New Windows Backdoor Hides C2 in desktop.ini Whitespace

Key Takeaways

• A novel Windows backdoor, dubbed “KB Backdoor” by researchers, has been discovered using an extremely subtle method to hide its command-and-control (C2) server address.
• The malware stores its C2 domain within the trailing whitespace of a fake desktop.ini file, making it nearly invisible to standard inspection methods.
• The 12 KB implant was found on a single Windows 7 SP1 system, masquerading as Realtek audio software, suggesting a potentially targeted attack.
• Persistence is achieved through a scheduled Windows Management Instrumentation (WMI) event subscription.

Stealthy Windows Backdoor Hides C2 in Desktop.ini Whitespace

Cybersecurity researchers have uncovered a new Windows backdoor that employs an exceptionally minimalist approach to evade detection, embedding its command-and-control (C2) server address within the trailing whitespace of a seemingly innocuous desktop.ini file. This technique allows the malware to maintain an extremely low profile, presenting a significant challenge for traditional security tools.

The implant, a mere 12 KB in size, was identified on a single corporate workstation running 64-bit Windows 7 SP1. It disguised itself as legitimate Realtek audio software, a common tactic for blending into a system’s normal operational environment. This small footprint distinguishes it from larger, in-memory backdoors, yet both strategies share the common goal of reducing visibility to security analysts.

Unusual C2 Obfuscation Mechanism

What sets this backdoor apart is its innovative method for storing the C2 address. Instead of using encryption or a complex configuration file, the malware’s command server address is encoded as the count of trailing spaces in each line of a fabricated Windows desktop.ini file. This makes the configuration appear almost blank during typical file reviews, effectively hiding the crucial C2 information in plain sight.

Analysts at Gen Digital discovered the backdoor while investigating unusual persistence mechanisms utilizing Windows Management Instrumentation (WMI). While the researchers found no definitive links to known threat actors, the initial access vector remains unknown, as the infection predated the deployment of endpoint protection on the affected system.

The isolated nature of this discovery—appearing on only one system—coupled with its custom design and lack of related samples, points towards a potentially selective intrusion rather than a widespread campaign. Gen Digital said in a report that the evidence supports moderate confidence in a targeted deployment, though no specific actor or campaign was named.

Technical Details of the 12 KB Backdoor

The backdoor, weighing in at just 12,288 bytes, operates without the typical C runtime library. It constructs the desktop.ini filename from fragmented strings rather than storing it as a single readable entry, then opens the file under the ProgramData directory. After bypassing the legitimate Windows header in the desktop.ini file, the malware deciphers its C2 address by counting the trailing spaces on each UTF-16 encoded line. Each space count is then converted into an ASCII character, progressively rebuilding the full command-and-control domain.

This method represents a form of simple obfuscation rather than robust encryption. An analyst relying solely on readable strings, encoded blobs, or file entropy might easily overlook this subtle trick. The use of desktop.ini for malicious purposes is not entirely new; it has previously been leveraged in Windows malware hiding on USB devices to enable malicious content to blend with legitimate Windows behavior.

Upon execution, the implant first sends an ICMP echo request containing an eight-character victim identifier. If a response is received, it proceeds to send an HTTP POST request and awaits commands, which can include instructions to launch shells or write files to the system. The researchers also noted a temporary alteration of the first two bytes of an executable file prior to writing it, followed by restoration after a rename. This brief manipulation might hinder basic file-based scanning, though it is unlikely to bypass advanced behavioral monitoring solutions.

WMI Persistence and Detection Challenges

Persistence for this backdoor relies on a scheduled WMI event subscription. Specifically, it monitors the system clock for 19:50 (7:50 PM) and, at that exact time, launches the disguised Realtek executable. While this subscription survives system reboots, it is not a boot-time trigger, meaning a system restarted earlier in the day would remain dormant until the scheduled time arrives.

WMI is a powerful tool for system administration, but its event filters, consumers, and bindings can also be exploited by adversaries for persistence. For defenders, WMI offers valuable opportunities to uncover malicious activity that might otherwise bypass detection in more conventional startup locations. Similar WMI event subscription persistence has been observed in other Windows-focused operations, underscoring the importance of repository inspection in incident response.

The C2 server associated with the backdoor, diagrtrack[.]com, was registered in July 2020. The malicious binary was compiled on December 2, 2020, and the last known DNS record for the domain dates to March 2021. The domain registration subsequently lapsed in July 2021, but the backdoor continued to launch and attempt resolution after each reboot, indicating its persistence mechanism remained active even after the C2 infrastructure was decommissioned.

What You Should Do

• Inspect Suspicious desktop.ini Files: Look for desktop.ini files, particularly in the C:ProgramData

  Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

  Tags:

  AttackMalwareSecurityThreat