# SparrowDoor Backdoor: NCSC Malware Analysis Report on a Persistent Loader with Clipboard Logging, AV Detection, API Hooking, and Token Impersonation

> NCSC UK published a Malware Analysis Report (dated 28 February 2022, published 25 April 2022) on SparrowDoor, a persistent loader-and-backdoor discovered on a UK network in 2021 that XOR-encodes its C2 channel underneath HTTPS. Compared to the SparrowDoor variant ESET first documented in September 2021, this UK sample adds clipboard logging ('Clipshot'), an antivirus-detection routine, inline hooking of Windows API functions, and token impersonation.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-08-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2136
- **ID:** TL-2026-2136
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Salt Typhoon - G1045 (China)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SparrowDoor is a Windows backdoor deployed via DLL search-order hijacking: a legitimate SearchIndexer-family binary loads a malicious loader DLL, which decrypts and executes an XOR-obfuscated shellcode payload from disk. Persistence is dual-layered — primarily as a fake Windows service impersonating the legitimate 'Windows Search Index' component, with a backup HKCU Run-key entry if service installation fails. Post-execution, the malware enters a beacon-and-tasking loop with a variable 3-8 minute inter-beacon sleep (denying operators a fixed periodicity), re-resolves its C2 domain roughly hourly, and shortens its sleep window to 1.5-4 seconds if no tasking has been received for five hours. C2 traffic runs over HTTPS with an additional XOR encoding layer on top (distinct XOR keys for outbound and inbound traffic, and a separate key for on-disk configuration, per ESET's original analysis of the closely related variant).

The UK-network sample analyzed by NCSC extends the malware's capability set beyond what ESET originally documented: a clipboard-logging export ('Clipshot') that is invoked via rundll32.exe (spawned from svchost.exe, command line containing 'curl_easy_init') and writes captured clipboard contents to a log file stored alongside the loader DLL; a routine to detect installed antivirus/security software; inline hooking of Windows API functions (NCSC's report ties the installed hooks to socket-option control and user impersonation); and token impersonation that adjusts the SparrowDoor process's access token — enabling SeDebugPrivilege and using the token associated with explorer.exe — to impersonate the logged-on user before establishing a C2 connection, then spawns child processes under that token via CreateProcessAsUserA. The malware also carries an uninstall routine that removes its persistence mechanisms, terminates spawned child processes, and deletes its own loader/payload files from disk.

Attribution: the NCSC report itself makes no actor attribution. SparrowDoor as a malware family is documented by ESET as used exclusively by FamousSparrow, a China-aligned cyberespionage group active since at least August 2019 that has targeted hotels, government bodies, international organizations, engineering firms, and law firms across at least 12 countries, and which began exploiting the Microsoft Exchange ProxyLogon vulnerability (CVE-2021-26855) on 3 March 2021, one day after the patch was released. Because NCSC characterizes its UK-network sample as structurally and functionally 'very similar' to the ESET-documented variant, the FamousSparrow association is recorded here as an inference from the malware family, not a claim the source document itself makes.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.003 Windows Command Shell
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1134.001 Token Impersonation/Theft
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1070.009 Clear Persistence
- T1003.001 LSASS Memory
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1071.001 Web Protocols
- T1132.001 Standard Encoding

## Sources

- [Malware analysis report on SparrowDoor malware](https://www.ncsc.gov.uk/report/mar-sparrowdoor)
- [NCSC Malware Analysis Report: SparrowDoor (PDF)](https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf)
- [NCSC MAR SparrowDoor indicators (CSV)](https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor-indicators.csv)
- [NCSC MAR SparrowDoor Sigma detection rules](https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor-sigma.txt)
- [FamousSparrow: A suspicious hotel guest](https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/)
- [You will always remember this as the day you finally caught FamousSparrow](https://www.welivesecurity.com/en/eset-research/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow/)
- [FamousSparrow APT: SparrowDoor Backdoor](https://cyberflorida.org/famoussparrow-apt-sparrowdoor-backdoor/)
- [Detecting Token Impersonation - Security Spotlight](https://securityboulevard.com/2023/11/detecting-token-impersonation-security-spotlight/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2136