Threat feed

Sirius backdoor FedEx fileless

Sirius backdoor: Korean FedEx-invoice PDFs launch a fileless chain that patches ETW, hollows trusted processes via Early Bird APC, and persists through OS resets

Posted · Updated · Spectrum Delta Research Team

Summary

Trellix (Oct 26) documents a priority-customer escalation delivering a previously undocumented variant of the Sirius backdoor - the same family Group-IB (Oct 22) documents as the 'SiriusQT' MaaS RAT (config marker <<SIRIUS_STUB_CONFIG>>, default port 4449). A Korean-language spear-phish posing as a FedEx tax invoice (217,740 KRW) carries a ZIP with a blank PDF whose /OpenAction /Launch object spawns hidden encoded PowerShell. An AES-CBC/GZip in-memory unpacker reflectively loads a .NET Stage 1; RC4 with a SHA256-derived key and a 3-to-1 byte de-interleaving trick rebuild the Stage 2 injector, which patches ntdll!EtwEventWrite to blind EDR/AV, downloads zeus.dat, and hollows msbuild.exe or svchost.exe via Early Bird APC injection (NtQueueApcThread). The VC++ backdoor beacons 185.114.206.45:4449 and pairs HVNC, SOCKS5 pivoting, Chromium credential harvesting and crypto-clipboard swapping with a persistence matrix that includes Windows provisioning packages (.ppkg) surviving full OS resets.

Breakdown

Adversary

Unnamed eCrime operators

Procedures (8)

  1. PDF /Launch spawns hidden encoded PowerShell

    FedEx-invoice PDF /Launch executes PowerShell

    Logs

    • Windows process creation · EID 1/4688: Acrobat.exe→powershell.exe hidden -ep BYPaSS -EncodedCommand
    • PowerShell script block logging · EID 4103/4104: AES-CBC/GZip unpacker one-liner; Reflection.Assembly Load

    Detectors

    • Suspicious PDF Reader Child Process · Acrobat.exe/AcroRd32.exe spawning powershell.exe or built-in utilities
    • Suspicious PowerShell Invocations - Specific · EID 4104 script block with ' -w '+hidden+-ep+bypass+-Enc (ae7fbf8e)
Click to expand remaining (7) procedures

  1. AES/GZip unpacker reflectively loads .NET stage in memory

    Fileless .NET staging via reflection

    • T1620Reflective Code Loading

    Logs

    • PowerShell script block logging · EID 4103/4104: AES-CBC/GZip unpacker one-liner; Reflection.Assembly Load

    Detectors

    • Suspicious PowerShell Invocations - Specific · EID 4104 script block with ' -w '+hidden+-ep+bypass+-Enc (ae7fbf8e)

  2. Injector patches ntdll!EtwEventWrite to blind ETW

    ETW patching blinds endpoint sensors

    • T1562.002

    Logs

    • Windows process creation · EID 1/4688: Acrobat.exe→powershell.exe hidden -ep BYPaSS -EncodedCommand

    Detectors

    No known detector

  3. Injector fetches zeus.dat and hollows trusted process

    Early Bird APC injection into msbuild/svchost

    • T1055.004Process Injection: Asynchronous Procedure Call

    Logs

    • Windows process creation · EID 1/4688: Acrobat.exe→powershell.exe hidden -ep BYPaSS -EncodedCommand
    • DNS / proxy / flow · Flows to dubaitechnicalservice.ae; raw TCP 185.114.206.45:4449
    • Windows process access · EID 10: VirtualAllocEx/WriteProcessMemory/NtQueueApcThread into msbuild/svchost

    Detectors

    • Uncommon Process Access Rights For Target Image · EID 10 uncommon access rights into msbuild.exe/svchost.exe (a24e5861)

  4. Backdoor beacons C2 over raw TCP 4449

    Raw TCP C2 on port 4449

    • T1095Non-Application Layer Protocol

    Logs

    • DNS / proxy / flow · Flows to dubaitechnicalservice.ae; raw TCP 185.114.206.45:4449

    Detectors

    No known detector

  5. Multi-vector persistence incl. reset-surviving .ppkg

    Persistence matrix incl. OS-reset survival

    • T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

    Logs

    • Windows scheduled task · EID 4698 + EID 1: schtasks XML logon-trigger task creation
    • Windows registry · EID 12/13 + 4657: HKCU Run; HKCU\Environment logon script; BootExecute
    • Windows file creation · EID 11: SysConfig_*.ppkg; SetupComplete.cmd; logon.cmd; svchost.exe drops

    Detectors

    • Suspicious Command Patterns In Scheduled Task Creation · schtasks /create with suspicious command patterns (f2c64357)
    • CurrentVersion Autorun Keys Modification · HKCU/HKLM CurrentVersion Run key set events (20f0ee37)
    • Session Manager Autorun Keys Modification · BootExecute REG_MULTI_SZ modification in Session Manager key (046218bd)

  6. Installs as %APPDATA%\Microsoft\svchost.exe masquerade

    svchost.exe masquerade install

    • T1036.005Masquerading: Match Legitimate Resource Name or Location

    Logs

    • Windows process creation · EID 1/4688: Acrobat.exe→powershell.exe hidden -ep BYPaSS -EncodedCommand
    • Windows file creation · EID 11: SysConfig_*.ppkg; SetupComplete.cmd; logon.cmd; svchost.exe drops

    Detectors

    • Suspicious Process Masquerading As SvcHost.EXE · svchost.exe executing outside System32/SysWOW64 (be58d2e2)

  7. Adds Defender exclusions; deletes shadow copies

    Defender exclusions and recovery sabotage

    • T1562.001

    Logs

    • Windows process creation · EID 1/4688: Acrobat.exe→powershell.exe hidden -ep BYPaSS -EncodedCommand
    • Windows registry · EID 12/13 + 4657: HKCU Run; HKCU\Environment logon script; BootExecute

    Detectors

    • Windows Defender Exclusions Added - PowerShell · Set-MpPreference -Exclusion* via EID 4104 (c1344fa2)
    • Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE · reg.exe add Defender Exclusions paths (48917adc)

Indicators of compromise

Hunt only

Email SHA-256 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51 / MD5 3cc5147d1dbe295c63da958afadac6c6; ZIP SHA-256 7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105 / MD5 6ffcf5f7aa4b3b75b06bd7a7f49366a8; PDF SHA-256 6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4 / MD5 39993389e1e95ebbd55aa54058cf7b52; .NET Loader SHA-256 899fc5fae0593dd47aef9db4b51ffb5aeae27be9d1b6beb41108411baca7ef05 / MD5 64a9940fc78de8a895d968a4092ed10b; .NET Injector SHA-256 eedd60c6abfc4c18578c960ae55b177ea9ff14e8d41634c46f361cc8680df01c / MD5 62A458EB260E7AA26092DBDF9C2D8ED4; Sirius Backdoor SHA-256 d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee / MD5 e8b080c276519547e95930ab15028adb; payload URL hxxps://dubaitechnicalservice.ae/prood/zeus.dat

Durable

C2 185.114.206.45:4449 (raw TCP); config marker <<SIRIUS_STUB_CONFIG>> or resource 'Caffee_Config'; install as %APPDATA%\Microsoft\svchost.exe with %TEMP%\msupdate fallback; HKCU Run value 'Windows Update'; Startup folder WindowsUpdate.lnk and updater.vbs; logon.cmd registered under the HKCU\Environment logon-script value (userinit.exe executes it at logon); SysConfig_<CRC32_of_mutex>.ppkg under C:\Recovery\Customizations (Push-Button Reset reinstalls it); C:\Windows\Setup\Scripts\SetupComplete.cmd (SYSTEM at setup/upgrade completion); REG_MULTI_SZ BootExecute append; RUNASADMIN flag under HKCU AppCompatFlags\Layers; schtasks logon-trigger XML task with RunLevel HighestAvailable; ~88-country geofence including South Korea; Trellix detections FE_Backdoor_Win_Sirus_1/2, ENS-AV BackDoor-FFAV, NX Trojan.Sirius.IPCheck/Downloader.Sirius/Trojan.Sirius.DNS

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Sirius backdoor FedEx fileless? Bring them to the community.

Discuss in the Tradecraft Slack