SparrowDoorMalware
Last reported 1 month ago, by Check Point Research5 reports
ATT&CK techniques
6 of 44 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“T1027.007”
- T1033System Owner/User Discovery
“T1033”
- T1036Masquerading
“Masquerading: Invalid Code Signature”
- T1036.001Invalid Code Signature
“T1036.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
21st September – Threat Intelligence Report“The group deployed a new backdoor called SparroWocky, replacing its long-running SparrowDoor implant and supporting persistent surveillance across victims in Latin America.”
-
FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor“FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor”
-
FamousSparrow centra sus operaciones en América Latina y despliega el nuevo backdoor SparroWocky“FamousSparrow, un grupo de ciberespionaje vinculado a China, ha centrado sus operaciones en América Latina y reemplazado SparrowDoor por SparroWocky, un nuevo backdoor con capacidades avanzadas de evasión.”
-
Beware the SparroWock: The backdoor that bites, the commands that catch“…public report on FamousSparrow revealed that this China-aligned APT group had developed two new versions of its custom backdoor named SparrowDoor.”
-
Malware analysis report on SparrowDoor malware“Malware analysis report on SparrowDoor malware”
Indicators in its reports
named in the reports above- 44f0a22b143b79fa…fff714c8a2a1in 2 reports
- 216.238.110[.]120in 2 reports
- 3209689e509205cc…407ddc23cac1in 2 reports
- 52c6646759cf6037…1c4bd794532fin 2 reports
- 99e7070b5af24a0f…b03cb385e91fin 2 reports
- 9aa9ff61bc63ccab…c980ca9ddc8cin 2 reports
- 38.54.57[.]17in 2 reports
- 38.60.197[.]55in 2 reports
- 38.60.209[.]106in 2 reports
- 38.60.224[.]51in 2 reports
- 38.60.224[.]235in 2 reports
- 38.60.241[.]65in 2 reports
- 38.60.241[.]127in 2 reports
- 38.60.241[.]193in 2 reports
- 77.111.101[.]40in 2 reports
- 91.148.134[.]115in 2 reports
- 130.94.101[.]82in 2 reports
- 140.99.164[.]199in 2 reports
- 149.104.87[.]228in 2 reports
- 149.104.90[.]203in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.