A Backdoor Called “BackDoor.Dande” Infected Drugstores and Pharmaceutical Companies Computers

The new investigation revealed that “Backdoor.Dande” Trojan Attack Drugstores and pharmaceutical companies computer systems and open a Backdoor with Eprica applications Components.

This Trojan Loaded as an Eprica Applications Components but it’s not limited the infection and also embedded with earlier versions that installed on that Programs.

According to DR.Web Recent Reseach, Eprica Components was Downloaded and launch its Backdoor into the Target Computer systems and this is software component to analyze drug prices and choose the best suppliers.

- Advertisement -

This Trojan was FIrst Reported on 2011 By Dr.web  and it was Developed to steal the medication procurement information from users of online drug ordering systems.

Past several years Researchers Following this Trojan and identified its infection method which made a huge impact on pharmaceutical industries.

Also Read  CowerSnail Trojan from the Developers of SambaCry Targeting Windows Machine

How Does “BackDoor.Dande” Works

Initially, this Backdoor is Download the Malicious components from the server that Belongs to “Spargo Tekhnologii”  and launch its infection to the Targeting computer systems.

Earlier Version of the ePrica pharmaceutical software installer Infected with BackDoor.Dande components were embedded directly with in it.

According to Dr, Web, The ePrica application has NLB and EMD plugins that are dynamic DLL libraries encrypted with a private key. Among them are the backdoor installer and modules used to collect medication procurement information.

Once Successfully Backdoor Launched, then its Automatically Retrieve the data from the databases of drugstore programs and also used to copy pharmaceutical product procurement information from 1C databases.

A module called runmod.exe helps to execute and launch this Malicious plugin. once it launched into the Target Machine, it waits for the command from the C&C server for Decrypt and launches into the Memory.

Protek Digital Signature information “Source: DR.Web”

The indicated application component is signed with the certificate “Protek”—a group of companies that includes “Spargo Tekhnologii”, ePrica’s developer.

Once All the data copied from the database then later it will be sent to the remote server.

Even after ePrica is removed, the backdoor stays in the system and continues to spy on users. It is possible that “BackDoor.Dande” is still present on the computers of users who have removed ePrica. Researchers said.

Also Read    A Banking Trojan Called “Ursnif” Using Mouse Moments for Evasion and Decryption From Virtual Machine