A Comprehensive Guide to Dealing with the Merdoor Malware

Malware threats are an ever-present and evolving menace in today’s digital landscape. Um desses incômodos que vem causando ondas no mundo cibernético é o Merdoor, um software malévolo do tipo backdoor. Neste artigo, we will delve deep into the intricacies of Merdoor, its origin, functionalities, impact, e mais importante, the steps to eradicate it from any compromised system.

Unmasking the Merdoor Malware

Merdoor is a malicious software categorized as a backdoor-type program. Its primary function is to create a hidden access point or a “backdoor” in compromised systems, paving the way for additional malware and harmful components to infiltrate.

The infamous group known as Lancefly is considered the mastermind behind the creation and distribution of Merdoor. This malware has been in operation since around 2018, primarily targeting entities in South and Southeast Asia that operate within governmental, educacional, aviation, and telecommunication sectors. The main objective of Lancefly appears to be intelligence gathering.

Dissecting the Merdoor Malware

Merdoor, upon successful infiltration, establishes a connection with its Command and Control server. This server acts as the hub for all its malicious activities, including the downloading and installation of further malware on the infected device.

Merdoor’s strength lies in its ability to cause chain infections. While theoretically, backdoor programs can infiltrate any type of malware into an infected machine, they usually operate within certain boundaries. In the observed attacks, Merdoor has been used to introduce loaders (programs that download/install additional malware), ZXShell Rootkit, PlugX RAT (Trojan de acesso remoto), and other malicious content into systems.

In addition to introducing new threats, Merdoor also possesses the ability to exploit legitimate processes and tools for malevolent purposes. Além disso, it has keylogging capabilities, meaning it can record keystrokes and thereby gather a variety of typed information.

The risks posed by high-risk malware like Merdoor are multifarious, ranging from multiple system infections and data loss to severe privacy issues, perdas financeiras, e roubo de identidade. No entanto, the threats associated with highly-targeted attacks leveraged against particularly sensitive entities can have significantly more devastating consequences.

Threat Analysis of Merdoor Malware

Threat Name	Merdoor virus
Tipo de ameaça	Trojan, backdoor, loader, password-stealing virus, banking malware, spyware.
Nomes de detecção	Avast (Win32:MalwareX-gen [Trj]), Combo Cleaner (Gen:Variant.Zusy.473641), ESET NOD32, (Win32/Agent.AFNM), Kaspersky (Trojan.Win32.Agentb.lcwx), Microsoft (Trojan:Win32/Casdet!rfn), Lista completa de detecções (VirusTotal)
Sintomas	Os Trojans são projetados para se infiltrar furtivamente no computador da vítima e permanecer silenciosos, e, portanto, nenhum sintoma específico é claramente visível em uma máquina infectada.
Métodos de distribuição	Anexos de e-mail infectados, anúncios on-line maliciosos, Engenharia social, 'rachaduras' de software.
Dano	Senhas e informações bancárias roubadas, roubo de identidade, the victim’s computer added to a botnet.

Counterparts of Merdoor Malware

Merdoor is not the only malware with backdoor functionalities prevalent in the cyber world today. Domino, PowerMagic, Soul, and MQsTTang are some other malicious programs that operate similarly.

The functionalities and features of malware can be quite diverse and are often combined in different ways. No entanto, the presence of any malicious software on a system poses a severe threat to the device’s integrity and the user’s safety. Sendo assim, it is crucial to eliminate all threats immediately upon detection.

Infiltration Techniques of Merdoor Malware

Merdoor has been known to employ various infiltration techniques. One of the attacks in 2020 involving this backdoor likely originated from a phishing email, while another campaign might have involved brute-force methods. The extent to which Lancefly, the group behind Merdoor, alters their methodology between attacks is not entirely clear.

Tipicamente, malware is proliferated using phishing and social engineering techniques. Malicious software is often disguised as or bundled with regular programs/media.

Given that Merdoor has been distributed using spam email, it is essential to understand how this method of malware proliferation works. Spam messages contain malicious attachments or links that lead to harmful sites that either stealthily download/install malware or trick visitors into doing so themselves.

Infectious files can come in various formats, tais como documentos (Microsoft Office, Microsoft OneNote, PDF, etc.), arquivos (RAR, fecho eclair, etc.), executáveis (.Exe, .correr, etc.), JavaScript, e mais. When a malicious file is executed, correr, ou de outra forma aberto, it triggers the infection chain.

Malware is also spread via drive-by (stealthy/deceptive) downloads, golpes on-line, malvertising, untrustworthy download sources, illegal software activation tools ("rachaduras"), and fake updates. Além disso, some malicious programs can self-proliferate through local networks and removable storage devices.

Preventive Measures Against Malware Installation

To ensure your system’s safety against threats like Merdoor, it is crucial to exercise caution while dealing with incoming emails and other messages. The attachments or links found in dubious mail should not be opened, as they could potentially be harmful.

Similarmente, vigilance must be maintained while browsing the internet, as fraudulent and malicious online content often appears ordinary and harmless.

It is highly advisable to only download from official and verified sources. Além disso, software must be activated and updated using legitimate functions/tools, como ferramentas de ativação ilegal ("rachaduras") and fake updates often contain malware.

Having a reliable anti-virus installed and kept up-to-date is of utmost importance. The security software must be used to conduct regular system scans and to remove detected threats. If you suspect your computer is already infected, we recommend running a scan with SpyHunter to automatically eliminate infiltrated malware.

Ferramentas Recomendadas Anti-malware:

Manual Malware Removal

Manual malware removal can be a complicated task and usually requires specialized IT skills. No entanto, if you wish to attempt the removal of malware manually, the first step is to identify the name of the malware that you’re trying to remove.

You can check the list of programs running on your computer, por exemplo, using task manager, and identify any program that looks suspicious. Once you have identified the suspicious program, you can use a program called Execuções automáticas to help remove it.

Restarting Your Computer into Safe Mode

To ensure the successful removal of the malware, you need to restart your computer into Safe Mode. Safe Mode is a diagnostic mode of a computer operating system (OS) that provides limited access to the computer’s file system and operating system, making it easier to isolate and remove malware.

Using the Autoruns Application

Once your computer is in Safe Mode, you can use the Autoruns application to help identify and remove the malware. Autoruns shows auto-start applications, Registro, e locais do sistema de arquivos.

Deleting the Malware

After identifying the malware file you want to eliminate, right-click your mouse over its name and choose “Delete”. After the malware is removed, you should search for the malware’s name on your computer. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.