.exe File name: file.exe
Size: 6.67 KB (6672 bytes)
MD5: 9bf82a30dcbb45bfc39e978a00a5460c
Detection count: 69
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 23, 2012
%Windows%\Offline Web Pages\cache.txt File name: %Windows%\Offline Web Pages\cache.txt
Mime Type: unknown/txt
Group: Malware file
%System%\Sens32.dll File name: %System%\Sens32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%Windows%\clb.dl File name: %Windows%\clb.dl
Mime Type: unknown/dl
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%WINDIR%\offline web pages\cache.txt%WINDIR%\System32\wmicuclt%WINDIR%\System32\wmicuclt.exe%WINDIR%\SysWOW64\wmicuclt%WINDIR%\SysWOW64\wmicuclt.exe%WINDIR%\Temp\ntshrui.dllHKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows NoPopUpsOnBoot = "1"HKEY_LOCAL_MACHINE\SYSTEM\WPA id = "1293D1C15VAVUJTN"HKEY_LOCAL_MACHINE\SYSTEM\WPA it = "{hex values}"HKEY_LOCAL_MACHINE\SYSTEM\WPA md = "{garbage code}"HKEY_LOCAL_MACHINE\SYSTEM\WPA ie = "%current folder%\{malware name}.exe"HKEY_LOCAL_MACHINE\SYSTEM\WPA sr = "Sens"HKEY_LOCAL_MACHINE\SYSTEM\WPA sn = "6to4"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] ConsentPromptBehaviorAdmin=0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] EnableLUA=0[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers]
Loading...