Loading malware…
SparroWocky is a modular C++ backdoor used by the China-aligned cyberespionage group FamousSparrow. Active since at least August 2025, it appears to have replaced the group’s earlier SparrowDoor implant. FamousSparrow has used SparroWocky primarily against government organizations in Latin America, including targets in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.
The backdoor profiles compromised Windows systems by collecting host, user, domain, operating-system, process, session, and network-interface information. It supports shell-command execution, in-memory execution of PE files and Beacon Object Files, filesystem enumeration and manipulation, file upload and collection, and encrypted data exfiltration. It can capture periodic screenshots, create processes in other logged-in users’ sessions, operate as a TCP proxy, and establish reverse port-forwarding listeners.
SparroWocky establishes persistence through either a Windows service or a Run-key mechanism. It is deployed through a DLL side-loading chain that decrypts an encrypted payload and reflectively maps it into memory. Its defense-evasion features include dynamic API resolution, runtime patching, call-stack spoofing, thread start-address concealment, manipulation of Windows loader structures, encrypted command-and-control communications, and self-removal of persistence and deployment artifacts on command.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
FamousSparrow has switched to a new backdoor, SparroWocky, and has been deploying it to several countries in Latin America since at least August 2025.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
Command 0x2F spawns a new instance of SparroWocky by duplicating the token associated with the specified session ID and calling CreateProcessAsUserW.
“a loader decrypts the RC4-encoded payload contained in a .dat file and maps it directly in memory for evasion”
The backdoor uses a custom API-hashing algorithm to dynamically resolve Windows API functions.
The malware uses “disguising malicious in-memory code and DLLs as legitimate Windows components.”
The SparroWocky loader keeps the now invalid signature of the legitimate module it is impersonating.
SparroWocky uses legitimate or generic names and descriptions for its persistence service.
SparroWocky can remove its persistence mechanism from the compromised machine.
Command 0x2F spawns a new instance of SparroWocky by duplicating the token associated with the specified session ID and calling CreateProcessAsUserW.
The loader retrieves the configuration and payload via RC4 decryption of the content of a file with a custom format.
This feature prevents multiple instances of the backdoor from running concurrently by leveraging a custom IPC mechanism.
SparroWocky hooks functions to retrieve its command line arguments from stdin.
"Upon initial execution, the backdoor profiles the compromised machine by collecting... IP configurations across all network interfaces."
"Upon initial execution, the backdoor profiles the compromised machine by collecting the computer name, active username, domain..."
"Upon initial execution, the backdoor profiles the compromised machine by collecting the computer name, active username, domain, Windows version..."
Command 0x22 returns a list of the contents of the specified directory, their sizes and last-write times.
SparroWocky can collect “user” details and enumerate “active user sessions.”
C2 addresses communicated with the malware “directly over port 443 or 8080, or through HTTP and SOCKS5 proxies.”
"Its feature set includes launching arbitrary executables, establishing TCP proxies..."
Command 0x1A connects to a provided IP address and forwards traffic between the remote machine and the C&C server.
SparroWocky can use an HTTP or SOCKS5 proxy to connect to its C&C server.
SparroWocky uses TLS over TCP to communicate with its C&C server.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A modular C++ cyberespionage backdoor that profiles hosts, establishes persistence through a custom Windows service or Registry Run key, executes commands and arbitrary executables, creates TCP proxies, captures screenshots, harvests files, and exfiltrates RC4-encrypted data over TLS. It includes runtime memory/code manipulation for evasion and can load and execute Beacon Object Files in memory.
A modular C++ espionage backdoor used for command execution, in-memory Beacon Object File execution, reconnaissance, file operations, screenshot capture, session-process creation, TCP proxying, and self-removal. It is deployed through DLL side-loading, decrypts an RC4-encoded payload from a .dat file, and employs extensive anti-analysis and evasion mechanisms, including runtime patching, API resolution, call-stack and threat-origin spoofing, and CreateThread hooking. It persists through the ProcAuditManager Windows service or SnapCart Registry keys.
A modular C++ backdoor used by FamousSparrow for cyberespionage. It establishes service or Registry Run-key persistence; gathers host, user, domain, network, drive, session, display, and directory information; executes commands and arbitrary PE files in memory; loads Beacon Object Files; proxies TCP traffic; exfiltrates files; and captures periodic screenshots. It uses TLS for C2 and RC4 for command data/exfiltration, and employs DLL side-loading, reflective loading, API hashing, call-stack spoofing, thread-start-address concealment, and self-deletion for evasion.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.