Pterodo malware (virus) - Free Instructions

What is Pterodo malware?

Pterodo is politically motivated malware related to cyberattacks against Ukraine

Pterodo is a dangerous malware strain that targets Ukrainian organizations

Pterodo is a Trojan known in the cybersecurity landscape since at least 2014. The date is significant due to the first Russian attacks against Ukraine and the annexation of Crimea. The malware is tied to a Russian cybercriminals group known as Armageddon (also known as Shuckworm or Gamardeon) and is known to attack a number of Ukrainian organizations.

The main goal of Pterodo malware is to open a backdoor on the affected computers or networks. With the help of this functionality, it can inject secondary payloads; its main purpose remains sensitive data theft that can be used against the country in many ways.

Distribution

Like any other high-threat malware strain targeting organizations, Pterodo primarily uses targeted phishing emails to begin the infiltration process. These emails are sent to employees disguised as useful messages from well-known individuals, for example, managers of people who end up opening the email. Email spoofing is an established technique that easily helps the malware breakthrough into various businesses and organizations.

The email attachments are often booby-trapped with macro-laced code, which, once opened, would be executed. Thus, not allowing documents to execute macros would prevent the infiltration of malware. Adequate anti-malware solutions and adequate staff security training can significantly reduce the probability of infections.

Pterodo malware can also be spread using alternative methods, including drive-by downloads, repacked installers, crack tools, insecure RDP^[1] connections, and more.

Operation

As explained by Symantec security researchers,^[2] the attack on the system begins with an execution of a malicious VBS file, (a backdoor component of Pterodo malware), which is used to download malicious files from a predetermined URL. Upon entry, the malware creates a scheduled task that can ensure persistence. Later, a malicious HTA file is downloaded and executed via the mshta.exe, which can execute Microsoft HTML Application files and bypass application control solutions.

The main goal of Pterodo is to steal sensitive data and deliver secondary payloads

After establishing the communication means with a remote C&C server, hackers deliver multiple variants of Pterodo malware. It establishes a VNC client – the main vector of the attack – that can be used for various data gathering, including private company documents with descriptions, account passwords, or other sensitive information.

Pterodo removal steps

Anti-malware solutions at the best means of protection against dangerous malware attacks. However, since the Trojan is known to use living-off-the-land^[3] and similar obfuscation techniques so it might be difficult to spot and remove. The first step of malware removal is removing the affected machine from the network. In order to disconnect several computers at the same time, follow these steps:

• Type in Control Panel in Windows search and press Enter
• Go to Network and Internet
• Click Network and Sharing Center
• On the left, pick Change adapter settings
• Right-click on your connection (for example, Ethernet), and select Disable
• Confirm with Yes.

Once the device is disconnected, you should begin a full system scan with SpyHunter 5Combo Cleaner, Malwarebytes, or another powerful anti-malware software. In some cases, it is better to perform a scan in Safe Mode to ensure that the virus does not tamper with the elimination process. To access it, proceed with the following steps:

Windows 7 / Vista / XP

1. Click Start > Shutdown > Restart > OK.
2. When your computer becomes active, start pressing the F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
3. Select Safe Mode with Networking from the list.

Windows 10 / Windows 8

1. Right-click on the Start button and select Settings.
   
2. Scroll down to pick Update & Security.
3. On the left side of the window, pick Recovery.
4. Now scroll down to find the Advanced Startup section.
5. Click Restart now.
6. Select Troubleshoot.
7. Go to Advanced options.
8. Select Startup Settings.
9. Click Restart.
10. Press 5 or click 5) Enable Safe Mode with Networking.

Malware can cause tremendous damage to Windows systems to the point where a full reinstallation could be required. For example, an infection can alter the Windows registry, damage vital bootup, and other sections, delete or corrupt DLL files, etc. Antivirus software can't repair damaged files, and a specialized app should be used instead.

• Download FortectIntego
• Click on the ReimageRepair.exe
  
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.

By employing this tool, you would not have to worry about future computer issues, as most of them could be fixed quickly by performing a full system scan at any time. Most importantly, you could avoid the tedious process of Windows reinstallation in case things go very wrong due to one reason or another.