에프시큐어(F-Secure), Windows Remote Desktop worm "Morto" spreading

필란드 보안업체인 에프시큐어(F-Secure) 에서 원격 데스크탑으로 전파되는 "Morto Worm" 이라는 악성파일에 대해 공개하였다.

현재 이 Worm으로 인해 TCP 3389 스캐닝이 증가한다고 있다고 SANS에서 발표하였다. 
https://isc.sans.edu/diary.html?storyid=11452&rss

정확한 분석은 차후에^^

알약에서는 "Worm.Morto.A" 으로 탐지 될 예정이다.
 

- 원본보기 : http://www.f-secure.com/weblog/archives/00002227.html

We don't see that many internet worms these days. It's mostly just bots and trojans. But we just found a new internet worm, and it's spreading in the wild. 

The worm is called Morto and it infects Windows workstations and servers. It uses a new spreading vector that we haven't seen before: RDP.

RDP stands for Remote Desktop Protocol. Windows has built-in support for this protocol via Windows Remote Desktop Connection. Once you enable a computer for remote use, you can use any other computer to access it. 



When you connect to another computer with this tool, you can remotely use the computer, just like you'd use a local computer.



Once a machine gets infected, the Morto worm starts scanning the local network for machines that have Remote Desktop Connection enabled. This creates a lot of traffic for port 3389/TCP, which is the RDP port.

When Morto finds a Remote Desktop server, it tries logging in as Administrator and tries a series of passwords:

 admin
 password
 server
 test
 user
 pass
 letmein
 1234qwer
 1q2w3e
 1qaz2wsx
 aaa
 abc123
 abcd1234
 admin123
 111
 123
 369
 1111
 12345
 111111
 123123
 123321
 123456
 654321
 666666
 888888
 1234567
 12345678
 123456789
 1234567890

Once you are connected to a remote system, you can access the drives of that server via Windows shares like \\tsclient\c and\\tsclient\d for drives C: and D:, respectively. Monto uses this feature to copy itself to the target machine. It does this by creating a temporary drive under letter A: and copying a file called a.dll to it.

The infection will create several new files on the system including \windows\system32\sens32.dll and 
\windows\offline web pages\cache.txt

Morto can be controlled remotely. This is done via several alternative servers, including jaifr.com and qfsl.net

We've seen several different samples. Some MD5 hashes include:
0c5728b3c22276719561049653c71b84
14284844b9a5aaa680f6be466d71d95b
58fcbc7c8a5fc89f21393eb4c771131d

More discussion on the topic at Technet forums.

We detect Morto components as Backdoor:W32/Morto.A and Worm:W32/Morto.B