Executive Summary
Securonix Threat Research has identified Deep#Door, a modular Python-based backdoor framework that employs a unique self-contained delivery mechanism. The infection starts with an obfuscated batch script (install_obf.bat) that extracts an embedded Python payload (svc.py) directly from its own code, bypassing traditional network-based payload delivery detections. The malware systematically disables host-based security controls, including Windows Defender and PowerShell logging, before establishing persistence via registry keys, startup folders, and WMI subscriptions.
Technically, Deep#Door is notable for its use of the public TCP tunneling service bore[.]pub, which allows the attacker to maintain a resilient C2 channel without dedicated server infrastructure. The implant features extensive surveillance capabilities—such as keylogging, audio/video capture, and screen monitoring—alongside robust credential harvesting modules for browsers, cloud providers (AWS, Azure, GCP), and SSH keys. Its advanced evasion suite includes AMSI/ETW patching, ntdll unhooking, and in-memory command-line wiping.
This threat poses a significant risk for long-term espionage and data theft. The modular nature of the Python implant, combined with destructive capabilities like MBR overwriting, makes it a versatile tool for both information collection and potentially disruptive post-exploitation activities.