SparrowDoor is a malware family functioning as a persistent loader and backdoor. The analyzed variant, reported by ESET in 2021 and found on a UK network, enhances the original with additional features including clipboard logging, antivirus detection evasion, inline hooking of Windows API calls, and token impersonation to facilitate privilege escalation. It communicates with its C2 server using XOR encoding layered under HTTPS. The NCSC UK report provides technical details, indicators of compromise, and detection rules to aid defenders.

The malware enables attackers to maintain long-term access to compromised systems, evade antivirus detection, capture sensitive clipboard data, and impersonate tokens to escalate privileges. This can lead to unauthorized data access, system manipulation, and potential lateral movement within affected networks. However, no widespread exploitation beyond the reported incident is documented.

No official patch or fix is available for this malware. The NCSC UK provides detection rules, indicators of compromise, and YARA signatures to identify and respond to infections. Organizations should apply these detection resources and monitor for signs of SparrowDoor activity. Standard incident response procedures for malware infections should be followed upon detection.