12 KB Windows Backdoor Hides C2 Domain in Whitespace to Evade Detection
A novel 12 KB Windows backdoor, disguised as Realtek audio software, employs trailing whitespace in a fake desktop.ini file to conceal its command and control domain, researchers discovered.
A diminutive 12 KB Windows backdoor, masquerading as legitimate Realtek audio software, has been identified employing a unique and stealthy technique to hide its command and control (C2) domain. Discovered on a single Windows 7 SP1 workstation by Gen Digital, the implant's minuscule size and novel obfuscation method aim to reduce its visibility to security analysts and automated scanning tools.
The malware's most striking feature is its method of storing the C2 server address. Instead of embedding it as a readable string or encrypted blob, the backdoor utilizes the count of trailing whitespace characters within a specially crafted, fake desktop.ini file. This configuration makes the C2 domain appear almost blank during routine examination, a simple yet effective evasion tactic. The implant was found during an investigation into unusual Windows Management Instrumentation (WMI) persistence mechanisms.
Analysts at Gen Digital noted that while the specific threat actor and initial access vector remain unknown due to the infection predating endpoint protection, the custom design and lack of related samples suggest a potentially targeted intrusion. The sample was compiled on December 2, 2020, with its C2 domain registered in July 2020 and its final DNS record dating to March 2021, before lapsing in July 2021. Despite the C2 server no longer resolving, the backdoor continued to attempt connections.
The backdoor's executable, named RtkNGUI64.exe and posing as Realtek software, is only 12,288 bytes and lacks the standard C runtime library. It constructs its filename from fragmented parts and creates a file under ProgramData. After bypassing a legitimate-looking Windows header, the program reads UTF-16 encoded lines and counts the trailing spaces on each line. Each space count is then converted into an ASCII character, effectively rebuilding the C2 address. This technique, while not employing strong encryption, effectively evades basic string analysis and entropy checks.
Upon successful execution, the implant first sends an ICMP echo request containing an eight-character victim identifier. If a response is received, it proceeds to send an HTTP POST request to the C2 server to receive commands, which can include executing shells or writing files to the system. Researchers also observed an attempt to subvert file-based scanning: before writing a delivered executable, the malware temporarily modifies the first two bytes of the file header, which typically identify a Windows program, and restores them after a rename operation. This maneuver is unlikely to defeat modern behavioral analysis but may frustrate simpler scanning methods.
Persistence for the backdoor is achieved through a timed WMI event subscription. This subscription is configured to trigger at 19:50 daily, launching the fake Realtek executable. While this persistence mechanism survives reboots, it does not initiate at system startup, meaning a machine restarted earlier in the day will remain dormant until the scheduled time. WMI event subscriptions can be a valuable hunting ground for defenders, as they can reveal activity not visible in standard startup locations.
Defenders are advised to hunt for suspicious configuration files that exhibit a normal Windows header followed only by UTF-16 spaces and line endings, as well as zero-byte copies indicating an unstaged configuration. Network monitoring can also flag the unusual sequence of an ICMP ping followed by HTTP traffic, a pattern that deviates from many encrypted HTTP C2 communications. The low prevalence of this specific implant should not diminish the urgency of detection, as even narrowly deployed malware can provide attackers with persistent access to valuable systems.