Modern threat actors are rapidly shifting away from traditional executable malware toward script-driven intrusion frameworks. These frameworks leverage native system tools such as PowerShell, batch scripts, and interpreted languages like Python to execute attacks in a way that blends seamlessly with legitimate system activity. The Deep#Door campaign is a prime example of this evolution. Instead of deploying compiled binaries, attackers rely on a heavily obfuscated batch script that embeds and reconstructs a Python-based Remote Access Trojan (RAT) directly on the target system. This approach significantly reduces detection surfaces and eliminates the need for external payload downloads. Deep#Door demonstrates how attackers can combine fileless-like execution, in-memory decoding, and trusted runtime environments to maintain stealth while achieving full system compromise.
Initial Infection: Obfuscated Batch Loader Execution
The attack chain begins with the execution of an obfuscated batch file: cmd.exe /c install_obf.bat
This script serves as the primary loader, orchestrating multiple stages:
- Security control tampering
- Payload extraction
- Persistence establishment
- Command-and-control (C2) initialization
Unlike traditional malware, this loader is self-contained, embedding the full Python payload within itself. This eliminates reliance on network downloads, making detection via network monitoring significantly harder.
Embedded Payload Extraction: Self-Referential Decoding
A standout feature of Deep#Door is its self-referential extraction technique, where the batch file reads its own contents to recover the embedded Python payload.
Key Mechanism
$f=[IO.File]::ReadAllText('%~f0')
$m=[regex]::Match($f,'#PYTHON_START(.+?)#PYTHON_END')Technical Breakdown
%~f0references the currently executing script- The script reads itself into memory
- Regex extracts the payload between markers
- Payload is written to:
%LOCALAPPDATA%\SystemServices\svc.py
This technique enables single-file delivery, mimicking fileless behavior while still persisting on disk in a disguised location.
Multi-Layer Obfuscation Inside the Python Implant
Once extracted, the Python payload (svc.py) employs multiple obfuscation layers:
1. Base64 Encoding
Used to conceal configuration values such as:
- C2 domain (
bore.pub) - Authentication keys
2. XOR Obfuscation
Applies lightweight encryption to runtime data and strings.
3. Dynamic Port Generation
Instead of static ports: 41234 → 41243. This reduces static indicators and improves resilience. These layers collectively ensure that static analysis yields minimal intelligence without execution.
Stage 1: Defense Evasion and Security Tampering
Before activating the payload, Deep#Door aggressively disables security mechanisms.
Windows Defender Manipulation
- Real-time monitoring disabled
- Behavior monitoring disabled
- IOAV protection disabled
Logging Suppression
- PowerShell logging disabled
- Event logs cleared
- Firewall logging turned off
Advanced Runtime Evasion
- AMSI patching
- ETW patching
- NTDLL unhooking
This stage effectively blinds endpoint defenses, allowing subsequent operations to proceed undetected.
Stage 2: Multi-Layer Persistence Mechanisms
Deep#Door ensures long-term access through redundant persistence techniques:
Persistence Methods
- Startup folder VBScript launcher
- Registry Run keys
- Scheduled tasks
- Optional WMI event subscriptions
Watchdog Mechanism
A background thread continuously:
- Checks persistence artifacts
- Restores them if removed
This self-healing persistence makes remediation significantly more complex.
Stage 3: Advanced Environment and Sandbox Detection
Before executing malicious logic, the malware validates its environment.
Detection Techniques
Debugger Detection
IsDebuggerPresent- PEB flag inspection
- Timing-based checks
Virtual Machine Detection
- Registry artifacts
- MAC address analysis
- CPUID hypervisor checks
Sandbox Detection
- Low system resources
- Lack of user activity
- Presence of analysis tools
If suspicious conditions are detected, the malware may delay or abort execution, evading automated analysis.
Stage 4: Covert Command-and-Control via Tunneling
Instead of traditional C2 servers, Deep#Door uses bore.pub, a public TCP tunneling service.
Why This Matters
- No dedicated infrastructure required
- Traffic blends with legitimate usage
- Difficult attribution
Authentication Mechanism
- Challenge-response using SHA256
- Prevents unauthorized connections
Connection Strategy
- Multi-threaded port scanning
- Retry logic with fallback mechanisms
This design enables resilient and stealthy remote access.
Stage 5: Full Remote Access Trojan Capabilities
Once connected, the implant provides extensive control:
Core Capabilities
- Remote shell execution
- File upload/download
- Network reconnaissance
Surveillance Features
- Keylogging
- Screen capture
- Webcam and microphone access
- Clipboard monitoring
Credential Harvesting
Targets include:
- Browser credentials
- Cloud tokens
- SSH keys
- Wi-Fi credentials
Advanced Capabilities
- Reverse shell
- Port scanning
- MBR overwrite
- System crash (BSOD trigger)
This makes Deep#Door a multi-functional espionage and post-exploitation framework.
Defense Evasion Techniques Summary
Deep#Door employs a layered evasion strategy:
- Anti-debugging and sandbox detection
- Log and telemetry suppression
- Command-line wiping
- Timestamp manipulation
- Trusted process abuse
These techniques ensure both real-time stealth and forensic resistance.
Detection and Mitigation Strategies
Key Indicators to Monitor
- Self-referential script execution (
%~f0) - Suspicious PowerShell usage
- Unauthorized Defender configuration changes
- Python execution from unusual directories
Network Indicators
- Connections to
bore.pub - Sequential port scanning behavior
Persistence Indicators
- Startup folder scripts
- Registry Run keys
- WMI subscriptions
Defensive Recommendations
- Enable PowerShell logging (Event ID 4104)
- Monitor process creation logs
- Deploy EDR with API monitoring
- Conduct proactive threat hunting
Conclusion: A New Generation of Stealth Malware
Deep#Door represents a significant shift toward modular, script-based attack frameworks that prioritize stealth, flexibility, and persistence. By combining:
- Embedded payload delivery
- Public tunneling infrastructure
- Advanced evasion techniques
the malware achieves long-term, low-visibility compromise.
Organizations must move beyond signature-based detection and adopt behavioral and correlation-driven defenses to counter such threats.
Our Opinion on the Deep#Door Threat Landscape
Deep#Door reflects a broader and concerning trend in modern cyber threats: the convergence of living-off-the-land techniques with highly modular scripting frameworks. What makes this campaign particularly dangerous is not just its technical sophistication, but its strategic design philosophy. By embedding the payload within a batch script and leveraging Python for execution, attackers significantly reduce their dependency on traditional malware infrastructure, which is often easier to detect and block.
The use of legitimate services like bore.pub further complicates detection, as it blurs the line between malicious and benign network activity. This indicates a shift toward “blended threat models”, where attackers hide in plain sight rather than relying solely on obfuscation.
From a defensive standpoint, this case highlights a critical gap: many organizations still rely heavily on signature-based detection and perimeter defenses. Deep#Door bypasses these controls entirely by operating within trusted processes and disabling visibility mechanisms early in execution.
In our view, the most effective response lies in behavioral analytics, memory inspection, and continuous threat hunting. Security teams must prioritize detecting anomalies rather than known indicators. Deep#Door is not just malware—it is a blueprint for the future of stealthy cyber intrusions.
MITRE ATT&CK Matrix
| Tactics | Techniques |
| Initial Access | T1566 – Phishing T1204 – User Execution |
| Execution | T1059.003 – Command and Scripting Interpreter: Windows Command Shell T1059.001 – Command and Scripting Interpreter: PowerShell T1059.006 – Command and Scripting Interpreter: Python |
| Persistence | T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder T1053.005 – Scheduled Task/Job: Scheduled Task T1546.003 – Event Triggered Execution: WMI Event Subscription |
| Defense Evasion | T1562.001 – Impair Defenses: Disable or Modify Tools T1562.006 – Impair Defenses: Indicator Blocking T1070.001 – Indicator Removal: Clear Windows Event Logs T1070.006 – Indicator Removal: Timestomp T1027 – Obfuscated Files or Information T1140 – Deobfuscate/Decode Files or Information T1562.004 – Disable or Modify System Firewall |
| Privilege Escalation | T1548.002 – Abuse Elevation Control Mechanism: Bypass User Account Control |
| Discovery | T1082 – System Information Discovery T1057 – Process Discovery T1083 – File and Directory Discovery T1046 – Network Service Discovery T1018 – Remote System Discovery |
| Command and Control | T1071.001 – Application Layer Protocol: Web Protocols T1572 – Protocol Tunneling T1095 – Non-Application Layer Protocol |
| Collection | T1056.001 – Input Capture: Keylogging T1113 – Screen Capture T1125 – Video Capture T1123 – Audio Capture T1115 – Clipboard Data |
| Exfiltration | T1041 – Exfiltration Over C2 Channel T1567 – Exfiltration Over Web Service |
