MalwarePublished 25 Apr 2022

Malware analysis report on SparrowDoor malware

Source NCSC UK

Description

The SparrowDoor malware is a persistent loader and backdoor that uses XOR encoding for its command and control (C2) communication over HTTPS. A new variant was identified on a UK network in 2021, adding capabilities such as clipboard logging, antivirus detection, inline hooking of Windows API functions, and token impersonation. This malware enables attackers to maintain persistence and potentially escalate privileges on infected systems. The NCSC UK has published a detailed technical analysis and detection resources for this variant. There is no indication of known exploits in the wild beyond the reported infection. No patch or official remediation is specified.

Impact

The malware enables attackers to maintain long-term access to compromised systems, evade antivirus detection, capture sensitive clipboard data, and impersonate tokens to escalate privileges. This can lead to unauthorized data access, system manipulation, and potential lateral movement within affected networks. However, no widespread exploitation beyond the reported incident is documented.

Defensive guidance

The NCSC UK provides detection rules, indicators of compromise, and YARA signatures to identify and respond to infections. Organizations should apply these detection resources and monitor for signs of SparrowDoor activity. Standard incident response procedures for malware infections should be followed upon detection.

Summary

SparrowDoor is a malware family functioning as a persistent loader and backdoor. The analyzed variant, reported by ESET in 2021 and found on a UK network, enhances the original with additional features including clipboard logging, antivirus detection evasion, inline hooking of Windows API calls, and token impersonation to facilitate privilege escalation. It communicates with its C2 server using XOR encoding layered under HTTPS. The NCSC UK report provides technical details, indicators of compromise, and detection rules to aid defenders.

References

ncsc.gov.uk/report/mar-sparrowdoor (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 May 2026, 20:38 UTC

References

Community reviews