Backdoor.Win32.Miancha

Posted: February 14, 2014

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	4,080
Threat Level:	1/10
Infected PCs:	2,935

First Seen:	February 14, 2014
Last Seen:	October 17, 2023
OS(es) Affected:	Windows

Backdoor.Win32.Miancha is a Trojan that creates a backdoor connection to a C&C (or Command & Control) server, enabling Backdoor.Win32.Miancha to transfer stolen information, download new threats or receive commands from its controller. The infection vectors for Backdoor.Win32.Miancha attacks may use disguises, such as software updates, and with Backdoor.Win32.Miancha recently implicated in incidental attacks against a nuclear plant, PC security for industrial targets can safely be said to be as important as it is for the average Web surfer. Until malware experts acquire more details on Backdoor.Win32.Miancha's capabilities, Backdoor.Win32.Miancha should be treated as a high-level threat, and nothing but the most competent anti-malware products should be trusted to remove Backdoor.Win32.Miancha from your PC.

When a Threat Unintentionally Strikes the Big Pot

Backdoor.Win32.Miancha currently is being distributed in the wild at random, without any explicit companies or individuals being targeted. Its distribution tactic is a simple media player update for GOM (an unrelated and non-threatening product) that has been bundled with additional files allowing for Backdoor.Win32.Miancha's installation. The entire bundle is wrapped in an archive, which causes malware experts to remind any readers that archive files, such as ZIP and RAR, continue to be one of the most obvious warning signs of a potential threat installer. Previous attacks using the same distribution methods of Backdoor.Win32.Miancha Trojans have preferentially exploited unsafe or hacked websites, redirecting any traffic to these 'recommended downloads.'

Despite having a haphazard distribution plan, Backdoor.Win32.Miancha recently struck what many threat authors would have considered paydirt: Backdoor.Win32.Miancha was downloaded and installed by an employee at the Monju Nuclear Power Plant, based in Japan. Backdoor.Win32.Miancha includes the standard features of any backdoor Trojan, and if not resolved, would have allowed criminals to have had remote access to at least one of the facility's PCs. Some of the problems that malware researchers run into with such backdoor Trojans may include the theft of highly confidential information, the use of advanced anti-security attacks, the installation of other threats and, occasionally, even industrial sabotage that destroys the contents of the affected PC's hard drive.

Keeping Backdoor.Win32.Miancha Dangers from Exploding in Your Face

While the incident at Monju since been resolved, the consequences of allowing criminals to have remote computer access to a functioning nuclear facility are, obviously, less than pleasant to contemplate. Employees at the nuclear plant have offered limited information, due to the ongoing nature of investigation into the security breach. However, malware experts estimate that initial exposure easily could have been originated by a fusion of improper Internet access and poor file-downloading habits on the part of a single employee. Alternately, the use of additional PC threats could have allowed Backdoor.Win32.Miancha to be distributed through removable devices such as USB drives.

Sensationalism aside, Backdoor.Win32.Miancha is no more or less threatening than any other backdoor Trojan worthy of the title and should be treated as a highly invasive and sophisticated PC threat. In removing Backdoor.Win32.Miancha, malware researchers advise the full use of any available anti-malware tools supported by common security practices (such as restarting in Safe Mode before scanning your computer). Additional measures may be necessary to protect any information already stolen by Backdoor.Win32.Miancha, along with all other, potential security risks.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

GoMPLAYER_JPSETUP.EXE

File name: GoMPLAYER_JPSETUP.EXE
File type: Executable File
Mime Type: unknown/EXE
Group: Malware file

GOMPLAYERBETASETUP_JP.EXE

File name: GOMPLAYERBETASETUP_JP.EXE
File type: Executable File
Mime Type: unknown/EXE
Group: Malware file

Additional Information

The following URL's were detected:

http://sch-s.pdf2docconvert.com/query