Thursday, March 28, 2024

A Backdoor Called “BackDoor.Dande” Infected Drugstores and Pharmaceutical Companies Computers

The new investigation revealed that “Backdoor.Dande” Trojan Attack Drugstores and pharmaceutical companies computer systems and open a Backdoor with Eprica applications Components.

This Trojan Loaded as an Eprica Applications Components but it’s not limited the infection and also embedded with earlier versions that installed on that Programs.

According to DR.Web Recent Reseach, EpricaĀ Components was Downloaded and launchĀ its Backdoor into the Target Computer systems and thisĀ is software component to analyze drug prices and choose the best suppliers.

This Trojan was FIrst Reported on 2011 By Dr.web  and it was Developed to steal the medication procurement information from users of online drug ordering systems.

Past several years Researchers Following this Trojan and identified its infection method which made a huge impact on pharmaceutical industries.

Also Read  CowerSnail Trojan from the Developers of SambaCry Targeting Windows Machine

How Does “BackDoor.Dande” Works

Initially, this Backdoor is Download the Malicious components from the server that Belongs to ā€œSpargo Tekhnologiiā€  and launch its infection to the Targeting computer systems.

Earlier Version of the ePrica pharmaceutical software installer Infected withĀ BackDoor.Dande components were embedded directly with in it.

According to Dr, Web, The ePrica application has NLB and EMD plugins that are dynamic DLL libraries encrypted with a private key. Among them are the backdoor installer and modules used to collect medication procurement information.

Once Successfully Backdoor Launched, then its Automatically Retrieve the data from the databases of drugstore programs and also used to copy pharmaceutical product procurement information from 1C databases.

A module called runmod.exe helps to execute and launch this Malicious plugin. once it launched into the Target Machine, it waits for the command from the C&C server for Decrypt and launches into the Memory.BackDoor

Protek Digital Signature information “Source: DR.Web”

The indicated application component is signed with the certificate ā€œProtekā€ā€”a group of companies that includes ā€œSpargo Tekhnologiiā€, ePricaā€™s developer.

Once All the data copied from the database then later it will be sent to the remote server.

Even after ePrica is removed, the backdoor stays in the system and continues to spy on users. It is possible that “BackDoor.Dande” is still present on the computers of users who have removed ePrica. Researchers said.

Also Read    A Banking Trojan Called ā€œUrsnifā€ Using Mouse Moments for Evasion and Decryption From Virtual Machine

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: Whatā€™s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles