Worm Spreads with New Capabilities

Tuesday, September 6, 2011 @ 01:09 PM gHale

Morto the worm has been spreading and has more than one never-before-seen characteristic.

Not only does it spread by using the Remote Desktop Protocol, but it also uses a novel way to contact its C&C in search for instructions: via DNS (Domain Name System) TXT records.

Cyber Crime: Huge Haul in One Day
New Worm Infects Windows PCs
Old Browser Plug-ins Big Attack Target
Report: Malware, Targeted Attacks on Rise

“While examining W32.Morto, we noticed that it would attempt to request a DNS record for a number of URLs that were hard-coded into the binary,” wrote Symantec’s security response engineer Cathal Mullaney.

“This is by no means unusual or unique, but when we examined the URLs, we noticed that there were no associated DNS A records returned from our own DNS requests. On further investigation, we determined that the malware was actually querying for a DNS TXT record only – not for a domain to IP lookup – and the values that were returned were quite unexpected.”

The information provided was a binary signature and an IP address from which the worm can download further malware — the same information that most threats receive using more established communication channels.

Leave a Reply

You must be logged in to post a comment.