EN PT-BR
← Voltar ao feed
high

Sirius backdoor variant delivered via Korean FedEx-themed phishing PDFs using process hollowing and Early Bird APC injection

1 fonte(s) · 1 atualização(ões) · publicado 27/10/2026 10:35 · coletado há 5 dias

Trellix researchers documented a previously undocumented Sirius backdoor variant during a priority customer investigation. The multistage campaign starts with Korean-language emails impersonating FedEx billing notifications and a fake tax invoice for 217,740 KRW. The lure leads to Fedex_tax_receipt.zip, which holds a weaponized PDF. The chain uses layered .NET loaders, in-memory execution and process injection to run the backdoor inside legitimate Windows processes. Execution depends on the victim approving the PDF reader security prompt.

Detalhes técnicos

  • The blank PDF uses /OpenAction and /Launch objects to start PowerShell with hidden window, noninteractive and execution policy bypass arguments.
  • A Base64-encoded command decrypts an embedded blob with AES-CBC and decompresses it with GZip. It then loads the .NET assembly into memory via reflection.
  • The first loader derives an RC4 key through XOR and SHA256, decrypts an internal resource, and rebuilds the next assembly by extracting every third byte to restore the MZ header.
  • The second loader patches EtwEventWrite and NtManageHotPatch to reduce telemetry. The article notes this does not prove that all logging or EDR is defeated.
  • The injector downloads zeus.dat from dubaitechnicalservice[.]ae, with the URL RC4-encrypted in the binary.
  • Native payloads such as Sirius are injected with process hollowing plus Early Bird APC injection into suspended legitimate processes, for example msbuild.exe and svchost.exe.
  • Sirius is a Microsoft Visual C++ backdoor. Its configuration sits in a Caffee_Config resource or after a SIRIUS_STUB_CONFIG marker in memory. The analyzed C2 is 185.114.206[.]45:4449.
  • Configuration flags enable mutex checks, hidden file attributes, geographic restrictions, registry Run entries, scheduled tasks and Startup shortcuts. Further persistence uses default profile modification, setup scripts and recovery provisioning packages.
  • The infection is not entirely fileless, because payloads and persistence artifacts are also written to disk. The analysis does not establish specific password theft capability.

Remediação

  • Correlate PDF-initiated PowerShell execution with unusual child processes and outbound connections.
  • Inspect process ancestry and memory rather than trusting executable names.
  • Combine attachment inspection, endpoint monitoring and network visibility instead of relying only on file signatures or blocking individual indicators.

Linha do tempo

  1. gbhackers.com ↗ · pub. 27/10/2026 10:35 · coletado 27/10 11:00 primeiro registro

    Sirius backdoor variant delivered via Korean FedEx-themed phishing PDFs using process hollowing and Early Bird APC injection

    ler a análise desta fonte

    Trellix researchers documented a previously undocumented Sirius backdoor variant during a priority customer investigation. The multistage campaign starts with Korean-language emails impersonating FedEx billing notifications and a fake tax invoice for 217,740 KRW. The lure leads to Fedex_tax_receipt.zip, which holds a weaponized PDF. The chain uses layered .NET loaders, in-memory execution and process injection to run the backdoor inside legitimate Windows processes. Execution depends on the victim approving the PDF reader security prompt.

    Technical Details

    • The blank PDF uses /OpenAction and /Launch objects to start PowerShell with hidden window, noninteractive and execution policy bypass arguments.
    • A Base64-encoded command decrypts an embedded blob with AES-CBC and decompresses it with GZip. It then loads the .NET assembly into memory via reflection.
    • The first loader derives an RC4 key through XOR and SHA256, decrypts an internal resource, and rebuilds the next assembly by extracting every third byte to restore the MZ header.
    • The second loader patches EtwEventWrite and NtManageHotPatch to reduce telemetry. The article notes this does not prove that all logging or EDR is defeated.
    • The injector downloads zeus.dat from dubaitechnicalservice[.]ae, with the URL RC4-encrypted in the binary.
    • Native payloads such as Sirius are injected with process hollowing plus Early Bird APC injection into suspended legitimate processes, for example msbuild.exe and svchost.exe.
    • Sirius is a Microsoft Visual C++ backdoor. Its configuration sits in a Caffee_Config resource or after a SIRIUS_STUB_CONFIG marker in memory. The analyzed C2 is 185.114.206[.]45:4449.
    • Configuration flags enable mutex checks, hidden file attributes, geographic restrictions, registry Run entries, scheduled tasks and Startup shortcuts. Further persistence uses default profile modification, setup scripts and recovery provisioning packages.
    • The infection is not entirely fileless, because payloads and persistence artifacts are also written to disk. The analysis does not establish specific password theft capability.

    Remediation

    • Correlate PDF-initiated PowerShell execution with unusual child processes and outbound connections.
    • Inspect process ancestry and memory rather than trusting executable names.
    • Combine attachment inspection, endpoint monitoring and network visibility instead of relying only on file signatures or blocking individual indicators.