Beware the SparroWock: The backdoor that bites, the commands that catch

Summary

China-aligned APT group FamousSparrow has deployed a new modular C++ backdoor named SparroWocky, replacing its earlier SparrowDoor implant. The malware includes advanced anti-analysis capabilities such as stack spoofing and reflective memory loading. Current activity is heavily focused on governmental organizations across Latin America.

Investigation

ESET researchers identified SparroWocky by examining its modular architecture and distinctive code traits, including references to the Jabberwocky poem. The investigation uncovered a trident loader scheme that relies on DLL side-loading and a custom payload format decrypted with RC4. Analysts also observed open-source libraries such as Mbed TLS and MinHook being used to improve stealth and functionality.

Mitigation

Organizations should enforce strict controls around DLL side-loading and monitor for suspicious service creation or modifications to registry Run keys. Advanced endpoint detection capable of identifying memory-only PE execution and stack manipulation is also important. Public-facing applications, including Exchange servers, should be patched promptly to reduce initial access opportunities.

Response

If SparroWocky activity is detected, affected systems should be isolated immediately to prevent lateral movement and command-and-control communication. Responders should perform memory forensics to identify reflectively loaded modules and investigate hijacked execution flows. Audit logs should also be reviewed for unauthorized service installation or changes to persistence mechanisms such as the SnapCart registry value.

Simulation Execution

• Attack Narrative & Commands: The adversary aims to establish a covert communication channel to a Command and Control (C2) server. To bypass simple perimeter defenses, the attacker uses a SOCKS5 proxy to tunnel traffic, making the traffic appear to originate from a legitimate proxy server rather than the infected endpoint. This action is intended to trigger the selection_http_proxy logic in the detection rule by generating logs that identify the protocol as SOCKS5 and the action as ‘allow’.

• Regression Test Script:

  # Simulation of SparroWocky C2 via SOCKS5 Proxy
  # Note: This requires a reachable proxy or a simulated listener to trigger the 'allow' log.
  
  $ProxyServer = "127.0.0.1:1080" # Assumes a local listener/proxy for simulation purposes
  $TargetUrl = "http://example.com"
  
  Write-Host "[+] Attempting to establish SOCKS5 proxy connection to simulate C2..."
  
  # Using PowerShell to force a connection through a proxy
  $proxy = New-Object System.Net.WebProxy("http://$ProxyServer")
  $wc = New-Object System.Net.WebClient
  $wc.Proxy = $proxy
  
  try {
      $wc.DownloadString($TargetUrl)
      Write-Host "[+] Connection attempted. Check firewall logs for SOCKS5/HTTP proxy activity."
  } catch {
      Write-Host "[-] Connection failed (expected if no listener is present), but telemetry should still be generated by the network stack."
  }

• Cleanup Commands:

  # Stop any local proxy listeners if they were started as part of the lab setup
  Stop-Process -Name "nc" -ErrorAction SilentlyContinue
  Stop-Process -Name "python" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete."