Beware the SparroWock: The backdoor that bites, the commands that catch

    Friday, September 18, 2026 In: Threat Research Print

    Date: 09/18/2026

    Severity: High

    Summary

    Researcher details SparroWocky, a modular C++ backdoor deployed by the China-aligned FamousSparrow APT against governmental organizations across Latin America. The malware uses DLL sideloading, RC4-encrypted payloads, reflective code loading, API hashing, and anti-analysis techniques to evade detection. SparroWocky supports command execution, system reconnaissance, screen capture, file exfiltration, TCP proxying, and in-memory execution of Beacon Object Files (BOFs), with C2 communication protected by TLS and RC4. 

    Indicators of Compromise (IOC) List 

    IP Address

    38.54.57.17

    38.60.197.55

    38.60.209.106

    38.60.224.51

    38.60.224.235

    38.60.241.65

    38.60.241.127

    38.60.241.193

    77.111.101.40

    91.148.134.115

    130.94.101.82

    140.99.164.199

    149.104.87.228

    149.104.90.203

    216.238.92.2

    216.238.105.53

    216.238.110.120

    216.238.121.164

    Hash

    e0ff727c5feb3352f0bb6df91bcf2b3100203e5777c8b49b3913fcec0dbbd260

    8dfaa1f579de14bca8bb27c54a57dd87646a835969766ca9ddb81ecd9329f4e4

    bc2b8196d8c966e84c255d0d1c7908541104446e3fc51f52318aac4239bbb4c4

    03241adc63e5a204dcec26915f4df076a8121fa7827edfdc36b75e4803c2f019

    1215584b4fa69130799f6cf5efe467f380dc68b14ed2c76f63ca6b461ad57246

    222d68c03d96d230bc3829e86be8821f32960375b70388028a705a4986b8d9c6

    773635768e738bec776dfd7504164b3596e5eee344757dd1ac9a1ad19b452c86

    67d7962eaec2c785d7a6db8502c74e6ccd95445d366e370fa9fe6743d68cb42c

    90af57e976aea91030579b9761e5265251986b707550ca1b793191e2818bad92

    f61a113f6de19f2c821b89d934268621cf2410278155f173c8682e524b450f21

    f2434d7f2427ee2f3a1be4ab0922fb73ac2ceaa494c73790af71024453ce0c9c

    c57fd715bcb6d5ece60745d036496ac37e0c13f14098776c9168c0381a01409f

    dd5a6c162eff8103f6e06149faf1287feeb6dbbbb9bbca031145767fd69ce500

    24dc94e01592a29c90fd875dcdfa095ed6e1dff6db4e517b48a2f89db467aa28

    edc3ab9bc87402a5e7de43b7b2e247fdd4e134b9220d91f84934362cce34b827

    dd3dffb09fd1df4ea2ae38023e5c256855dfc9bcf9913d775f65365e2acae166

    b68c8dff2ca0944c7e6c94d184d8219c08c020eb349ff9e0a7f49bc6a6effdaf

    973a692e6240bf4ce3c14e6ca13755c7e473c7722513d7a6e811a08cf2ae0e10

    1cca1555b3ce3dbe37e17f32c91441886fb113a3d5e8da1c4ec5e523f8719fa5

    63cf1e1e7ea20a69f8a6b9d16468673b92cfe2560ad1012422ec3001a7e837cf

    80a7ff01de553cb099452cb9fac5762caf96c0c3cd9c5ad229739da7f2a2ca72

    41128b82fa12379034b3c42bdecf8e3b435089f19a5d57726a2a784c25e9d91f

    1ce7895cee6dfbc182486f7c2dff87281ba0b57a85febeb1a0196d480d032936

    abbf9c57ad3068c8aafaf443297e9448e8657b6ac16e1a8bdde5ba87254708e1

    d53346b5c8c6c76e7bc0407410a58328a1e214a4d359e558380963d29a35f71b

    5ad73e8bd5bde7808cfa39d3ada411a2e5a51278dcc7b543f2f5b5abb0c4ea27

    0e74d57f572e384ad179ad8aa094cbdc92a6abbcc77eeb658fc05743ffd94e68

    d057034675befc1b4c2ae4132c4d169201c9abfbae79181185d45ca6721e43cc

    95dff799b2fffe128fb5e8f3bae0a0ec5bc5b181567165ac50860beac9230fcf

    b87247a9ab8994e18486970c8c393593143b8775d75305b8b244c58a1294790c

    e0b6f8535e19f0a4938e3317de0c4493ecea17aa906fd0454805ba2086cbf3a8

    72677119b8bf3e2d23f22150c7b364fea9248819c36e97db015414586285591d

    3c771cf5f74a62a0c0d825f99dbe322ec261b4cc988006ada3a4b829b09ba43e

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    dstipaddress IN ("216.238.110.120","38.60.224.51","149.104.90.203","38.54.57.17","130.94.101.82","140.99.164.199","149.104.87.228","216.238.92.2","38.60.241.127","38.60.241.65","77.111.101.40","91.148.134.115","38.60.197.55","38.60.209.106","216.238.105.53","38.60.224.235","38.60.241.193","216.238.121.164") or srcipaddress IN ("216.238.110.120","38.60.224.51","149.104.90.203","38.54.57.17","130.94.101.82","140.99.164.199","149.104.87.228","216.238.92.2","38.60.241.127","38.60.241.65","77.111.101.40","91.148.134.115","38.60.197.55","38.60.209.106","216.238.105.53","38.60.224.235","38.60.241.193","216.238.121.164")

    Detection Query 2 :

    sha256hash IN ("1cca1555b3ce3dbe37e17f32c91441886fb113a3d5e8da1c4ec5e523f8719fa5","41128b82fa12379034b3c42bdecf8e3b435089f19a5d57726a2a784c25e9d91f","973a692e6240bf4ce3c14e6ca13755c7e473c7722513d7a6e811a08cf2ae0e10","edc3ab9bc87402a5e7de43b7b2e247fdd4e134b9220d91f84934362cce34b827","dd5a6c162eff8103f6e06149faf1287feeb6dbbbb9bbca031145767fd69ce500","1215584b4fa69130799f6cf5efe467f380dc68b14ed2c76f63ca6b461ad57246","0e74d57f572e384ad179ad8aa094cbdc92a6abbcc77eeb658fc05743ffd94e68","dd3dffb09fd1df4ea2ae38023e5c256855dfc9bcf9913d775f65365e2acae166","e0ff727c5feb3352f0bb6df91bcf2b3100203e5777c8b49b3913fcec0dbbd260","b68c8dff2ca0944c7e6c94d184d8219c08c020eb349ff9e0a7f49bc6a6effdaf","bc2b8196d8c966e84c255d0d1c7908541104446e3fc51f52318aac4239bbb4c4","e0b6f8535e19f0a4938e3317de0c4493ecea17aa906fd0454805ba2086cbf3a8","90af57e976aea91030579b9761e5265251986b707550ca1b793191e2818bad92","67d7962eaec2c785d7a6db8502c74e6ccd95445d366e370fa9fe6743d68cb42c","f61a113f6de19f2c821b89d934268621cf2410278155f173c8682e524b450f21","72677119b8bf3e2d23f22150c7b364fea9248819c36e97db015414586285591d","8dfaa1f579de14bca8bb27c54a57dd87646a835969766ca9ddb81ecd9329f4e4","95dff799b2fffe128fb5e8f3bae0a0ec5bc5b181567165ac50860beac9230fcf","abbf9c57ad3068c8aafaf443297e9448e8657b6ac16e1a8bdde5ba87254708e1","80a7ff01de553cb099452cb9fac5762caf96c0c3cd9c5ad229739da7f2a2ca72","d53346b5c8c6c76e7bc0407410a58328a1e214a4d359e558380963d29a35f71b","3c771cf5f74a62a0c0d825f99dbe322ec261b4cc988006ada3a4b829b09ba43e","773635768e738bec776dfd7504164b3596e5eee344757dd1ac9a1ad19b452c86","63cf1e1e7ea20a69f8a6b9d16468673b92cfe2560ad1012422ec3001a7e837cf","c57fd715bcb6d5ece60745d036496ac37e0c13f14098776c9168c0381a01409f","f2434d7f2427ee2f3a1be4ab0922fb73ac2ceaa494c73790af71024453ce0c9c","24dc94e01592a29c90fd875dcdfa095ed6e1dff6db4e517b48a2f89db467aa28","03241adc63e5a204dcec26915f4df076a8121fa7827edfdc36b75e4803c2f019","1ce7895cee6dfbc182486f7c2dff87281ba0b57a85febeb1a0196d480d032936","222d68c03d96d230bc3829e86be8821f32960375b70388028a705a4986b8d9c6","5ad73e8bd5bde7808cfa39d3ada411a2e5a51278dcc7b543f2f5b5abb0c4ea27","d057034675befc1b4c2ae4132c4d169201c9abfbae79181185d45ca6721e43cc","b87247a9ab8994e18486970c8c393593143b8775d75305b8b244c58a1294790c")

    Reference: 

    https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/    


    Tags

    MalwareAPTLatin AmericaBackdoorChinaGovernment Services and FacilitiesDLLSideLoadingExfiltrationScreen capture

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.