Beware the SparroWock: The backdoor that bites, the commands that catch

Immediate Actions

Key Takeaways

• SparroWocky targets government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.
• The loader uses a custom file format with magic value 0x11328712 and RC4 encryption for payload decryption.
• SparroWocky incorporates open-source code from Mbed TLS, MinHook, and a COFF Loader directly into its codebase.
• The backdoor hooks CreateThread to spoof thread start addresses, using AnimateWindow as a trampoline.
• Self-deletion is achieved via a batch script that force-deletes the loader, payload, and itself.

Attack Chain

1. Initial Access: Exploit public-facing applications like Exchange (ProxyLogon) to gain network entry
2. Execution: Deploy trident loader (legitimate EXE, malicious DLL, encrypted .dat payload) via DLL side-loading
3. Defense Evasion: Reflectively load payload in memory after stripping MZ/PE headers; use SilentMoonwalk for stack spoofing
4. Persistence: Create Windows service (ProcAuditManager) or registry Run key (SnapCart) depending on privileges
5. Command and Control: Establish TLS connection to C&C server on port 443 or 8080; use RC4 for message encryption
6. Exfiltration: Collect files and screenshots, encrypt with RC4, and exfiltrate over the C2 channel

Affected Systems

• Microsoft Windows endpoints
• Government organizations in Latin America
• Public health sector in Guatemala
• Telecommunications sector in Puerto Rico
• Maritime transportation in Venezuela

Vulnerabilities (CVEs)

Detection Availability

No detection rules or queries are published in the source article.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Network connection logs
• DNS logs
• Windows Security Event ID 4698
• Sysmon Event ID 7 (Image Load)
• Sysmon Event ID 8 (CreateRemoteThread)

Key Behavioral Indicators

• Service named ProcAuditManager with description 'Tracks process creation,'
• Registry Run key value named SnapCart under HKLM or HKCU
• Named pipe .\.\pipe\ccpipe created by suspicious processes
• Mutex named MyMutexName used for process synchronization
• Network connections to C2 IPs on port 443 or 8080
• Batch scripts deleting multiple DLLs and executables forceably

Control Gaps

• Memory scanning may miss reflectively loaded payloads with stripped PE headers
• Stack-based EDR telemetry may be spoofed by SilentMoonwalk implementation
• API hashing prevents static analysis of imported functions

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Patch and monitor public-facing Exchange servers for ProxyLogon exploitation
• Inspect and restrict outbound traffic on ports 443 and 8080 to unknown IP ranges
• Implement TLS inspection for traffic to high-risk regions

User Protection

• Deploy endpoint detection rules for DLL side-loading anomalies
• Enable memory scanning features in EDR to detect reflective loading
• Monitor for unauthorized creation of services or registry Run keys

Security Awareness

• Brief SOC analysts on FamousSparrow targeting trends in Latin America
• Report suspicious service names with generic descriptions to security teams

MITRE ATT&CK Mapping

Plain-Language Summary

A China-linked hacker group called FamousSparrow has been attacking government agencies across Latin America since mid-2025. They are using a new, stealthy backdoor program called SparroWocky that can take screenshots, steal files, and run commands while actively hiding from security software. Organizations in the region should check network logs for connections to the listed IP addresses and audit systems for unauthorized services or DLLs.

Additional IOCs

• Ips:
  • 91[.]148[.]134[.]115 - SparroWocky C&C server
  • 130[.]94[.]101[.]82 - SparroWocky C&C server
  • 140[.]99[.]164[.]199 - SparroWocky C&C server
  • 149[.]104[.]87[.]228 - SparroWocky C&C server
  • 149[.]104[.]90[.]203 - SparroWocky C&C server
  • 216[.]238[.]92[.]2 - SparroWocky C&C server
  • 216[.]238[.]105[.]53 - SparroWocky C&C server
  • 216[.]238[.]121[.]164 - SparroWocky C&C server
• File Hashes:
  • 44F0A22B143B79FA760BF31E14C8FFF714C8A2A1 (SHA1) - SparroWocky backdoor payload (v1.8)
  • 3209689E509205CCDB7E (SHA1) - SparroWocky loader (winfsp-x64.dll)
  • 52C6646759CF6037BB17 (SHA1) - SparroWocky loader (winfsp-x64.dll)
  • 99E7070B5AF24A0FE1E6 (SHA1) - SparroWocky loader (DukeQt.dll)
  • 9AA9FF61BC63CCAB907 (SHA1) - SparroWocky backdoor payload
• Registry Keys:
  • SOFTWARE\Microsoft\Windo - Registry Run key for persistence (SnapCart value)
• File Paths:
  • C:\Windows\System32\en-US\ - Path used to load MUI files for host process camouflage
• Command Lines:
  • Purpose: Self-deletion of backdoor components | Tools: cmd.exe | Stage: Defense Evasion | del "<filepath>" /f /q
  • Purpose: Execution of arbitrary commands via cmd.exe | Tools: cmd.exe | Stage: Execution | cmd.exe /c <command>
• Other:
  • MyMutexName - Mutex used for instance synchronization
  • MyEventName - Event used for instance synchronization
  • MySharedMemName - Shared memory block for instance synchronization
  • ProcAuditManager - Service name used for persistence
  • SnapCart - Registry value name used for persistence
  • acdbenus - Mbed TLS DRBG personalization string
  • 0x11328712 - Magic value for encrypted payload file header
  • \\.\pipe\ccpipe - Named pipe for process I/O redirection