Deep#Door Stealer: Stealthy Python Backdoor and Credential Stealer Leveraging Tunneling, Multi-Layer Persistence, and In-Memory Surveillance Capabilities

SOC Prime Team

Deep#Door Stealer: Stealthy Python Backdoor and Credential Stealer Leveraging Tunneling, Multi-Layer Persistence, and In-Memory Surveillance Capabilities

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

The report examines Deep#Door, a stealthy Python-based backdoor delivered through an obfuscated batch loader that embeds and reconstructs its malicious payload at runtime. The malware uses a public TCP tunneling service for command-and-control, sets up several persistence mechanisms, weakens Windows security controls, and supports broad surveillance and credential-theft activity. It also performs detailed environment checks to evade sandboxes and analysts, while relying on in-memory API patching to stay concealed during execution.

Investigation

Securonix researchers mapped the full infection chain from the initial batch script to payload extraction, reconstruction, and execution of the final Python RAT. Their analysis identified abuse of bore.pub for tunneling, dynamically generated ports, and a custom authentication sequence used for operator access. The report also detailed the malware’s defense-evasion methods, persistence techniques, system discovery routines, and data exfiltration behavior.

Mitigation

Defenders should closely monitor script execution, enable PowerShell logging, detect unauthorized changes to Microsoft Defender and firewall settings, and audit startup entries, Run keys, and related persistence locations. Network monitoring should also focus on outbound connections to bore.pub and unusual high-port activity. EDR tooling capable of detecting API patching and in-memory tampering can further improve visibility into this threat.

Response

If Deep#Door activity is detected, isolate the affected endpoint immediately, terminate the malicious Python process, remove all persistence mechanisms including startup scripts, Run keys, and WMI subscriptions, and restore modified Defender and logging settings. Security teams should also perform memory and forensic analysis to identify hidden implants and assess credential theft exposure, while blocking network communication to bore.pub.

"graph TB %% Class Definitions Section classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#ccccff %% Nodes Definitions action_user_execution["Action – T1204 User Execution: Victim runs malicious batch file install_obf.bat"] class action_user_execution action tool_batch_file["Tool – Name: install_obf.bat Description: Batch script that launches the loader"] class tool_batch_file tool action_obfuscation["Action – T1027 Obfuscated Files or Information: Extracts base64/XOR encoded Python payload (svc.py) via selfu2011referencing PowerShell regex"] class action_obfuscation action tool_powershell["Tool – Name: PowerShell Description: Used to parse the batch file and decode the embedded payload"] class tool_powershell tool tool_python["Tool – Name: Python Description: Executes the decoded svc.py payload"] class tool_python tool action_defense_evasion_disable["Action – T1562.001 Disable or Modify Tools / T1562.004 Disable or Modify System Firewall / T1562.008 Disable or Modify Cloud Logs: Disables Windows Defender, PowerShell logging, SmartScreen and firewall logging"] class action_defense_evasion_disable action tool_setmp["Tool – Name: Set-MpPreference Description: Powershell cmdlet to change Defender settings"] class tool_setmp tool tool_netsh["Tool – Name: netsh advfirewall Description: Modifies Windows firewall rules and logging"] class tool_netsh tool action_indicator_removal["Action – T1070.001 Clear Windows Event Logs and T1070.006 Timestomp: Stops and clears EventLog/Sysmon services and alters file timestamps"] class action_indicator_removal action action_persistence_runkey["Action – T1547.001 Registry Run Keys/Startup Folder and T1053 Scheduled Task/Job: Drops SystemServices.vbs to Startup folder, creates Run key and a scheduled task as fallback"] class action_persistence_runkey action tool_vbs_startup["Tool – Name: SystemServices.vbs Description: VBS script placed in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup"] class tool_vbs_startup tool action_credential_access["Action – T1003 OS Credential Dumping, T1552.004 Private Keys, T1552.001 Credentials In Files, T1555 Password Stores, T1555.005 Password Managers: Harvests browser passwords, Windows Credential Manager, SSH keys, cloud tokens"] class action_credential_access action action_collection["Action – T1056.001 Keylogging, T1113 Screen Capture, T1125 Video Capture, T1123 Audio Capture, T1115 Clipboard Data: Captures keystrokes, screenshots, webcam video, microphone audio and clipboard"] class action_collection action action_discovery["Action – T1082 System Information Discovery, T1518 Software Discovery, T1057 Process Discovery, T1046 Network Service Discovery, T1018 Remote System Discovery, T1526 Cloud Service Discovery: Gathers OS, hardware, software, process, network and cloud configuration data"] class action_discovery action action_defense_evasion_reflective["Action – T1620 Reflective Code Loading and T1497.003 Virtualization/Sandbox Evasion: Time Based: Detects debuggers, virtual machines and sandbox characteristics and aborts execution"] class action_defense_evasion_reflective action action_c2_tunneling["Action – T1572 Protocol Tunneling: Establishes encrypted tunnel via public service bore.pub, performs dynamic port scanning and challengeu2011response authentication"] class action_c2_tunneling action action_exfiltration["Action – T1041 Exfiltration Over C2 Channel and T1048.002 Exfiltration Over Alternative Protocol: Asymmetric Encrypted Nonu2011C2: Sends harvested data through the tunneled channel"] class action_exfiltration action action_impact_forkbomb["Action – T1499.002 Service Exhaustion Flood: Executes a fork bomb to consume system resources"] class action_impact_forkbomb action %% Connections showing attack flow action_user_execution –>|executes| tool_batch_file tool_batch_file –>|contains| action_obfuscation action_obfuscation –>|uses| tool_powershell tool_powershell –>|decodes and launches| tool_python tool_python –>|performs| action_defense_evasion_disable action_defense_evasion_disable –>|uses| tool_setmp action_defense_evasion_disable –>|uses| tool_netsh action_defense_evasion_disable –>|leads to| action_indicator_removal action_indicator_removal –>|precedes| action_persistence_runkey action_persistence_runkey –>|drops| tool_vbs_startup action_persistence_runkey –>|enables| action_credential_access action_credential_access –>|enables| action_collection action_collection –>|feeds data to| action_discovery action_discovery –>|supports| action_defense_evasion_reflective action_defense_evasion_reflective –>|establishes| action_c2_tunneling action_c2_tunneling –>|carries| action_exfiltration action_exfiltration –>|triggers| action_impact_forkbomb "

Deep#Door Stealer: Stealthy Python Backdoor and Credential Stealer Leveraging Tunneling, Multi-Layer Persistence, and In-Memory Surveillance Capabilities

Summary

Investigation

Mitigation

Response

Attack Flow

Detections

Possible Persistence Points [ASEPs – Software/NTUSER Hive] (via registry_event)

Suspicious Powershell Strings (via cmdline)

Call Suspicious .NET Classes/Methods from Powershell CommandLine (via process_creation)

Possible Remote System Discovery or Connectivity Check (via cmdline)

Possible Account or Group Enumeration / Manipulation (via cmdline)

Possible Timeout Usage for Delay Execution (via cmdline)

LOLBAS WScript / CScript (via process_creation)

Disable Windows Defender Realtime Monitoring and Other Preferences Changes (via cmdline)

Suspicious Powershell Strings (via powershell)

Windows Defender Preferences Suspicious Changes (via powershell)

Suspicious Binary / Scripts in Autostart Location (via file_event)

IOCs (HashSha256) to detect: Deep#Door Stealer: Stealthy Python Backdoor and Credential Stealer Leveraging Tunneling, Multi-Layer Persistence, and In-Memory Surveillance Capabilities

Detect C2 Communication via Public TCP Tunneling Service [Windows Network Connection]

PowerShell Command for Embedded Python Payload Extraction [Windows Powershell]

Detection of Deep#Door Stealthy Python Backdoor Deployment [Windows Process Creation]

Detection of Bore.pub TCP Tunneling Service Usage for C2 Communications [Windows Network Connection]

Windows Defender Real-Time and Behavior Monitoring Disabled [Windows Powershell]

Deep#Door Obfuscated Batch Script Execution [Windows Process Creation]

PowerShell Command Disabling Windows Defender Features [Windows Powershell]

Detection of Deep#Door Stealthy Python Backdoor Execution [Windows Process Creation]

Detection of Stealth C2 Communication via bore.pub [Windows Network Connection]

Deep#Door Stealer Detection Using PowerShell and Firewall Tampering [Windows Powershell]

Simulation Execution