ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese contractor named I‑SOON. While we initially discovered the malware samples on VirusTotal, ESET telemetry shows real activity between 2023 and 2024, with several victims in Honduras, Taiwan, Thailand, and Pakistan, targeting mostly government organizations.
The Windows variants discovered are internally marked as WIN_DRV and WIN_PLUS. Both come with a hardcoded C&C configuration and support communication over TCP, UDP, and WebSocket protocols. The core backdoor functionality for both includes support for over 30 C&C commands, covering various functionalities including system information collection, process enumeration, as well as service management and file management functions such as listing, creating, deleting, and transferring files.
In addition to the core backdoor functionality, the WIN_DRV version utilizes kernel drivers to hide the malware’s network connections, processes, files, and registry keys, and enables TCP traffic diversion allowing the malware operators to send commands to the backdoor through a random TCP port on the victim’s device without exposing the backdoor’s real listening port in the network traffic.
Based on ESET telemetry, there are limited indications that some SprySOCKS attack scenarios may involve a UEFI bootkit component, possibly exploiting CVE‑2023‑24932.
The analysis provided in this report leads us to attribute these new, Windows variants to FishMonger with high confidence.
Key points of this blogpost:
- We discovered two previously undocumented Windows variants of FishMonger’s SprySOCKS backdoor.
- ESET telemetry shows activity between 2023 and 2024, primarily targeting government organizations in Honduras, Taiwan, Thailand, and Pakistan.
- Both Windows variants support communication over TCP, UDP, and WebSocket protocols, and implement over 30 commands.
- The WIN_DRV variant creates a stealthy passive TCP backdoor, relying on a kernel driver to redirect traffic to the backdoor’s hidden TCP port whenever specially crafted data is detected inside a received TCP packet.
FishMonger profile
FishMonger – believed to be operated by a Chinese contractor named I‑SOON (see our Q4 2023–Q1 2024 APT Activity Report) – is a cyberespionage group that falls under the Winnti Group umbrella and is most likely operating out of China, from the city of Chengdu. It is also known as Earth Lusca, TAG-22, Aquatic Panda, or Red Dev 10. We published an analysis of FishMonger in early 2020 when it heavily targeted universities in Hong Kong during the civic protests that started in June 2019. The group is also known to operate watering-hole attacks, as reported by Trend Micro. FishMonger’s toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT.
Technical analysis
In this section, we provide a technical analysis of these new, Windows variants of FishMonger’s SprySOCKS backdoor.
The archive that led us to this discovery was uploaded to VirusTotal in April 2024 under the name klelam00007.zip; its contents are shown in Figure 1.
This archive contains various files, including legitimate ones used to host DLL side-loading, and three suspicious-looking, encrypted files with .dat extensions. Our subsequent analysis revealed that these encrypted files contain a new, previously undocumented Windows variant of FishMonger’s SprySOCKS backdoor, labeled WIN_DRV by its developers. Further investigation revealed an additional backdoor version, labeled WIN_PLUS, in ESET Telemetry.
Initial access
FishMonger has been known for targeting the public-facing servers of its victims, often exploiting server-based N-day vulnerabilities, to gain initial access. While we were not able to confirm the exact way FishMonger got into its victims’ systems in this campaign, the presence of a server operating system on some of the victim devices along with FishMonger’s typical modus operandi suggest that the attackers may well have got in through misconfigured or unpatched public-facing applications.
SprySOCKS for Windows
In September 2023, Trend Micro published a report about a new FishMonger Linux backdoor that its analysts named SprySOCKS. The code of the backdoor is based on an open-source Windows remote access trojan (RAT) named Trochilus, and shares several common characteristics with the RedLeaves backdoor; nevertheless, it was extended and modified enough to be considered a new backdoor. In this report, we analyze two as yet undisclosed Windows variants of v1.8 of SprySOCKS:
- One has been named WIN_DRV by its developers and uses a kernel driver for advanced stealth.
- Another, without the driver, is named WIN_PLUS.
As shown in Figure 2, the backdoor version type and number are hardcoded in the binary.
The vast majority of artifacts and functionality present in the Linux version of the SprySOCKS backdoor introduced in Trend Micro’s report can also be found in the newly discovered Windows SprySOCKS variants described in this report. These include:
- the same C&C message format,
- very similar C&C commands (plus some additional ones),
- the same encryption keys and algorithms, and
- the use of the same statically linked networking library (HP-Socket).
For both of these new SprySOCKS variants, the core backdoor functionality involving C&C communication and available commands is very similar.
Some key distinctions can be observed in how the final backdoor is loaded, the enhanced stealthiness, and the utilization of component names and paths.
Our examination begins with a breakdown of components involved in the execution chain of individual SprySOCKS variants, followed by an overview of the backdoor component, which remains largely consistent across both variants.
WIN_DRV components
Through an analysis of an archive on VirusTotal, we uncovered the WIN_DRV iteration of SprySOCKS, featuring an empty C&C configuration. Consequently, this version does not actively communicate with remote addresses but can establish a TCP server on a random port on the victim’s device, functioning as a passive backdoor. Notably, the server’s TCP port number need not be known to the attackers due to the RawWNPF driver’s capability, as detailed in the RawWNPF driver section.
As illustrated in Figure 1, the archive housing the WIN_DRV version of SprySOCKS contains several files:
- klelam00007.bat – a batch script responsible for ensuring backdoor persistence. As depicted in Figure 3, it:
○ copies all files from the current working directory to the %SystemRoot%\Fonts directory (the batch file requires deployment in the same directory as other archive files),
○ creates a scheduled task named ApphostRagistreationVerifier, set to run ApphostRagistreationVerifier.exe (a legitimate, properly signed executable renamed by the attackers to mimic the valid Microsoft-signed AppHostRegistrationVerifier.exe) with NT AUTHORITY\SYSTEM privileges on system startup. Employing the widely known DLL side-loading technique, the attackers leverage Windows’ DLL loading mechanism to load their malicious DLL (specifically tpsvcloc.dll) using a legitimate, signed application. In this instance, the attackers utilize the Malware Sideloading via MFC Satellite DLLs technique (note the presence of the loc string in the tpsvcloc.dll filename),
- ApphostRagistreationVerifier.exe – a legitimate, signed executable for ThinPrint’s AutoConnect printer creation service (SHA‑1: FFC3AA7909D4E72C360D65A1F45260DFFE5C99B7) that loads the tpsvc.dll library,
- tpsvc.dll – a legitimate, signed library that loads the tpsvcloc.dll library,
- tpsvcloc.dll – the SprySOCKS backdoor loader,
- X1B5206BDC1743DD.dat – an encrypted container containing the SprySOCKS backdoor and duplicates of the subsequent two files,
- KX1B5206BDC1743DD.dat – DriverLoader, an encrypted kernel driver responsible for loading another kernel driver from KW1B5206BDC1743FP.dat, and
- KW1B5206BDC1743FP.dat – RawWNPF, an encrypted kernel driver responsible for concealing the backdoor’s files and network activities.
Figure 4 outlines the execution chain of the SprySOCKS WIN_DRV variant.
The subsequent subsections delve into the technical analyses of the aforementioned components: SprySOCKS loader, DriverLoader driver, and RawWNPF driver.
SprySOCKS loader
The loader initiates with preliminary checks for virtual environment presence and specific security products. It scans for particular libraries (snxhk.dll, SxWrapper.dll, SxIn.dll, SXIn64.dll, and SbieDll.dll) within the loader’s process and terminates if any are detected.
Subsequently, it verifies the successful establishment of persistence by the klelam00007.bat script from Figure 3. This involves checking if the loader’s current image is loaded from the %SystemRoot%\Fonts\ directory and attempting access to %SystemRoot%\Fonts\X1B5206BDC1743DD.dat, %SystemRoot%\Fonts\tpsvc.dll, and %SystemRoot%\Fonts\tpsvcloc.dll. In case any of these files are not in their expected locations, it establishes persistence autonomously by:
- copying X1B5206BDC1743DD.dat, tpsvc.dll, tpsvcloc.dll, and ApphostRagistreationVerifier.exe from the current working directory to the %SystemRoot%\Fonts\ directory,
- registering the %SystemRoot%\Fonts\ApphostRagistreationVerifier.exe application as a debugger for vds.exe (a Virtual Disk Service that can be automatically executed on system start) by writing the application’s path into the registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vds.exe\debugger, and
- dropping the affair-build.bat file into the %SystemRoot%\Fonts\ directory and executing it via cmd.exe. This script, as shown in Figure 5, eliminates traces of this process by deleting files from the deployment directory and rerunning the malware (now from %SystemRoot%\Fonts\) by restarting the vds service.
This results in the generation of shellcode using the DllToShellCode tool. The loader then extracts the remaining encrypted payloads from the container into separate files at the following locations:
– %SystemRoot%\Fonts\KX1B5206BDC1743DD.dat
– %SystemRoot%\Fonts\KW1B5206BDC1743FP.dat
Subsequently, the loader creates a new svchost.exe process using CreateProcessAsUserW with a token acquired from spoolsv.exe. It injects the backdoor’s shellcode into the process using the process doppelgänging technique. During the injection process, the shellcode is saved in a temporary file with the prefix TH in the %TEMP% directory.
Finally, the loader decrypts and executes the DriverLoader, a hidden kernel driver stored within the previously extracted KX1B5206BDC1743DD.dat file. The decrypted contents are saved to C:\Windows\System32\drivers\fsdiskbit.sys. The loader then installs this driver as a minifilter driver by creating a new service registry key named msidiskserver. The NtLoadDriver Windows API function is invoked with the registry key as the parameter to load the driver. Subsequently, if no errors are detected, the loader deletes both the msidiskserver registry key and the fsdiskbit.sys file, completing the process. This could potentially be the driver’s perspective:
0x222008: Remove the driver’s binary (if it exists).
The RawWNPF driver has the capability to conceal processes by their process IDs, with a list of hidden processes managed through the driver’s IOCTLs 0x220358, 0x22035C, 0x220354, and 0x220350. To hide a process, the driver intercepts the NtQuerySystemInformation system call and alters its output when information about running processes is being fetched. If any of the processes match a hidden process in the driver’s list, it is excluded from the output. The method of hooking the NtQuerySystemInformation system call appears to draw inspiration from the InfinityHookPro project.
In addition to hiding processes, the driver can also conceal specific active connections based on IP, port, or a combination of both. By hooking IoCompletionRoutine for IOCTL 0x12001B within the nsiproxy.sys Windows kernel driver, attackers can hide connections from standard network administration tools like netstat.exe. The driver can also redirect TCP packets received on any open TCP port to a specified port (the SprySOCKS backdoor’s TCP server port) if the data contains specific content. This is achieved by registering packet filter objects through the Windows Filtering Platform (WFP) API functions, inspecting inbound and outbound IPv4 packets for the designated content, and diverting traffic accordingly.
Furthermore, the driver conceals the SprySOCKS backdoor’s files by acting as a minifilter driver and implementing pre- and post-operation callbacks for IRP_MJ_CREATE and IRP_MJ_DIRECTORY_CONTROL I/O requests. The driver protects a hardcoded list of filenames by preventing access to them and filtering out directory-related requests that do not pertain to enumeration.
To ensure persistence, the driver utilizes CmRegisterCallbackEx to set up a RegistryCallback routine that hides the registry key linked to the SprySOCKS loader’s persistence: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vds.exe. Consequently, the driver filters out any attempts to open or enumerate the key. If the specified conditions are satisfied, both backdoors will create a mutex named Global\{DCAA7ED8-521B-4EAB-BE21-65254CF59239} and periodically record clipboard data, active window title, and keystrokes into the file %appdata%\Microsoft\Vault\lg.dat. The data in the file will be encrypted using a single-byte XOR cipher with the key 0x44.
C&C Communication:
The backdoor supports TCP, UDP, and WebSocket protocols for communication with the C&C, acting as both client and server. The networking functionalities are based on the HP-Socket networking framework, and some cryptography functions are implemented using the Crypto++ library.
The C&C configuration is embedded in the backdoor, including up to three IP addresses and associated ports for each communication channel (TCP, UDP, WebSocket), and up to three port numbers for the backdoor to listen on. The configuration example from the WIN_PLUS version includes the C&C addresses and ports for each communication channel and the backdoor’s TCP server listening port.
Before establishing connections or starting a server, the WIN_DRV version of SprySOCKS hides connections to/from specified addresses or ports by using RawWNPF driver’s IOCTLs. It also executes netsh.exe utility commands to modify firewall rules.
If the C&C configuration is empty, the backdoor initiates a TCP server on a random port and hides it using IOCTL 0x220200. For TCP communication, a 12-byte header is sent before the actual data. Different headers are used for UDP and WebSocket channels.
Decoded C&C messages include a message ID specifying a command to be executed by the backdoor. Table 3 lists the supported message IDs and their descriptions, though not all commands have been fully analyzed. The SprySOCKS C&C commands have been rewritten as follows:
| Message ID | Description |
| 0x09 | Retrieve client system information: computer name, OS version, network adapter details, memory information, CPU details, current privileges, system language and version, current time, backdoor version (1.8), and version type (WIN_DRV or WIN_PLUS). |
| 0x0A | Initiate an interactive console. |
| 0x0B | Write to the interactive console. |
| 0x0D | End the interactive console session. |
| 0x0E | Specify an additional communication channel without activation, possibly for backup C&C purposes. |
| 0x0F | Send C&C message to a different target (tentative assessment). |
| 0x11 | List all running processes. |
| 0x12 | Enumerate modules of a specified process using its PID. |
| 0x13 | Terminate a process based on its PID. |
| 0x14 | Close all active connections. |
| 0x16 | Retrieve information about the current communication channel. |
| 0x17 | Set up additional communication channels (TCP, UDP, or WebSocket) and activate them. |
| 0x19 | Uninstall the backdoor and exit. |
| 0x1E | List all services present on the system. |
| 0x1F | Set the StartType for a specified service. |
| 0x20 | Start a service with a specified name. |
| 0x21 | Invoke the ControlService function with a specified dwControl parameter. |
| 0x22 | Remove a specified service from the service manager without stopping its execution. |
| 0x23 | Initialize a SOCKS proxy connection. |
| 0x24 | Terminate the SOCKS proxy connection (tentative assessment). |
| 0x25 | Send data through the SOCKS proxy. |
| 0x26 | Execute SOCKS proxy-related commands (tentative assessment). |
| 0x2A | Upload a specified file (tentative assessment). |
| 0x2B | File-transfer-related helper command (tentative assessment). |
| 0x2C | Download a specified file (tentative assessment). |
| 0x2D | File-transfer-related helper command (tentative assessment). |
| 0x3C | Retrieve information about free disk space. |
| 0x3D | List files in a specified directory. |
| 0x3E | Delete a specified file. |
| 0x3F | Create a specified directory. |
| 0x40 | Rename a specified file. |
| 0x41 | Execute an existing file. |
| 0x42 | Copy a specified file. |
| 0x43 | List files from the Recent Windows directories for the logged-in user: %APPDATA%\Microsoft\Windows\Recent\ %APPDATA%\Microsoft\Office\Recent\ |
Network infrastructure
One C&C address has been identified in this campaign: 207.148.78[.]36, hardcoded in the configuration of the WIN_PLUS variant of the SprySOCKS backdoor.
Ports for communication with the C&C from the configuration:
- TCP: 443
- UDP: 53
- WebSocket: 80
Another IP address, 207.148.75[.]122, from the same range 207.148.64.0/20 as the C&C, was used as a SprySOCKS delivery server by FishMonger operators in June 2023. This IP range belongs to the Vultr cloud hosting provider.
Conclusion
The discovery of a Windows variant of SprySOCKS expands FishMonger’s capabilities across platforms. The Windows port maintains core architecture from the Linux version, including C&C protocol, encryption, and command handling logic, while incorporating Windows-specific mechanisms and enhancing stealthiness with kernel drivers. Vigilance is advised regarding any potential UEFI bootkit involvement by the group.
For inquiries about our research, contact us at threatintel@eset.com.
ESET Research offers private APT intelligence reports and data feeds.To inquire about this service, please visit the ESET Threat Intelligence page. Hey there! Did you know that most of the strings in the SprySOCKS components are actually encrypted? This adds an extra layer of security to the system and helps protect sensitive information from prying eyes.
It’s interesting to note that the SprySOCKS loader removes original files from the deployment directory after copying them and setting up persistence. This indicator removal technique helps cover the tracks of malicious activity and makes it harder to detect.
Additionally, the SprySOCKS components use dynamic API resolution, which can make it more challenging to analyze and understand the behavior of the malware. This obfuscation technique adds another level of complexity to the threat.
Another intriguing aspect is that SprySOCKS components are stored in an AES-encrypted file on the victim’s drive. This encryption adds a barrier to accessing and analyzing the malicious components, making it harder for security researchers to dissect the malware.
Overall, SprySOCKS employs various techniques to evade detection and analysis, making it a sophisticated threat in the cybersecurity landscape. Stay vigilant and keep an eye out for such advanced threats to protect your systems effectively. sentence in your own words. for me, please. sentence in a different way.
Original sentence: The cat chased the mouse through the house.
Rewritten sentence: Through the house, the mouse was chased by the cat. sentence: The cat ran quickly across the room to catch the mouse.
Rewritten sentence: Swiftly, the cat dashed across the room in pursuit of the mouse. Rewrite the sentence.
