Sirius backdoor variant delivered by Korean FedEx-themed PDF emails
Original title: New Sirius Backdoor Hides Inside Windows Processes to Steal Passwords and Evade Detection
Trellix says a weaponized PDF launches fileless loaders that inject Sirius into suspended Windows processes after the victim approves a prompt.
Trellix researchers describe a previously undocumented Sirius backdoor variant found in a customer investigation. Korean-language emails impersonate FedEx billing notices and attach Fedex_tax_receipt.zip, whose PDF uses OpenAction and Launch objects to start hidden PowerShell only if the user accepts a reader prompt. Loaders decrypt and reflectively run .NET assemblies, then download zeus.dat and inject Sirius into a suspended process such as msbuild.exe or svchost.exe. Persistence can use registry Run keys, scheduled tasks and Startup shortcuts; C2 is listed as 185.114.206.45 on port 4449.
Unconfirmed: The write-up does not show that the variant extracts passwords or defeats all endpoint logging.
- The fake invoice demands 217,740 KRW.
- AES-CBC and RC4 stages reconstruct assemblies in memory.
- The loader patches EtwEventWrite and NtManageHotPatch.
- Config flags include mutexes, hidden files and geographic limits.
- Disk persistence means the infection is not entirely fileless.
Impact: Stealthy remote access and persistence on Windows hosts
| Product | Affected |
|---|---|
| Microsoft Windows | — |
- 1.Correlate PDF-launched PowerShell with unusual child processes and outbound connections.
- 2.Inspect process ancestry and memory rather than trusting process names.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1059.001 PowerShellT1055.012 Process HollowingT1547.001 Registry Run Keys / Startup FolderT1053 Scheduled Task/Job
- Vendors
- Microsoft
- Products
- WindowsPowerShell
- Malware
- Sirius
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dubaitechnicalservice.ae | backdoor variant Next, the injector retrieves zeus.dat from dubaitechnicalservice[.]ae. Its download routine supports multiple .NET networking i |
| ipv4 | 185.114.206.45 | FIG marker in memory. The analyzed configuration identifies 185.114.206[.]45:4449 as a command and control endpoint and uses Microsoft |
| md5 | 39993389e1e95ebbd55aa54058cf7b52 | 910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105 PDF MD5 39993389e1e95ebbd55aa54058cf7b52 SHA-256 6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5 |
| md5 | 3cc5147d1dbe295c63da958afadac6c6 | ocking individual infrastructure indicators. IOCs Email MD5 3cc5147d1dbe295c63da958afadac6c6 SHA-256 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1 |
| md5 | 6ffcf5f7aa4b3b75b06bd7a7f49366a8 | 4bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51 Zip MD5 6ffcf5f7aa4b3b75b06bd7a7f49366a8 SHA-256 7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d |
| sha256 | 6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4 | 5469dca105 PDF MD5 39993389e1e95ebbd55aa54058cf7b52 SHA-256 6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4 Note: IP addresses and domains are intentionally defanged ( |
| sha256 | 7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105 | 762ba04f51 Zip MD5 6ffcf5f7aa4b3b75b06bd7a7f49366a8 SHA-256 7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105 PDF MD5 39993389e1e95ebbd55aa54058cf7b52 SHA-256 6da827caff |
| sha256 | 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51 | rs. IOCs Email MD5 3cc5147d1dbe295c63da958afadac6c6 SHA-256 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51 Zip MD5 6ffcf5f7aa4b3b75b06bd7a7f49366a8 SHA-256 7ec38100fa |
From the original article
3 min read at gbhackers.com
A previously undocumented Sirius backdoor variant during a priority customer investigation, revealing a multistage campaign that hides malicious code inside legitimate Windows processes. The supplied analysis details stealthy remote access and persistence, although it does not establish specific password extraction capabilities.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.