Tuesday, February 27, 2024

A Backdoor Called “BackDoor.Dande” Infected Drugstores and Pharmaceutical Companies Computers

The new investigation revealed that “Backdoor.Dande” Trojan Attack Drugstores and pharmaceutical companies computer systems and open a Backdoor with Eprica applications Components.

This Trojan Loaded as an Eprica Applications Components but it’s not limited the infection and also embedded with earlier versions that installed on that Programs.

According to DR.Web Recent Reseach, Eprica Components was Downloaded and launch its Backdoor into the Target Computer systems and this is software component to analyze drug prices and choose the best suppliers.

This Trojan was FIrst Reported on 2011 By Dr.web  and it was Developed to steal the medication procurement information from users of online drug ordering systems.

Past several years Researchers Following this Trojan and identified its infection method which made a huge impact on pharmaceutical industries.

Also Read  CowerSnail Trojan from the Developers of SambaCry Targeting Windows Machine

How Does “BackDoor.Dande” Works

Initially, this Backdoor is Download the Malicious components from the server that Belongs to “Spargo Tekhnologii”  and launch its infection to the Targeting computer systems.

Earlier Version of the ePrica pharmaceutical software installer Infected with BackDoor.Dande components were embedded directly with in it.

According to Dr, Web, The ePrica application has NLB and EMD plugins that are dynamic DLL libraries encrypted with a private key. Among them are the backdoor installer and modules used to collect medication procurement information.

Once Successfully Backdoor Launched, then its Automatically Retrieve the data from the databases of drugstore programs and also used to copy pharmaceutical product procurement information from 1C databases.

A module called runmod.exe helps to execute and launch this Malicious plugin. once it launched into the Target Machine, it waits for the command from the C&C server for Decrypt and launches into the Memory.BackDoor

Protek Digital Signature information “Source: DR.Web”

The indicated application component is signed with the certificate “Protek”—a group of companies that includes “Spargo Tekhnologii”, ePrica’s developer.

Once All the data copied from the database then later it will be sent to the remote server.

Even after ePrica is removed, the backdoor stays in the system and continues to spy on users. It is possible that “BackDoor.Dande” is still present on the computers of users who have removed ePrica. Researchers said.

Also Read    A Banking Trojan Called “Ursnif” Using Mouse Moments for Evasion and Decryption From Virtual Machine


Latest articles

ThreatHunter.ai Stops Hundreds of Attacks in 48 Hours: Fighting Ransomware and Nation-State Cyber Threats

The current large surge in cyber threats has left many organizations grappling for security...

WordPress Plugin Flaw Exposes 200,000+ Websites for Hacking

A critical security flaw has been identified in the Ultimate Member plugin for WordPress,...

Hackers Actively Hijacking ConnectWise ScreenConnect server

ConnectWise, a prominent software company, issued an urgent security bulletin on February 19, 2024,...

Heavily Obfuscated PIKABOT Evades EDR Protection

PIKABOT is a polymorphic malware that constantly modifies its code, making it hard to...

Anonymous Sudan Promoting New DDoS Botnet: Beware

It has come to light that a group known as Anonymous Sudan is actively...

Scattered Spider: Advanced Techniques for Launching High-Profile Attacks

Scattered Spider is a threat group responsible for attacking several organizations since May 2022...

8220 Hacker Group Attacking Linux & Windows Users to Mine Crypto

In a significant escalation of cyber threats, the 8220 Gang, a notorious Chinese-based hacker group, has intensified its attacks...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles