Saturday, July 13, 2024
EHA

A Backdoor Called “BackDoor.Dande” Infected Drugstores and Pharmaceutical Companies Computers

The new investigation revealed that “Backdoor.Dande” Trojan Attack Drugstores and pharmaceutical companies computer systems and open a Backdoor with Eprica applications Components.

This Trojan Loaded as an Eprica Applications Components but it’s not limited the infection and also embedded with earlier versions that installed on that Programs.

According to DR.Web Recent Reseach, Eprica Components was Downloaded and launch its Backdoor into the Target Computer systems and this is software component to analyze drug prices and choose the best suppliers.

This Trojan was FIrst Reported on 2011 By Dr.web  and it was Developed to steal the medication procurement information from users of online drug ordering systems.

Past several years Researchers Following this Trojan and identified its infection method which made a huge impact on pharmaceutical industries.

Also Read  CowerSnail Trojan from the Developers of SambaCry Targeting Windows Machine

How Does “BackDoor.Dande” Works

Initially, this Backdoor is Download the Malicious components from the server that Belongs to “Spargo Tekhnologii”  and launch its infection to the Targeting computer systems.

Earlier Version of the ePrica pharmaceutical software installer Infected with BackDoor.Dande components were embedded directly with in it.

According to Dr, Web, The ePrica application has NLB and EMD plugins that are dynamic DLL libraries encrypted with a private key. Among them are the backdoor installer and modules used to collect medication procurement information.

Once Successfully Backdoor Launched, then its Automatically Retrieve the data from the databases of drugstore programs and also used to copy pharmaceutical product procurement information from 1C databases.

A module called runmod.exe helps to execute and launch this Malicious plugin. once it launched into the Target Machine, it waits for the command from the C&C server for Decrypt and launches into the Memory.BackDoor

Protek Digital Signature information “Source: DR.Web”

The indicated application component is signed with the certificate “Protek”—a group of companies that includes “Spargo Tekhnologii”, ePrica’s developer.

Once All the data copied from the database then later it will be sent to the remote server.

Even after ePrica is removed, the backdoor stays in the system and continues to spy on users. It is possible that “BackDoor.Dande” is still present on the computers of users who have removed ePrica. Researchers said.

Also Read    A Banking Trojan Called “Ursnif” Using Mouse Moments for Evasion and Decryption From Virtual Machine

Website

Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles