Fake FedEx invoices install Sirius Backdoor through blank PDFs
Original title: Hackers Use Fake FedEx Invoices to Deploy Sirius Backdoor and Evade Windows Security
A Korean-language lure claims 217,740 KRW is due; the PDF launches PowerShell that loads the backdoor only in memory.
Trellix says attackers email billing staff fake FedEx tax invoices that carry Fedex_tax_receipt.zip and a blank PDF. Opening it can run PowerShell, which decrypts a .NET loader in memory, injects later stages, and downloads Sirius from dubaitechnicalservice.ae. The backdoor patches ETW, persists across resets, and can steal Chromium credentials, watch webcams, proxy traffic, and alter crypto addresses on the clipboard. Trellix published indicators on October 26, 2026.
Unconfirmed: Trellix calls this a previously undocumented Sirius variant; no threat group is named.
- The subject line is “[FedEx] A tax invoice has been issued.”
- Final payload zeus.dat is fetched from dubaitechnicalservice.ae; C2 is 185.114.206.45:4449.
- With admin rights it drops a provisioning package under C:\Recovery\Customizations.
- Without admin rights it writes updater.vbs to Startup and may sideload user32.dll.
Impact: Remote control, credential theft, spying, and clipboard wallet swaps
- 1.Enable the Defender ASR rule blocking Adobe Reader from creating child processes.
- 2.Enforce PowerShell Constrained Language Mode and log Script Block Event ID 4104.
- 3.Flag PDF readers that launch PowerShell and review Defender exclusions.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1059.001 PowerShellT1055 Process InjectionT1562.001 Disable or Modify ToolsT1547.001 Registry Run Keys / Startup Folder
- Vendors
- Microsoft
- Products
- WindowsAdobe Reader
- Malware
- Sirius Backdoor
- Organizations
- Trellix
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.114.206.45 | echnicalservice.ae/prood/zeus.dat Final payload download C2 185.114.206.45:4449 Command-and-control server Note: IP addresses and doma |
| md5 | 39993389e1e95ebbd55aa54058cf7b52 | b93ec09cc2beeb35ee8bdb401d7645469dca105 ZIP archive PDF MD5 39993389e1e95ebbd55aa54058cf7b52 Weaponized PDF PDF SHA-256 6da827caff789c1c33dd9ad380c61054 |
| md5 | 3cc5147d1dbe295c63da958afadac6c6 | of compromise (IoCs):- Type Indicator Description Email MD5 3cc5147d1dbe295c63da958afadac6c6 Phishing email Email SHA-256 87aafaa8bb6444bae4d2ef82e395c4 |
| md5 | 62a458eb260e7aa26092dbdf9c2d8ed4 | e9d1b6beb41108411baca7ef05 Stage 1 loader .NET Injector MD5 62A458EB260E7AA26092DBDF9C2D8ED4 Stage 2 injector .NET Injector SHA-256 eedd60c6abfc4c18578c |
| md5 | 64a9940fc78de8a895d968a4092ed10b | d90678db527c4f5bdf5012e305d4 Weaponized PDF .NET Loader MD5 64a9940fc78de8a895d968a4092ed10b Stage 1 loader .NET Loader SHA-256 899fc5fae0593dd47aef9db4 |
| md5 | 6ffcf5f7aa4b3b75b06bd7a7f49366a8 | c46e85daf468a66754169b1e3d762ba04f51 Phishing email ZIP MD5 6ffcf5f7aa4b3b75b06bd7a7f49366a8 ZIP archive ZIP SHA-256 7ec38100faffb910ece1f379cb93ec09cc2 |
| md5 | e8b080c276519547e95930ab15028adb | 1634c46f361cc8680df01c Stage 2 injector Sirius Backdoor MD5 e8b080c276519547e95930ab15028adb Final backdoor Sirius Backdoor SHA-256 d6802fce5b918ed247ba |
| sha256 | 6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4 | 39993389e1e95ebbd55aa54058cf7b52 Weaponized PDF PDF SHA-256 6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4 Weaponized PDF .NET Loader MD5 64a9940fc78de8a895d968a4092e |
| sha256 | 7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105 | D5 6ffcf5f7aa4b3b75b06bd7a7f49366a8 ZIP archive ZIP SHA-256 7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105 ZIP archive PDF MD5 39993389e1e95ebbd55aa54058cf7b52 Weapon |
| sha256 | 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51 | c5147d1dbe295c63da958afadac6c6 Phishing email Email SHA-256 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51 Phishing email ZIP MD5 6ffcf5f7aa4b3b75b06bd7a7f49366a8 ZIP |
| sha256 | 899fc5fae0593dd47aef9db4b51ffb5aeae27be9d1b6beb41108411baca7ef05 | c78de8a895d968a4092ed10b Stage 1 loader .NET Loader SHA-256 899fc5fae0593dd47aef9db4b51ffb5aeae27be9d1b6beb41108411baca7ef05 Stage 1 loader .NET Injector MD5 62A458EB260E7AA26092DBDF9C |
| sha256 | d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee | 9547e95930ab15028adb Final backdoor Sirius Backdoor SHA-256 d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee Final backdoor URL hxxps://dubaitechnicalservice.ae/prood/z |
| sha256 | eedd60c6abfc4c18578c960ae55b177ea9ff14e8d41634c46f361cc8680df01c | 7AA26092DBDF9C2D8ED4 Stage 2 injector .NET Injector SHA-256 eedd60c6abfc4c18578c960ae55b177ea9ff14e8d41634c46f361cc8680df01c Stage 2 injector Sirius Backdoor MD5 e8b080c276519547e95930 |
| url | https://dubaitechnicalservice.ae/prood/zeus.dat | aa0545a8120cfbc3734b1c37794c4e381862d4ee Final backdoor URL hxxps://dubaitechnicalservice.ae/prood/zeus.dat Final payload download C2 185.114.206.45:4449 Command-and-c |
From the original article
3 min read at cybersecuritynews.com
Hackers are sending fake FedEx tax invoices to trick users into installing a stealthy backdoor on Windows. The malware, called Sirius Backdoor, hides inside a blank PDF and loads its main code directly into memory, which leaves very few traces on the hard drive. The emails target people who handle bills and payments.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.