New Sirius Backdoor Hides Inside Windows Processes to Steal Passwords and Evade Detection

A previously undocumented Sirius backdoor variant during a priority customer investigation, revealing a multistage campaign that hides malicious code inside legitimate Windows processes.

The supplied analysis details stealthy remote access and persistence, although it does not establish specific password extraction capabilities.

The financial urgency and regional tailoring reflect established phishing techniques that exploit trust in familiar brands.

The visually blank document uses PDF /OpenAction and /Launch objects to invoke PowerShell with hidden window, noninteractive, and execution policy bypass arguments.

Crucially, execution depends on the victim approving the PDF reader security confirmation prompt; opening the attachment alone does not guarantee compromise.

A Base64 encoded PowerShell command decrypts an embedded blob using AES in CBC mode, decompresses it through GZip, and loads the resulting .NET assembly directly into memory through reflection.

This reduces executable artifacts available to conventional file scanning, a defining characteristic of fileless malware.

The first loader adds another obfuscation layer. It derives an RC4 key through XOR manipulation and SHA256 hashing, decrypts an internal resource, then reconstructs the next assembly by extracting every third byte.

Discarding the intervening junk restores the executable’s MZ header before reflective execution.

Trellix Researchers said that, the campaign begins with Korean-language emails impersonating FedEx billing notifications. A fraudulent tax invoice demanding 217,740 KRW directs recipients toward Fedex_tax_receipt.zip, which contains a weaponized PDF.

The second loader attempts to interfere with security telemetry by patching EtwEventWrite and NtManageHotPatch.

These modifications target visibility into its activity, but the supplied evidence does not demonstrate that all Windows logging or endpoint detection becomes ineffective.

Sirius backdoor variant

Next, the injector retrieves zeus.dat from dubaitechnicalservice[.]ae. Its download routine supports multiple .NET networking interfaces, while an RC4 encrypted URL obscures the destination within the binary.

For native payloads such as Sirius, the loader creates a legitimate process in a suspended state, writes malicious content into its memory, and queues execution through an asynchronous procedure call.

Potential hosts include msbuild.exe and svchost.exe, allowing the backdoor to operate within apparently familiar process contexts.

The researchers describe this execution path as process hollowing combined with Early Bird APC injection.

The distinction matters operationally: defenders must examine process ancestry, memory contents, and execution behavior rather than trusting an executable name.

Endpoint detection platforms correlate such process and connection evidence to investigate suspicious activity.

Sirius is a Microsoft Visual C++ backdoor whose configuration can reside in a Caffee_Config resource or follow a SIRIUS_STUB_CONFIG marker in memory.

The analyzed configuration identifies 185.114.206[.]45:4449 as a command and control endpoint and uses Microsoft themed installation paths.

Behavior flags enable mutex checks, hidden file attributes, geographic restrictions, registry Run entries, scheduled tasks, and Startup shortcuts.

Additional routines attempt persistence through default profile modification, setup scripts, and recovery provisioning packages, depending on privileges and configuration.

These installation mechanisms also mean the overall infection should not be described as entirely fileless: memory resident delivery can coexist with payloads and persistence artifacts written to disk.

For security teams, the immediate priority is correlating suspicious PDF initiated PowerShell execution with unusual child processes and outbound connections.

Combining attachment inspection, endpoint monitoring, and network visibility provides stronger defense than relying exclusively on file signatures or blocking individual infrastructure indicators.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.