DEEP#DOOR

MITRE ATT&CK Matrix Tactics Techniques Initial Access T1566 – Phishing

persistence achieved through registry run keys, scheduled tasks, and startup folder entries

This is achieved using the following PowerShell command: powershell -NoP -Command “$f=[IO.File]::ReadAllText(‘%~f0′);$m=[regex]::Match($f,'(?s)#PYTHON_START\r?\n(.+?)\r?\n#PYTHON_END’);if($m.Success){[IO.File]::WriteAllText(‘%LOCALAPPDATA%\SystemServices\svc.py’,$m.Groups[1].Value)}”

The attack chain starts with a single batch file: install_obf.bat. When executed, this script reads itself, literally parsing its own contents to extract a hidden Python payload embedded directly inside the script. The extracted file, svc.py, is then written quietly to %LOCALAPPDATA%\SystemServices\ | Once active, the implant is a fully featured remote access tool. Operators can execute shell commands...

Rather than dropping compiled binaries, the loader deploys a Python-based RAT payload (svc.py) extracted directly from the dropper script itself.

MITRE ATT&CK Matrix Tactics Techniques Initial Access T1566 – Phishing T1204 – User Execution

persistence achieved through registry run keys, scheduled tasks, and startup folder entries

Optional WMI Persistence: The malware can deploy a WMI event subscription , which triggers execution based on system events or time intervals.

persistence achieved through registry run keys, scheduled tasks, and startup folder entries

persistence achieved through registry run keys, scheduled tasks, and startup folder entries

Optional WMI Persistence: The malware can deploy a WMI event subscription , which triggers execution based on system events or time intervals.

persistence achieved through registry run keys, scheduled tasks, and startup folder entries

MITRE ATT&CK Matrix Tactics Techniques ... Privilege Escalation T1548.002 – Abuse Elevation Control Mechanism: Bypass User Account Control

Attacks begin with the execution of an obfuscated batch file

as well as Windows telemetry system patching capabilities

Event Log Service Disruption Stops and disables: Clears existing logs

Timestamp Stomping To blend in with legitimate system files, the malware modifies file metadata: File creation, access, and modification timestamps are altered to match trusted binaries

Once written to disk, the Python payload itself contains additional layers of encoding and obfuscation , requiring runtime decoding. 1. Base64 Decoding Function ... 2. XOR Obfuscation Routine

Discovery of Deep#Door compromise has also been complicated by virtual machine, debugging tool, and sandbox environment checks

Self-referential parsing that simulates fileless execution has been conducted by the loader ahead of delivering the backdoor

Discovery of Deep#Door compromise has also been complicated by virtual machine, debugging tool, and sandbox environment checks

before proceeding with keylogging, browser credential theft, screenshot capturing, and microphone recording

as well as SSH key and cloud authentication token siphoning for lateral movement

before proceeding with keylogging, browser credential theft, screenshot capturing, and microphone recording

as well as SSH key and cloud authentication token siphoning for lateral movement

The resulting implant operates as a fully featured Remote Access Trojan (RAT) capable of long-term persistence, espionage, lateral movement, and post-exploitation operations within compromised environments.

port_scan() scans internal or external hosts to identify reachable services and potential pivot targets.

Process Enumeration Scans running processes for analysis tools such as: Wireshark Procmon x64dbg IDA Burp Suite

Hardware Fingerprinting Uses PowerShell queries (WMI/CIM) to inspect: BIOS version strings Manufacturer and model Baseboard details

get_ssh_keys() scans user directories for private SSH keys used for remote access.

Discovery of Deep#Door compromise has also been complicated by virtual machine, debugging tool, and sandbox environment checks

Discovery of Deep#Door compromise has also been complicated by virtual machine, debugging tool, and sandbox environment checks

before proceeding with keylogging, browser credential theft, screenshot capturing, and microphone recording

before proceeding with keylogging, browser credential theft, screenshot capturing, and microphone recording

clipmon_start() monitors clipboard changes to capture copied sensitive data such as passwords or tokens.

before proceeding with keylogging, browser credential theft, screenshot capturing, and microphone recording

webcam_snap() accesses connected cameras using multiple fallback methods (OpenCV, DirectShow, or native APIs).

MITRE ATT&CK Matrix ... Command and Control T1071.001 – Application Layer Protocol: Web Protocols

the backdoor, which communicates with attacker infrastructure using a public TCP tunneling service

Communicates over raw TCP tunneled via bore.pub (no HTTP/DNS artifacts)

The backdoor communicates with attacker infrastructure via bore.pub, a tunneling service that allows external operators to reach internal systems without exposing traditional C2 infrastructure.

After successful authentication, the implant enters a persistent command loop ... executes them locally, and returns results via a custom TCP-based protocol

MITRE ATT&CK Matrix ... Exfiltration T1567 – Exfiltration Over Web Service

Deep#Door was also observed to enable boot record overwrites and system crashes

Attacks begin with the execution of an obfuscated batch file that deactivates Windows security controls prior to embedded Python payload extraction

Set-MpPreference -DisableRealtimeMonitoring $true Set-MpPreference -DisableBehaviorMonitoring $true Set-MpPreference -DisableBlockAtFirstSeen $true Set-MpPreference -DisableIOAVProtection $true

Firewall Logging Suppression The loader disables Windows Firewall logging using: netsh advfirewall set allprofiles logging droppedconnections disable

Firewall Logging Suppression The loader disables Windows Firewall logging using: netsh advfirewall set allprofiles logging droppedconnections disable netsh advfirewall set allprofiles logging allowedconnections disable