# SparrowDoor backdoor variant with clipboard logging and token impersonation (NCSC MAR)

> The UK NCSC malware analysis report documents a SparrowDoor variant found on a UK network in 2021. SparrowDoor is a persistent loader and backdoor that XOR-encodes its C2 channel under HTTPS; this variant adds clipboard logging, AV detection, inline API hooking and token impersonation.

- **Published:** 2026-10-18T07:46:19Z
- **Last reviewed:** 2026-10-18T07:46:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3849
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-3849.png
- **ID:** TL-2026-3849
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

The NCSC (UK) published a malware analysis report on 25 April 2022 covering a variant of SparrowDoor, the backdoor first reported by ESET in September 2021, recovered from a UK network in 2021. The NCSC describes SparrowDoor as a persistent loader and backdoor that uses XOR encoding for the C2 channel underneath HTTPS. Compared with the ESET-documented sample, the variant adds clipboard logging, antivirus (security software) detection, inline hooking of Windows API functions and token impersonation. The loader performs reflective loading of a header-less portable executable payload, and the backdoor supports tasking commands including reading/writing files and opening a reverse shell.

Per secondary reporting of the NCSC report, the recovered files were located in C:\ProgramData\Microsoft\DRM\ and consisted of libcurl.dll (32-bit SparrowDoor loader, MD5 46077a32e433a56eb8ba64dcbf86bc60) and libhost.dll (obfuscated 32-bit SparrowDoor backdoor and shellcode, MD5 8ad3f513f48f711d573d33b7419e3ed5). The NCSC report maps the malware to ATT&CK techniques covering service and Run-key persistence, DLL hijacking (hijack execution flow), process injection, reflective code loading, masquerading, signed binary proxy execution, file deletion, deobfuscation, token manipulation, security software discovery, clipboard collection and exfiltration over C2. The NCSC publishes an IOC CSV, Sigma rules, YARA rules and STIX 2.1 data alongside the PDF; the CSV contents could not be retrieved in this research run, so network indicators specific to the UK sample are not included.

The NCSC page names no threat actor, no CVEs and no CVSS score. ESET separately attributes the SparrowDoor family exclusively to the China-aligned FamousSparrow group (active since at least August 2019), which in 2021 exploited ProxyLogon (from 3 March 2021) and other server flaws, primarily against hotels, governments, law firms, engineering firms and international organizations. ESET's 2021 sample loaded via a hijacked K7 Computing binary (Indexer.exe, K7UI.dll, MpSvc.dll), persisted as the WSearchIndex service or an HKCU Run key, and communicated over HTTPS using multi-byte XOR keys. In 2025 ESET documented two newer SparrowDoor variants (one modular, with parallel command execution). Attribution of the specific UK sample to FamousSparrow is NOT stated by the NCSC and is therefore recorded with LOW confidence. Severity HIGH is an analyst judgement.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1134 Access Token Manipulation
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1218 System Binary Proxy Execution
- T1003 OS Credential Dumping
- T1518 Software Discovery
- T1071 Application Layer Protocol
- T1573 Encrypted Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SparrowDoor Loader/Backdoor DLLs in ProgramData Microsoft DRM (libcurl.dll / libhost.dll) — Loader Execution** (`TL-2026-3849-SPL-001`)

Detects image loads or file creation of the SparrowDoor loader (libcurl.dll) and encoded backdoor/shellcode (libhost.dll) under C:\ProgramData\Microsoft\DRM\ as recovered by the NCSC malware analysis report, the K7-themed side-loaded DLL names from ESET reporting (K7UI.dll, MpSvc.dll, K7AVWScn.dll) when staged in ProgramData, and the known SparrowDoor MD5/SHA1 hashes. The Microsoft\DRM path and the MpSvc.dll name imitate legitimate Microsoft/Defender locations (masquerading), and libhost.dll/MpSvc.dll are encoded shellcode containers that the loader must decode at runtime. Behaviour-first: the path/name pairing is the primary signal; hashes add high-fidelity corroboration for TL-2026-3849.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574, T1036, T1218, T1140
- **Data sources:** sysmon, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h (EventCode=7 OR EventCode=11)
| eval obj=lower(coalesce(ImageLoaded, TargetFilename)), hashes=lower(coalesce(Hashes, ""))
| where match(obj,"programdata.microsoft.drm.(libcurl|libhost)[.]dll$") OR match(obj,"programdata.*(libcurl|libhost|k7ui|mpsvc|k7avwscn)[.]dll$") OR match(hashes,"46077a32e433a56eb8ba64dcbf86bc60|8ad3f513f48f711d573d33b7419e3ed5|bb2f5b573ac7a761015daad0b7ff03b294dc60f6|23e228d5603b4802398b2e7419187aef71ff9dd5|ebc93a546bcdf6cc1eb61d7174bcb85407bbd892")
| stats count, min(_time) as first_seen, values(EventCode) as event_codes, values(Image) as process, values(Hashes) as file_hashes by host, obj
| convert ctime(first_seen)
```

### Microsoft KQL

```kql
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FolderPath matches regex @"(?i)programdata.microsoft.drm.(libcurl|libhost)\.dll$"
    or (FolderPath has "ProgramData" and FileName in~ ("libcurl.dll", "libhost.dll", "k7ui.dll", "mpsvc.dll", "k7avwscn.dll"))
    or MD5 in~ ("46077a32e433a56eb8ba64dcbf86bc60", "8ad3f513f48f711d573d33b7419e3ed5")
    or SHA1 in~ ("BB2F5B573AC7A761015DAAD0B7FF03B294DC60F6", "23E228D5603B4802398B2E7419187AEF71FF9DD5", "EBC93A546BCDF6CC1EB61D7174BCB85407BBD892")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, SHA1, MD5, InitiatingProcessAccountName
```

### Sigma

```yaml
title: SparrowDoor Loader DLL Loaded From ProgramData Microsoft DRM Path
id: 2f6b1c0e-7a43-4d52-9b8e-3c1a5d7e9f01
status: experimental
description: Detects image loads of libcurl.dll or libhost.dll from C:\ProgramData\Microsoft\DRM\ (NCSC SparrowDoor MAR), K7-themed side-loaded DLL names staged in ProgramData (ESET), or known SparrowDoor file hashes.
references:
  - https://www.ncsc.gov.uk/report/mar-sparrowdoor
  - https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/
author: Threadlinqs Team
date: 2026-10-18
tags:
  - attack.defense-evasion
  - attack.persistence
  - attack.t1574.002
  - attack.t1036.005
  - attack.t1218
  - attack.t1140
logsource:
  category: image_load
  product: windows
detection:
  selection_drm:
    ImageLoaded|contains: '\ProgramData\Microsoft\DRM\'
    ImageLoaded|endswith:
      - '\libcurl.dll'
      - '\libhost.dll'
  selection_names:
    ImageLoaded|contains: '\ProgramData\'
    ImageLoaded|endswith:
      - '\k7ui.dll'
      - '\mpsvc.dll'
      - '\k7avwscn.dll'
  selection_hash:
    Hashes|contains:
      - 'MD5=46077A32E433A56EB8BA64DCBF86BC60'
      - 'MD5=8AD3F513F48F711D573D33B7419E3ED5'
      - 'SHA1=BB2F5B573AC7A761015DAAD0B7FF03B294DC60F6'
      - 'SHA1=23E228D5603B4802398B2E7419187AEF71FF9DD5'
      - 'SHA1=EBC93A546BCDF6CC1EB61D7174BCB85407BBD892'
  condition: 1 of selection_*
falsepositives:
  - Legitimate software that ships its own libcurl.dll into a ProgramData directory
level: high

```

**Known false positives:**

- Legitimate applications that bundle a libcurl.dll in a ProgramData subdirectory
- Security or software-deployment tools staging DLLs in ProgramData during installation

**Tuning notes:** Adjust the index name to match your Sysmon index. The generic ProgramData branch is broader than the Microsoft\DRM branch; if noisy, restrict it to unsigned DLLs or allow-list known software publishers. Sysmon must log EventCode 7 (image load) and 11 (file create) with hashes enabled (MD5 and SHA1 in the Hashes field). The NCSC IOC CSV was not retrievable; add its hashes to the hash branch when imported.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Exchange/IIS Worker Process Spawning Shells or Download Utilities — ProxyLogon-Style Initial Access (SparrowDoor Delivery) (locked: unlock with TL Creds)
- Post-Exploitation Tradecraft — Mimikatz/Token Abuse, Security Software Discovery and DRM Directory Cleanup (locked: unlock with TL Creds)
- Process Injection / Reflective Loading From ProgramData-Hosted Binaries (SparrowDoor Loader Behaviour) (locked: unlock with TL Creds)
- K7 Indexer.exe DLL Side-Loading From ProgramData (SparrowDoor Hijack Execution Flow) (locked: unlock with TL Creds)
- SparrowDoor Run Key Persistence — Indexer.exe -i or ProgramData Autostart (locked: unlock with TL Creds)
- SparrowDoor C2 Domain Resolution — [indicator] and offices-analytics.com (locked: unlock with TL Creds)
- SparrowDoor Persistence — WSearchIndex or ProgramData-Hosted Service Creation (locked: unlock with TL Creds)
- SparrowDoor C2 — Known Infrastructure and ProgramData-Hosted Beaconing over HTTPS (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- IP address: `45.131.179[.]24`
- Domain: `credits[.]offices-analytics[.]com`
- File hash: `46077a32e433a56eb8ba64dcbf86bc60`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Malware analysis report on SparrowDoor malware (NCSC)](https://www.ncsc.gov.uk/report/mar-sparrowdoor)
- [NCSC MAR SparrowDoor (PDF)](https://www.ncsc.gov.uk/sites/default/files/2026-08/NCSC-MAR-SparrowDoor.pdf)
- [ESET: You will always remember this as the day you finally caught FamousSparrow](https://www.welivesecurity.com/en/eset-research/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow/)
- [ESET: FamousSparrow - a suspicious hotel guest](https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/)
- [The Hacker News: New SparrowDoor backdoor variants found](https://thehackernews.com/2025/03/new-sparrowdoor-backdoor-variants-found.html)
- [BleepingComputer: Chinese FamousSparrow hackers deploy upgraded malware in attacks](https://www.bleepingcomputer.com/news/security/chinese-famoussparrow-hackers-deploy-upgraded-malware-in-attacks/)
- [CSO Online: Salt Typhoon may have upgraded backdoors for efficiency and evasion](https://www.csoonline.com/article/3856291/salt-typhoon-may-have-upgraded-backdoors-for-efficiency-and-evasion.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3849