Malware

SparrowDoor

Indicators of Compromise 3

Filename .dat Filename ProcAuditManager Filename SnapCart

MITRE ATT&CK TTPs 15

T1013
T1013
 T1027
Obfuscated Files or Information
Defense Evasion
 T1048
Exfiltration Over Alternative Protocol
Exfiltration
 T1055
Process Injection
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1090
Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1110
Brute Force
Credential Access
 T1120
Peripheral Device Discovery
Discovery
 T1133
External Remote Services
Persistence
 T1482
Domain Trust Discovery
Discovery
 T1566
Phishing
Initial Access
 T1574.002
DLL Side-Loading
Persistence

Source Articles

Chinese hackers use SparroWocky malware in govt espionage attacks
The China-linked threat actor FamousSparrow has been conducting espionage campaigns against government organizations in Latin America since mid-2025, using a new modular C++ backdoor named SparroWocky. This malware replaces the group's previously used SparrowDoor backdoor and is deployed via DLL side-loading, with payloads RC4-encoded in .dat files. SparroWocky features advanced evasion techniques, including thread creation hooking to spoof legitimate Windows functions, in-memory code manipulation, and anti-analysis tricks, enabling command execution, file manipulation, screenshot capture, and proxy capabilities. The malware establishes persistence via a Windows service or registry key and communicates with C2 servers over ports 443 or 8080, sometimes through HTTP and SOCKS5 proxies.
bleeping-computer ·2h ago