A Backdoor Called “BackDoor.Dande” Infected Drugstores and Pharmaceutical Companies Computers

The new investigation revealed that “Backdoor.Dande” Trojan Attack Drugstores and pharmaceutical companies computer systems and open a Backdoor with Eprica applications Components.

This Trojan Loaded as an Eprica Applications Components but it’s not limited the infection and also embedded with earlier versions that installed on that Programs.

According to DR.Web Recent Reseach, Eprica Components was Downloaded and launch its Backdoor into the Target Computer systems and this is software component to analyze drug prices and choose the best suppliers.

This Trojan was FIrst Reported on 2011 By Dr.web  and it was Developed to steal the medication procurement information from users of online drug ordering systems.

Past several years Researchers Following this Trojan and identified its infection method which made a huge impact on pharmaceutical industries.

Also Read  CowerSnail Trojan from the Developers of SambaCry Targeting Windows Machine

How Does “BackDoor.Dande” Works

Initially, this Backdoor is Download the Malicious components from the server that Belongs to “Spargo Tekhnologii”  and launch its infection to the Targeting computer systems.

Earlier Version of the ePrica pharmaceutical software installer Infected with BackDoor.Dande components were embedded directly with in it.

According to Dr, Web, The ePrica application has NLB and EMD plugins that are dynamic DLL libraries encrypted with a private key. Among them are the backdoor installer and modules used to collect medication procurement information.

Once Successfully Backdoor Launched, then its Automatically Retrieve the data from the databases of drugstore programs and also used to copy pharmaceutical product procurement information from 1C databases.

A module called runmod.exe helps to execute and launch this Malicious plugin. once it launched into the Target Machine, it waits for the command from the C&C server for Decrypt and launches into the Memory.

Protek Digital Signature information “Source: DR.Web”

The indicated application component is signed with the certificate “Protek”—a group of companies that includes “Spargo Tekhnologii”, ePrica’s developer.

Once All the data copied from the database then later it will be sent to the remote server.

Even after ePrica is removed, the backdoor stays in the system and continues to spy on users. It is possible that “BackDoor.Dande” is still present on the computers of users who have removed ePrica. Researchers said.

Also Read    A Banking Trojan Called “Ursnif” Using Mouse Moments for Evasion and Decryption From Virtual Machine

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

View Comments

Recent Posts

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting the growing, widespread use and potential…

13 hours ago

C2A Security’s EVSec Risk Management and Automation Platform Gains Automotive Industry Favor as Companies Pursue Regulatory Compliance

In 2023, C2A Security added multiple OEMs and Tier 1s to its portfolio of customers, successful evaluations, and partnerships such…

14 hours ago

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and education. The latest update, Wireshark 4.2.4,…

17 hours ago

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered platform designed to redefine how we…

17 hours ago

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information and grant unauthorized access. It's an…

18 hours ago

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including two zero-day exploits showcased at the…

21 hours ago