A Comprehensive Guide to Dealing with the Merdoor Malware

Malware threats are an ever-present and evolving menace in today’s digital landscape. One such nuisance that has been making waves in the cyber world is Merdoor, a backdoor-type malevolent software. Dans cet article, we will delve deep into the intricacies of Merdoor, its origin, functionalities, impact, et, surtout, the steps to eradicate it from any compromised system.

Unmasking the Merdoor Malware

Merdoor is a malicious software categorized as a backdoor-type program. Its primary function is to create a hidden access point or a « backdoor » in compromised systems, paving the way for additional malware and harmful components to infiltrate.

The infamous group known as Lancefly is considered the mastermind behind the creation and distribution of Merdoor. This malware has been in operation since around 2018, primarily targeting entities in South and Southeast Asia that operate within governmental, éducatif, aviation, and telecommunication sectors. The main objective of Lancefly appears to be intelligence gathering.

Dissecting the Merdoor Malware

Merdoor, upon successful infiltration, establishes a connection with its Command and Control server. This server acts as the hub for all its malicious activities, including the downloading and installation of further malware on the infected device.

Merdoor’s strength lies in its ability to cause chain infections. While theoretically, backdoor programs can infiltrate any type of malware into an infected machine, they usually operate within certain boundaries. In the observed attacks, Merdoor has been used to introduce loaders (programs that download/install additional malware), ZXShell Rootkit, PlugX RAT (Cheval de Troie d'accès à distance), and other malicious content into systems.

In addition to introducing new threats, Merdoor also possesses the ability to exploit legitimate processes and tools for malevolent purposes. Par ailleurs, it has keylogging capabilities, meaning it can record keystrokes and thereby gather a variety of typed information.

The risks posed by high-risk malware like Merdoor are multifarious, ranging from multiple system infections and data loss to severe privacy issues, pertes financières, et usurpation d'identité. Cependant, the threats associated with highly-targeted attacks leveraged against particularly sensitive entities can have significantly more devastating consequences.

Threat Analysis of Merdoor Malware

Threat Name	Merdoor virus
Type de menace	troyen, backdoor, loader, virus voleur de mot de passe, malware bancaire, spyware.
Noms de détection	Avast (Win32:MalwareX-gen [Trj]), Nettoyant Combo (Gen:Variant.Zusy.473641), ESET NOD32- (Win32/Agent.AFNM), Kaspersky (Trojan.Win32.Agentb.lcwx), Microsoft (troyen:Win32/Casdet!rfn), Liste complète des détections (VirusTotal)
Symptômes	Trojans are designed to stealthily infiltrate the victim’s computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine.
Modes de diffusion	Pièces jointes infectées, publicités en ligne malveillantes, ingénierie sociale, software ‘cracks’.
Dommage	Mots de passe et informations bancaires volés, vol d'identité, l'ordinateur de la victime ajouté à un botnet.

Counterparts of Merdoor Malware

Merdoor is not the only malware with backdoor functionalities prevalent in the cyber world today. Domino, PowerMagic, Soul, and MQsTTang are some other malicious programs that operate similarly.

The functionalities and features of malware can be quite diverse and are often combined in different ways. Cependant, the presence of any malicious software on a system poses a severe threat to the device’s integrity and the user’s safety. Donc, it is crucial to eliminate all threats immediately upon detection.

Infiltration Techniques of Merdoor Malware

Merdoor has been known to employ various infiltration techniques. One of the attacks in 2020 involving this backdoor likely originated from a phishing email, while another campaign might have involved brute-force methods. The extent to which Lancefly, the group behind Merdoor, alters their methodology between attacks is not entirely clear.

Typiquement, malware is proliferated using phishing and social engineering techniques. Malicious software is often disguised as or bundled with regular programs/media.

Given that Merdoor has been distributed using spam email, it is essential to understand how this method of malware proliferation works. Spam messages contain malicious attachments or links that lead to harmful sites that either stealthily download/install malware or trick visitors into doing so themselves.

Infectious files can come in various formats, tels que les documents (Microsoft Office, Microsoft OneNote, PDF, etc.), des archives (RAR, ZIP *: FRANÇAIS, etc.), exécutables (.EXE, .courir, etc.), Javascript, et de plus en plus. When a malicious file is executed, courir, or otherwise opened, it triggers the infection chain.

Malware is also spread via drive-by (stealthy/deceptive) téléchargements, escroqueries en ligne, malvertising, untrustworthy download sources, outils d'activation de logiciels illégaux (« fissures »), et fausses mises à jour. Par ailleurs, some malicious programs can self-proliferate through local networks and removable storage devices.

Preventive Measures Against Malware Installation

To ensure your system’s safety against threats like Merdoor, it is crucial to exercise caution while dealing with incoming emails and other messages. The attachments or links found in dubious mail should not be opened, as they could potentially be harmful.

De même, vigilance must be maintained while browsing the internet, as fraudulent and malicious online content often appears ordinary and harmless.

It is highly advisable to only download from official and verified sources. En outre, software must be activated and updated using legitimate functions/tools, comme outils d'activation illégaux (« fissures ») and fake updates often contain malware.

Having a reliable anti-virus installed and kept up-to-date is of utmost importance. The security software must be used to conduct regular system scans and to remove detected threats. If you suspect your computer is already infected, we recommend running a scan with SpyHunter to automatically eliminate infiltrated malware.

Outils Anti-Malware recommandé:

Suppression manuelle des logiciels malveillants

Manual malware removal can be a complicated task and usually requires specialized IT skills. Cependant, if you wish to attempt the removal of malware manually, the first step is to identify the name of the malware that you’re trying to remove.

You can check the list of programs running on your computer, par exemple, using task manager, and identify any program that looks suspicious. Once you have identified the suspicious program, you can use a program called Exécutions automatiques to help remove it.

Restarting Your Computer into Safe Mode

To ensure the successful removal of the malware, you need to restart your computer into Safe Mode. Safe Mode is a diagnostic mode of a computer operating system (OS) that provides limited access to the computer’s file system and operating system, making it easier to isolate and remove malware.

Using the Autoruns Application

Once your computer is in Safe Mode, you can use the Autoruns application to help identify and remove the malware. Autoruns shows auto-start applications, Enregistrement, et emplacements du système de fichiers.

Deleting the Malware

After identifying the malware file you want to eliminate, right-click your mouse over its name and choose « Delete ». After the malware is removed, you should search for the malware’s name on your computer. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Suivre ces étapes devrait supprimer tout logiciel malveillant de votre ordinateur. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.