Securonix Details Deep#Door Backdoor’s Espionage and Disruption Capabilities
Summary
Securonix describes Deep#Door, a Python-based Windows backdoor that disables security controls, establishes layered persistence, evades analysis, and supports espionage and destructive actions.
Key points
- The reported infection chain begins with a batch script that disables Windows security controls and embeds a Python payload.
- Deep#Door establishes persistence through Run registry changes, scheduled tasks, and scripts in the Startup folder.
- The backdoor checks for debuggers, virtualization artifacts, and other signs of analysis environments.
- Reported capabilities include command execution, file manipulation, reconnaissance, keylogging, screen and audio capture, and credential and SSH key harvesting.
- Securonix says the malware can also overwrite the Master Boot Record, crash systems, and exhaust resources by spawning processes.
- Its communication methods include dynamically constructed ports and public tunneling; Securonix also cites AMSI/ETW patching, ntdll unhooking, and in-memory techniques.
Article Details
- Attack Vectors
- A batch script disables security controls, embeds and reconstructs a Python payload, and deploys the Deep#Door backdoor.
- Persistence is established through Run registry modifications, scheduled tasks, and scripts placed in the Startup folder.
- Deep#Door checks for debuggers, virtualization artifacts, and other environmental characteristics to avoid analysis environments.
- The backdoor supports shell command execution, system and network reconnaissance, keylogging, clipboard monitoring, screenshot capture, microphone and webcam access, and harvesting credentials and SSH keys.
- The malware uses public tunneling for covert command-and-control communication and dynamically constructs possible communication ports.
- The malware can overwrite the Master Boot Record, force system crashes, and exhaust resources by spawning numerous processes.
- Defensive Notes
- The batch script disables SmartScreen, firewall logging, Defender tamper protection, and Antimalware Scan Interface functions; the backdoor also uses AMSI/ETW patching and ntdll unhooking.
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe backdoor performs network reconnaissance.T1027.009 · Embedded PayloadsThe Python payload is embedded in the batch script and reconstructed by the script.T1053.005 · Scheduled TaskThe malware creates scheduled tasks as one layer of persistence.T1056.001 · KeyloggingDeep#Door includes keylogging capabilities.T1059.003 · Windows Command ShellThe backdoor provides shell command execution on Windows computers.T1059.006 · PythonThe backdoor is a Python payload reconstructed and executed by the batch script.T1082 · System Information DiscoveryThe backdoor performs system reconnaissance.T1113 · Screen CaptureDeep#Door captures screenshots.T1115 · Clipboard DataDeep#Door monitors clipboard contents.T1123 · Audio CaptureThe backdoor can access the microphone for surveillance.T1125 · Video CaptureThe backdoor can access the webcam for surveillance.T1497.001 · System ChecksDeep#Door checks for debuggers, virtualization artifacts, and environmental characteristics to avoid VMs, sandboxes, and analysis environments.T1547.001 · Registry Run Keys / Startup FolderDeep#Door establishes persistence by modifying Run registry entries and placing scripts in the Startup folder.T1552.004 · Private KeysThe malware harvests SSH keys.T1562.001 · Disable or Modify ToolsThe batch script disables security controls, and the backdoor uses AMSI/ETW patching and ntdll unhooking to evade defenses.