Avvalgi hujjatlashtirilmagan Sirius backdoor varianti ustuvor mijoz tekshiruvi davomida aniqlangan bo'lib, bu zararli kodni qonuniy Windows jarayonlari ichida yashiradigan ko'p bosqichli kampaniyani ochib beradi.
Taqdim etilgan tahlil yashirin masofaviy kirish va doimiylikni batafsil bayon qiladi, garchi u aniq parol olish qobiliyatlarini tasdiqlamasa ham.
Moliyaviy shoshilinchlik va mintaqaviy moslashtirish tanish brendlar ishonchini suiiste'mol qiladigan o'rnatilgan fishing usullarini aks ettiradi.
Ko'rinish jihatidan bo'sh hujjat PDF /OpenAction va /Launch obyektlaridan foydalanib PowerShell-ni yashirin oyna, interaktiv bo'lmagan va bajarish siyosatini chetlab o'tish argumentlari bilan chaqiradi.
Muhim jihati shundaki, bajarish jabrlanuvchining PDF o'quvchi xavfsizlik tasdiqlash so'rovini tasdiqlashiga bog'liq; ilovani ochishning o'zi buzilishni kafolatlamaydi.
Base64 bilan kodlangan PowerShell buyrug'i AES CBC rejimida o'rnatilgan blobni shifrdan yechadi, GZip orqali siqishni ochadi va natijaviy .NET yig'ilmasini aks ettirish (reflection) orqali to'g'ridan-to'g'ri xotiraga yuklaydi.
Bu an'anaviy fayl skanerlash uchun mavjud bajariladigan artefaktlarni kamaytiradi, bu faylsiz zararli dasturiy ta'minotning asosiy xususiyatidir.
Birinchi yuklovchi yana bir obfuskatsiya qatlamini qo'shadi. U RC4 kalitini XOR manipulyatsiyasi va SHA256 xeshlash orqali hosil qiladi, ichki resursni shifrdan yechadi, so'ngra har uchinchi baytni ajratib olish orqali keyingi yig'ilmani qayta quradi.
Oraliq axlatni tashlab yuborish bajariladigan MZ sarlavhasini aks ettirish orqali bajarishdan oldin tiklaydi.
Trellix tadqiqotchilari aytishicha, kampaniya FedEx to'lov xabarnomalarini taqlid qiladigan koreys tilidagi elektron pochta xabarlari bilan boshlanadi. 217 740 KRW talab qiladigan soxta soliq hisob-fakturasi qabul qiluvchilarni Fedextaxreceipt.zip fayliga yo'naltiradi, bu esa qurollangan PDF-ni o'z ichiga oladi.
Infeksiya zanjiri (Manba: Trellix).
Ikkinchi yuklovchi EtwEventWrite va NtManageHotPatch-ni yamash orqali xavfsizlik telemetriyasiga aralashishga urinadi.
Bu o'zgartirishlar uning faoliyatiga nisbatan ko'rinishni maqsad qiladi, ammo taqdim etilgan dalillar barcha Windows jurnalizatsiyasi yoki yakuniy nuqta aniqlash samarali bo'lmasligini ko'rsatmaydi.
Sirius backdoor varianti
Keyin, injektor dubaitechnicalservice[.]ae dan zeus.dat-ni oladi. Uning yuklab olish tartibi bir nechta .NET tarmoq interfeyslarini qo'llab-quvvatlaydi, RC4 bilan shifrlangan URL esa binar ichida manzilni yashiradi.
Sirius kabi mahalliy yuklamalar uchun yuklovchi qonuniy jarayonni to'xtatilgan holatda yaratadi, zararli mazmunni uning xotirasiga yozadi va asinxron protsedura chaqiruvi orqali bajarishni navbatga qo'yadi.
Xom PDF tuzilishi (Manba: Trellix).
Potensial xostlar msbuild.exe va svchost.exe ni o'z ichiga oladi, bu backdorga ko'rinish jihatidan tanish jarayon kontekstlarida ishlash imkonini beradi.
Tadqiqotchilar bu bajarish yo'lini jarayon bo'shatish (process hollowing) bilan birlashtirilgan Early Bird APC in'ektsiyasi deb ta'riflaydi.
Farq operatsion jihatdan muhim: himoyachilar bajariladigan fayl nomiga ishonish o'rniga jarayon nasl-nasabini, xotira mazmunini va bajarish xatti-harakatini tekshirishlari kerak.
Yakuniy nuqta aniqlash platformalari shubhali faoliyatni tekshirish uchun bunday jarayon va ulanish dalillarini korrelyatsiya qiladi.
Sirius — bu Microsoft Visual C++ backdori bo'lib, uning konfiguratsiyasi CaffeeConfig resursida joylashishi yoki xotirada SIRIUSSTUB_CONFIG belgisi ortidan kelishi mumkin.
Tahlil qilingan konfiguratsiya 185.114.206[.]45:4449 ni buyruq va nazorat yakuniy nuqtasi sifatida aniqlaydi va Microsoft mavzusidagi o'rnatish yo'llaridan foydalanadi.
Xatti-harakat bayroqlari mutex tekshiruvlari, yashirin fayl atributlari, geografik cheklovlar, registr Run yozuvlari, rejalashtirilgan vazifalar va Startup yorliqlarini yoqadi.
Qo'shimcha tartiblar standart profil o'zgartirish, sozlash skriptlari va tiklash ta'minot paketlari orqali doimiylikka urinishni o'z ichiga oladi, bu imtiyozlar va konfiguratsiyaga bog'liq.
Bu o'rnatish mexanizmlari shuni anglatadiki, umumiy infeksiya to'liq faylsiz deb ta'riflanmasligi kerak: xotirada joylashgan yetkazib berish diskka yozilgan yuklamalar va doimiylik artefaktlari bilan birga mavjud bo'lishi mumkin.
Xavfsizlik jamoalari uchun darhol ustuvor vazifa PDF tomonidan boshlatilgan shubhali PowerShell bajarilishini g'ayrioddiy bola jarayonlari va tashqi ulanishlar bilan korrelyatsiya qilishdir.
Ilova tekshiruvi, yakuniy nuqta monitoringi va tarmoq ko'rinishini birlashtirish faqat fayl imzolari yoki alohida infratuzilma ko'rsatkichlarini bloklashga tayanishdan ko'ra kuchliroq himoya ta'minlaydi.
IOC lar
Elektron pochta MD5 3cc5147d1dbe295c63da958afadac6c6 SHA-256 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51 Zip MD5 6ffcf5f7aa4b3b75b06bd7a7f49366a8 SHA-256 7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105 PDF MD5 39993389e1e95ebbd55aa54058cf7b52 SHA-256 6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4
Eslatma: IP manzillar va domenlar tasodifiy yechilish yoki giperhavola qilishning oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedkasi platformalarida qayta fangalang.
A previously undocumented Sirius backdoor variant during a priority customer investigation, revealing a multistage campaign that hides malicious code inside legitimate Windows processes.
The supplied analysis details stealthy remote access and persistence, although it does not establish specific password extraction capabilities.
The financial urgency and regional tailoring reflect established phishing techniques that exploit trust in familiar brands.
The visually blank document uses PDF /OpenAction and /Launch objects to invoke PowerShell with hidden window, noninteractive, and execution policy bypass arguments.
Crucially, execution depends on the victim approving thePDF reader security confirmation prompt; opening the attachment alone does not guarantee compromise.
A Base64 encoded PowerShell command decrypts an embedded blob using AES in CBC mode, decompresses it through GZip, and loads the resulting .NET assembly directly into memory through reflection.
This reduces executable artifacts available to conventional file scanning, a defining characteristic of fileless malware.
The first loader adds another obfuscation layer. It derives an RC4 key through XOR manipulation and SHA256 hashing, decrypts an internal resource, then reconstructs the next assembly by extracting every third byte.
Discarding the intervening junk restores the executable’s MZ header before reflective execution.
Trellix Researchers said that, the campaign begins with Korean-language emails impersonating FedEx billing notifications. A fraudulent tax invoice demanding 217,740 KRW directs recipients toward Fedextaxreceipt.zip, which contains a weaponized PDF.
Infection chain (Source : Trellix).
The second loader attempts to interfere with security telemetry by patching EtwEventWrite and NtManageHotPatch.
These modifications target visibility into its activity, but the supplied evidence does not demonstrate that all Windows logging or endpoint detection becomes ineffective.
Sirius backdoor variant
Next, the injector retrieves zeus.dat from dubaitechnicalservice[.]ae. Its download routine supports multiple .NET networking interfaces, while an RC4 encrypted URL obscures the destination within the binary.
For native payloads such as Sirius, the loader creates a legitimate process in a suspended state, writes malicious content into its memory, and queues execution through an asynchronous procedure call.
Raw PDF structure (Source : Trellix).
Potential hosts include msbuild.exe and svchost.exe, allowing the backdoor to operate within apparently familiar process contexts.
The researchers describe this execution path as process hollowing combined with Early Bird APC injection.
The distinction matters operationally: defenders must examine process ancestry, memory contents, and execution behavior rather than trusting an executable name.
Endpoint detection platforms correlate such process and connection evidence to investigate suspicious activity.
Sirius is a Microsoft Visual C++ backdoor whose configuration can reside in a CaffeeConfig resource or follow a SIRIUSSTUB_CONFIG marker in memory.
The analyzed configuration identifies 185.114.206[.]45:4449 as a command and control endpoint and uses Microsoft themed installation paths.
Behavior flags enable mutex checks, hidden file attributes, geographic restrictions, registry Run entries, scheduled tasks, and Startup shortcuts.
Additional routines attempt persistence through default profile modification, setup scripts, and recovery provisioning packages, depending on privileges and configuration.
These installation mechanisms also mean the overall infection should not be described as entirely fileless: memory resident delivery can coexist with payloads and persistence artifacts written to disk.
For security teams, the immediate priority is correlating suspicious PDF initiated PowerShell execution with unusual child processes and outbound connections.
Combining attachment inspection, endpoint monitoring, and network visibility provides stronger defense than relying exclusively on file signatures or blocking individual infrastructure indicators.
IOCs
Email MD5 3cc5147d1dbe295c63da958afadac6c6 SHA-256 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51 Zip MD5 6ffcf5f7aa4b3b75b06bd7a7f49366a8 SHA-256 7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105 PDF MD5 39993389e1e95ebbd55aa54058cf7b52 SHA-256 6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.