A Comprehensive Guide to Dealing with the Merdoor Malware

Malware threats are an ever-present and evolving menace in today’s digital landscape. Una de esas molestias que ha estado haciendo olas en el mundo cibernético es Merdoor, un software malévolo de tipo puerta trasera. En este articulo, we will delve deep into the intricacies of Merdoor, its origin, functionalities, impact, y lo más importante, the steps to eradicate it from any compromised system.

Unmasking the Merdoor Malware

Merdoor is a malicious software categorized as a backdoor-type program. Its primary function is to create a hidden access point or a “backdoor” in compromised systems, paving the way for additional malware and harmful components to infiltrate.

The infamous group known as Lancefly is considered the mastermind behind the creation and distribution of Merdoor. This malware has been in operation since around 2018, primarily targeting entities in South and Southeast Asia that operate within governmental, educativo, aviation, and telecommunication sectors. The main objective of Lancefly appears to be intelligence gathering.

Dissecting the Merdoor Malware

Merdoor, upon successful infiltration, establishes a connection with its Command and Control server. This server acts as the hub for all its malicious activities, including the downloading and installation of further malware on the infected device.

Merdoor’s strength lies in its ability to cause chain infections. While theoretically, backdoor programs can infiltrate any type of malware into an infected machine, they usually operate within certain boundaries. In the observed attacks, Merdoor has been used to introduce loaders (programs that download/install additional malware), ZXShell Rootkit, PlugX RAT (Troyano de acceso remoto), and other malicious content into systems.

In addition to introducing new threats, Merdoor also possesses the ability to exploit legitimate processes and tools for malevolent purposes. Por otra parte, it has keylogging capabilities, meaning it can record keystrokes and thereby gather a variety of typed information.

The risks posed by high-risk malware like Merdoor are multifarious, ranging from multiple system infections and data loss to severe privacy issues, pérdidas financieras, y robo de identidad. Sin embargo, the threats associated with highly-targeted attacks leveraged against particularly sensitive entities can have significantly more devastating consequences.

Threat Analysis of Merdoor Malware

Threat Name	Merdoor virus
Tipo de amenaza	Troyano, backdoor, loader, virus que roba contraseñas, banking malware, spyware.
Nombres de detección	Avast (Win32:MalwareX-gen [Trj]), Combo Cleaner (Gen:Variant.Zusy.473641), ESET NOD32, (Win32/Agent.AFNM), Kaspersky (Trojan.Win32.Agentb.lcwx), microsoft (Troyano:Win32/Casdet!rfn), Lista completa de detecciones (VirusTotal)
Síntomas	Los troyanos están diseñados para infiltrarse sigilosamente en el ordenador de la víctima y permanecer en silencio., y por lo tanto ningún síntoma particular es claramente visible en una máquina infectada.
Métodos de distribución	Archivos adjuntos de correo electrónico infectados, anuncios maliciosos en línea, Ingeniería social, 'grietas' de software.
Daño	Contraseñas e información bancaria robadas, el robo de identidad, the victim’s computer added to a botnet.

Counterparts of Merdoor Malware

Merdoor is not the only malware with backdoor functionalities prevalent in the cyber world today. Domino, PowerMagic, Soul, and MQsTTang are some other malicious programs that operate similarly.

The functionalities and features of malware can be quite diverse and are often combined in different ways. Sin embargo, the presence of any malicious software on a system poses a severe threat to the device’s integrity and the user’s safety. Por lo tanto, it is crucial to eliminate all threats immediately upon detection.

Infiltration Techniques of Merdoor Malware

Merdoor has been known to employ various infiltration techniques. One of the attacks in 2020 involving this backdoor likely originated from a phishing email, while another campaign might have involved brute-force methods. The extent to which Lancefly, the group behind Merdoor, alters their methodology between attacks is not entirely clear.

Típicamente, malware is proliferated using phishing and social engineering techniques. Malicious software is often disguised as or bundled with regular programs/media.

Given that Merdoor has been distributed using spam email, it is essential to understand how this method of malware proliferation works. Spam messages contain malicious attachments or links that lead to harmful sites that either stealthily download/install malware or trick visitors into doing so themselves.

Infectious files can come in various formats, tales como documentos (oficina de microsoft, microsoft una nota, PDF, etc.), archivos (RAR, cremallera, etc.), ejecutables (.exe, .correr, etc.), JavaScript, y más. When a malicious file is executed, correr, o abierto de otra manera, it triggers the infection chain.

Malware is also spread via drive-by (stealthy/deceptive) descargas, estafas en línea, publicidad maliciosa, untrustworthy download sources, herramientas de activación de software ilegales ("grietas"), y actualizaciones falsas. Por otra parte, some malicious programs can self-proliferate through local networks and removable storage devices.

Preventive Measures Against Malware Installation

To ensure your system’s safety against threats like Merdoor, it is crucial to exercise caution while dealing with incoming emails and other messages. The attachments or links found in dubious mail should not be opened, as they could potentially be harmful.

Similar, vigilance must be maintained while browsing the internet, as fraudulent and malicious online content often appears ordinary and harmless.

It is highly advisable to only download from official and verified sources. Además, software must be activated and updated using legitimate functions/tools, como herramientas de activación ilegales ("grietas") and fake updates often contain malware.

Having a reliable anti-virus installed and kept up-to-date is of utmost importance. The security software must be used to conduct regular system scans and to remove detected threats. If you suspect your computer is already infected, we recommend running a scan with SpyHunter to automatically eliminate infiltrated malware.

Herramientas Anti-malware Recomendadas:

Eliminación manual de malware

Manual malware removal can be a complicated task and usually requires specialized IT skills. Sin embargo, if you wish to attempt the removal of malware manually, the first step is to identify the name of the malware that you’re trying to remove.

You can check the list of programs running on your computer, por ejemplo, using task manager, and identify any program that looks suspicious. Once you have identified the suspicious program, you can use a program called Ejecuciones automáticas to help remove it.

Restarting Your Computer into Safe Mode

To ensure the successful removal of the malware, you need to restart your computer into Safe Mode. Safe Mode is a diagnostic mode of a computer operating system (OS) that provides limited access to the computer’s file system and operating system, making it easier to isolate and remove malware.

Using the Autoruns Application

Once your computer is in Safe Mode, you can use the Autoruns application to help identify and remove the malware. Autoruns shows auto-start applications, Registro, y ubicaciones del sistema de archivos.

Deleting the Malware

After identifying the malware file you want to eliminate, right-click your mouse over its name and choose “Delete”. After the malware is removed, you should search for the malware’s name on your computer. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Seguir estos pasos debería eliminar cualquier malware de su computadora. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.