KB Backdoor Exploids Windows desktop.ini Whitespace
An exceptionally unusual Windows backdoor remained undetected on a single corporate computer for years. Astonishingly, it concealed its command-and-control server address in an incredibly obscure location. It utilized the specific number of consecutive spaces hidden within the standard desktop.ini system file. Security experts from Gen Digital recently discovered this malicious program. They found it while actively searching for suspicious persistence mechanisms utilizing Windows Management Instrumentation (WMI).
At a glance: Infection Scope and Disguise
Investigators located the backdoor on only one isolated computer connected to a corporate domain. This specific machine was running the antiquated 64-bit Windows 7 SP1 operating system. The malicious program possessed a remarkably small footprint, occupying a mere 12 KB of disk space. It cleverly disguised itself as legitimate Realtek audio software. Furthermore, its digital signature did not match any previously identified malware samples in global databases.
WMI Persistence and Delayed Execution
To ensure consistent execution, the attackers created a deceptive WMI subscription explicitly named “Realtek.” Every single day, precisely at 19:50, this subscription launched the RtkNGUI64.exe file. This file resided within a directory meticulously designed to mimic the authentic Realtek software folder. This sophisticated persistence mechanism survived system reboots. However, it deliberately did not execute the program immediately upon Windows startup. Consequently, the malicious activity only commenced during the evening hours.
The Ingenious Whitespace Steganography
The backdoor’s most defining characteristic was its ingenious method for securely storing its command server address. The program would silently open the C:\ProgramData\desktop.ini file. It would then intentionally bypass the initial 174 bytes, which correspond directly to the standard Windows system file header. Following this header, the file contained numerous lines consisting entirely of empty spaces.
Decoding the Server Address
The backdoor meticulously counted the exact number of spaces present on each individual line. It then ingeniously interpreted these resulting numerical values as corresponding character codes. For instance, exactly 100 spaces magically transformed into the letter “d,” 105 spaces became “i,” and 97 spaces translated to “a.” Ten consecutive lines seamlessly combined to form the string “diagrtrack.” Finally, the program simply appended the “.com” suffix, successfully deriving the complete address: diagrtrack.com.
Evading Standard Detection Methods
This specific domain name deliberately imitated DiagTrack, a legitimate Windows system service primarily associated with diagnostic telemetry. When viewed within a standard text editor, the malicious desktop.ini file appeared almost entirely empty. Furthermore, routinely searching for suspicious strings directly within the executable file proved completely ineffective. The malware even stored the filename desktop.ini itself separated into two distinct, fragmented strings.
Command Execution and C2 Communication
Following successful execution, the program computationally generated a unique, eight-digit computer identifier. It derived this ID based on the active username, the network domain, and the specific device name. Subsequently, it transmitted an initial verification request to the command server. Upon receiving a successful response, it transitioned to standard data exchange utilizing the HTTP protocol.
The integrated command set proved relatively limited but highly effective. The remote operator could execute arbitrary commands directly through the Windows command line interface. They could also write new files to the disk or dynamically modify the server polling interval, which defaulted to five seconds. The backdoor routinely encoded the execution results before transmitting them back to the operator.
File Writing Obfuscation
When actively writing new executable files, the program temporarily altered the first two bytes. Therefore, the file did not possess the standard Windows program signature during its creation and subsequent renaming phases. After finalizing the write operation, the backdoor meticulously restored the original bytes. This clever tactic could easily thwart simple file-scanning utilities precisely when the new file appeared on the disk.
Timeline and Lingering Mysteries
Attackers originally registered the diagrtrack.com domain in July 2020. They subsequently compiled the discovered backdoor on December 2 of that exact same year. The crucial configuration file materialized on the infected computer approximately three hours later. Unfortunately, administrators only installed dedicated security software 21 days later. Consequently, determining the initial, primary infection vector proved utterly impossible.
The domain registration officially expired in July 2021, and the address subsequently ceased functioning. Nevertheless, the resilient backdoor continued to persist silently within the system. Following every reboot, at precisely 19:50, the program obediently reconstructed the dead domain from the whitespace. It then futilely attempted to contact the non-existent server.
Security specialists currently have not successfully linked this intriguing discovery to any known threat group or broader campaign. The presence of only a single infected computer, the highly customized configuration format, and the absolute absence of similar samples strongly suggest a highly targeted operation. Ultimately, definitively determining the specific objective of the infection proved impossible. The operator’s original commands and any supplementary malicious modules were not preserved on the system.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
