A newly discovered Windows backdoor, measuring just 12 KB, demonstrates how minimal code can effectively evade detection. This malware was identified on a single corporate workstation, masquerading as Realtek audio software. Its compact size contrasts with other in-memory backdoors, yet both aim to minimize visibility.
What sets this backdoor apart is its method of concealing the command-and-control (C2) server address. Instead of using encryption or embedding the address directly, the malware stores it within a fake Windows desktop.ini file. The C2 domain is encoded by counting trailing spaces in each line of the file, making the configuration appear nearly blank during standard reviews.
Security analysts at Gen Digital uncovered this backdoor while investigating unusual Windows Management Instrumentation (WMI) persistence mechanisms. The malware’s origin remains uncertain, as the infection predates the implementation of endpoint protection on the affected system. Notably, the backdoor was found exclusively on a 64-bit Windows 7 SP1 machine, suggesting a targeted attack. However, no direct links to known threat actors or campaigns have been established.
Technical Details of the Backdoor
The backdoor’s executable is precisely 12,288 bytes and omits the standard C runtime library. It constructs the desktop.ini filename from separate fragments and accesses a file located in the ProgramData directory. After bypassing a legitimate-looking Windows header, the malware counts the number of spaces on each UTF-16 encoded line. These counts are then converted into ASCII characters to reconstruct the C2 domain.
This technique relies on obfuscation rather than robust encryption. Analysts who focus solely on readable strings or encoded data might overlook this method. Similar tactics have been observed in other malware that uses desktop.ini files to blend malicious content with normal Windows behavior.
Upon execution, the backdoor sends an ICMP echo request containing an eight-character identifier for the infected machine. If a response is received, it proceeds to send an HTTP POST request and awaits commands to execute shell commands or write files. Additionally, the malware attempts to evade file-based detection by temporarily altering the first two bytes of any downloaded executable, restoring them after renaming the file. This brief modification can hinder simple signature-based detection methods but is unlikely to bypass advanced behavior-based monitoring.
Persistence Mechanism and Detection Strategies
The malware achieves persistence through a timed WMI event subscription, monitoring the system clock for 19:50 to trigger the execution of the disguised Realtek-named executable. This method ensures the backdoor remains active even after system reboots, though it does not activate immediately upon startup.
For defenders, WMI event filters, consumers, and bindings offer valuable insights into activities that might not appear in standard startup configurations. Similar WMI-based persistence techniques have been employed in other Windows-targeted operations, highlighting the importance of thorough repository inspections during incident response.
The C2 server associated with this backdoor was registered in July 2020, with the malware compiled on December 2, 2020. The last known DNS record dates to March 2021, and the domain registration expired in July of that year. Despite this, the backdoor continued its attempts to resolve the C2 domain after each system reboot.
To detect such threats, security teams should scrutinize configuration files that feature a standard Windows header followed by lines containing only UTF-16 spaces and line endings. Zero-byte copies of these files may also indicate the presence of the malware. Additionally, monitoring for WMI filters linked to Win32_LocalTime, especially those associated with command-line consumers executing suspicious software, can aid in identifying infections. Network traffic analysis can further reveal anomalies, such as the sequence of a ping followed by HTTP communication, which deviates from typical encrypted HTTP C2 patterns used by remote-access malware.
This discovery underscores the evolving sophistication of malware designed to evade detection through minimalistic and unconventional methods. It highlights the necessity for continuous vigilance and adaptive security measures to counteract such stealthy threats.
