Type:<\/strong> Worm<\/p>\n Degree of destruction<\/strong>: High<\/p>\n Prevalence:<\/strong> High<\/p>\n Computer worms such as Neutrino are types of malware that can automatically reproduce themselves. For permanence, worms set ways to maintain infection in the system in every boot. The prominent feature of worms is their distribution method which is generally through portable drives and shared directories in the network.<\/p>\n Neutrino malware provides a basis for bitcoin miners and Ransomware. The most important detected Ransomware in this way is Gand Crab malware.<\/p>\n This malware will run multiple bitcoin miner processes after the execution that will engage the system CPU and slows the OS.<\/p>\n One of the distribution methods of this malware is a portable drive as such all victim’s existing files and portable drives will be transferred to a directory named “_” and copy a version of itself in this directory. In some of these malware examples and the path of the portable drive, two files “deviceconfigmanager.vbs and autorun.inf” will be placed as well as an Ink file in every example in the path of the portable drive. All files and directories except Ink file are hidden and system type. Hence, the only thing which can be seen in it is the Ink file which will be executed with a click, when you connect the portable drive to the system.<\/p>\n First, malware will provide a basis for its permanence and then acts like a bot and will connect to its server; based on the instructions it received from its server, it will provide a basis for the creation and execution of bitcoins. By executing bitcoins, the user’s system will extensively be slow that which is due to too much use of CPU by the malware processes.<\/p>\n This malware is sensitive to several related processes to\u00a0VMWare-VirtualBox-Citrix Xen Server it will end its execution if it runs on one of these Virtual machines.<\/p>\n Each of the following files can build into the victim’s system separately:<\/p>\n The directory name from “M-” to the end of the phrase is random. In some examples, the name of the directory will begin with “T-“.<\/p>\n In the new observed examples, the name of the directory is just a random collection of numbers, and the letters “M-” and “T-” have been removed.<\/p>\n In the new examples that were recently analyzed, malware will deactivate the system restore by changing registries.<\/p>\n If the following names’ parental processes are not explorer.exe and services.exe, it can be observed in the current system processes that may be the system is infected by the bitcoin files which are downloaded from the infected malware.<\/p>\n The built-up registry path for malware permanence:<\/p>\n In the new version of this malware in Windows 10, the malware will manipulate the registries related to Windows Defender. These changes may interfere with the Windows Defender function.<\/p>\n This malware, also, infects the directories and share drives such as portable drives.<\/p>\n In the new versions of this malware, a massive volume of traffic will exist from port 5900 of the infected system. Malware tries to connect with a huge number of IPs from this port. Surveys show that some of these IPs belong to the malware server.<\/p>\nWhat is the Worm?<\/h3>\n
What is Neutrino malware?<\/h3>\n
Technical Explanation<\/h2>\n
Signs of infection\u00a0<\/strong><\/h3>\n
\n
[SystemRoot]:\\\\Windows\\\\M-505059720970246082475082628448545\\\\winmgr.exe<\/code><\/li>\n[SystemRoot]:\\\\Windows\\\\M-505059720970246082475082628448545\\\\winsvc.exe<\/code><\/li>\n[SystemRoot]:\\\\Windows\\\\M-505059720970246082475082628448545\\\\winsvcs.exe<\/code><\/li>\n[SystemRoot]:\\\\Windows\\\\M-505059720970246082475082628448545\\\\winsecmgr.exe<\/code><\/li>\n<\/ul>\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore<\/code><\/p>\nValueName = DisableSR<\/code><\/p>\nGenerally, the malware process will be run by the following name:<\/code><\/p>\nwinsvcs.exe-winsvc.exe-winmgr.exe-winsecmgr.exe<\/code><\/p>\n\u201csvchost.exe\u201d,\u201dnotepad.exe\u201d,\u201dwinmgr.exe\u201d,\u201dwuapp.exe\u201d<\/code><\/p>\nHKEY_CURRENT_USER\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run<\/code>
\nValueName = \u201cMicrosoft Windows Manager\u201d OR \u201cMicrosoft Windows Service\u201d OR \u201cMicrosoft Windows Services\u201d OR \u201cMicrosoft Windows Updates\u201d OR \u201cMicrosoft Windows Updates Manager\u201d OR \u201cMicrosoft Windows Driver\u201d<\/code>
\nData=%User Profile%\\[RandomName]\\winsvcs.exe<\/code>
\nOR<\/code>
\n[SystemRoot]:\\Windows\\]\\[RandomName]\\winsvcs.exe<\/code><\/p>\nHKLM\\Software\\Policies\\Microsoft\\Windows\u202c\u202c \u202b\u202aDefender\\Real-Time Protection<\/code><\/p>\nValue:\u00a0DisableScanOnRealtimeEnable OR DisableOnAccessProtection OR\u00a0DisableBehaviorMonitoring<\/code><\/p>\n