Asl matn EN tilida, manba saytidan olindi. Manba ↗

A previously undocumented Sirius backdoor variant during a priority customer investigation, revealing a multistage campaign that hides malicious code inside legitimate Windows processes.

The supplied analysis details stealthy remote access and persistence, although it does not establish specific password extraction capabilities.

The financial urgency and regional tailoring reflect established phishing techniques that exploit trust in familiar brands.

The visually blank document uses PDF /OpenAction and /Launch objects to invoke PowerShell with hidden window, noninteractive, and execution policy bypass arguments.

Crucially, execution depends on the victim approving thePDF reader security confirmation prompt; opening the attachment alone does not guarantee compromise.

A Base64 encoded PowerShell command decrypts an embedded blob using AES in CBC mode, decompresses it through GZip, and loads the resulting .NET assembly directly into memory through reflection.

This reduces executable artifacts available to conventional file scanning, a defining characteristic of fileless malware.

The first loader adds another obfuscation layer. It derives an RC4 key through XOR manipulation and SHA256 hashing, decrypts an internal resource, then reconstructs the next assembly by extracting every third byte.

Discarding the intervening junk restores the executable’s MZ header before reflective execution.

Trellix Researchers said that, the campaign begins with Korean-language emails impersonating FedEx billing notifications. A fraudulent tax invoice demanding 217,740 KRW directs recipients toward Fedextaxreceipt.zip, which contains a weaponized PDF.

Infection chain (Source : Trellix).

The second loader attempts to interfere with security telemetry by patching EtwEventWrite and NtManageHotPatch.

These modifications target visibility into its activity, but the supplied evidence does not demonstrate that all Windows logging or endpoint detection becomes ineffective.

Sirius backdoor variant

Next, the injector retrieves zeus.dat from dubaitechnicalservice[.]ae. Its download routine supports multiple .NET networking interfaces, while an RC4 encrypted URL obscures the destination within the binary.

For native payloads such as Sirius, the loader creates a legitimate process in a suspended state, writes malicious content into its memory, and queues execution through an asynchronous procedure call.

Raw PDF structure (Source : Trellix).

Potential hosts include msbuild.exe and svchost.exe, allowing the backdoor to operate within apparently familiar process contexts.

The researchers describe this execution path as process hollowing combined with Early Bird APC injection.

The distinction matters operationally: defenders must examine process ancestry, memory contents, and execution behavior rather than trusting an executable name.

Endpoint detection platforms correlate such process and connection evidence to investigate suspicious activity.

Sirius is a Microsoft Visual C++ backdoor whose configuration can reside in a CaffeeConfig resource or follow a SIRIUSSTUB_CONFIG marker in memory.

The analyzed configuration identifies 185.114.206[.]45:4449 as a command and control endpoint and uses Microsoft themed installation paths.

Behavior flags enable mutex checks, hidden file attributes, geographic restrictions, registry Run entries, scheduled tasks, and Startup shortcuts.

Additional routines attempt persistence through default profile modification, setup scripts, and recovery provisioning packages, depending on privileges and configuration.

These installation mechanisms also mean the overall infection should not be described as entirely fileless: memory resident delivery can coexist with payloads and persistence artifacts written to disk.

For security teams, the immediate priority is correlating suspicious PDF initiated PowerShell execution with unusual child processes and outbound connections.

Combining attachment inspection, endpoint monitoring, and network visibility provides stronger defense than relying exclusively on file signatures or blocking individual infrastructure indicators.

IOCs

Email MD5 3cc5147d1dbe295c63da958afadac6c6 SHA-256 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51 Zip MD5 6ffcf5f7aa4b3b75b06bd7a7f49366a8 SHA-256 7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105 PDF MD5 39993389e1e95ebbd55aa54058cf7b52 SHA-256 6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.