CrowDoor

CrowDoor is a Windows backdoor malware family and a variant of SparrowDoor. It has been used in China-nexus intrusion activity and is associated in the provided reporting with Earth Estries, Salt Typhoon, UAT-9244, and UAT-8302-linked tooling chains; Cisco Talos also describes TernDoor as a CrowDoor variant and notes Draculoader is used to deliver CrowDoor. Reported targeting includes telecommunications infrastructure in South America and broader government and technology victims in activity attributed to China-linked clusters.

Based on the supplied content, CrowDoor supports multiple execution modes depending on a command-line argument. When run with no argument or with argument 0, it sets persistence via a Windows Registry Run key or a service and restarts itself. With argument 1, it restarts by injecting into msiexec.exe. With argument 2, it invokes the main backdoor function. The newer variant differs from older variants by using msiexec.exe as the injected process and by changing command/function IDs.

Capabilities directly described in the content include establishing an initial C2 connection, collecting host information such as computer name, username, OS version, and host/IP information, providing a remote shell, deleting malware files, removing persistence and exiting, and performing file operations including open/read, open/write, drive enumeration, file search, directory creation, rename, and delete. The malware also includes explicit functionality for communication with a command-and-control server.

Persistence mechanisms explicitly mentioned include Registry Run key modification and Windows service creation. The content also states CrowDoor uses process injection into legitimate processes such as msiexec.exe via CreateRemoteThread or NtCreateThreadEx. Reported package combinations associated with CrowDoor include WinStore.exe with Sqlite3.dll, K7Sysmon.exe with K7Sysmn1.dll/K7Sysmn2.dll/K7Sysmn3.dll, HxTsk.exe with d3d8.dll, and MsMsRng.exe with sqlite3.dll and msimg32.dll; some components are described as stored encrypted.

In the supplied reporting, CrowDoor is discussed in operations involving lateral movement and collection activity by Earth Estries, including use alongside PSExec, WMIC, CAB-packaged payloads, batch scripts, Cobalt Strike, and credential theft tooling such as TrillClient. One report also states Salt Typhoon used CrowDoor for persistence through a combination of registry modifications and service creation.