12 KB Windows Backdoor Hides C2 Domain in desktop.ini Whitespace to Evade Detection

A newly documented Windows backdoor shows how little code an attacker needs to stay hidden.

The 12 KB implant was found on one corporate workstation, where it posed as Realtek audio software.

Its small footprint differs from Windows in-memory backdoor activity, but both approaches aim to reduce visibility. The malware’s most unusual feature was not encryption or a large toolkit.

Its command server address was stored as the count of trailing spaces in a fake Windows desktop.ini file, making the configuration appear almost blank during ordinary review.

Analysts at Gen Digital identified the backdoor while looking into unusual Windows Management Instrumentation, or WMI, persistence.

They found no known actor link, and initial access remained unknown because the infection predated endpoint protection.

That uncertainty matters. The sample appeared on exactly one 64-bit Windows 7 SP1 system, yet its custom design and lack of related samples point to a potentially selective intrusion.

Gen Digital said in a report shared with Cyber Security News (CSN) that the evidence supports moderate confidence in targeted deployment, without naming an actor or campaign.

The backdoor is only 12,288 bytes and lacks the usual C runtime library. Rather than place desktop.ini as one readable string in the program, it builds the filename from separated fragments and opens a file under ProgramData.

After skipping the legitimate-looking Windows header, the program counts spaces on each UTF-16 line. Each count becomes an ASCII character, rebuilding its command-and-control address.

This is simple hiding rather than strong secrecy. An analyst who checks only readable strings, encoded blobs, or file entropy could miss it, while a review of Windows malware hiding on USB devices shows that desktop.ini has also been used to make malicious content blend into normal Windows behavior.

The implant first sends an ICMP echo request containing an eight-character victim identifier. If it receives a response, it sends an HTTP POST request and receives commands to run shells or write files.

The researchers also observed an attempt to weaken file-based scanning. Before writing a delivered executable, the malware temporarily alters the first two bytes that normally identify a Windows program, then restores them after a rename.

That brief change may frustrate simple checks, though it is unlikely to defeat modern behavior-based monitoring.

WMI Trigger Leaves Hunting Clues

Persistence relied on a timed WMI event subscription. It watches the system clock for 19:50 and launches the fake Realtek-named executable.

The subscription survives a reboot, but it is not a boot trigger, so a system restarted earlier in the day remains quiet until that scheduled time.

WMI is valuable to defenders because its event filters, consumers, and bindings can expose activity that does not appear in familiar startup folders.

Similar WMI event subscription persistence has appeared in other Windows-focused operations, making repository inspection an important part of incident response.

The command server did not remain active. It was registered in July 2020, the binary was compiled on December 2, 2020, and the final DNS record dates to March 2021.

The registration lapsed that July, but the backdoor continued launching and repeatedly attempting resolution after each reboot.

For defenders, the strongest early endpoint detection is structural. Investigate suspicious configuration files that contain a normal Windows header followed only by UTF-16 spaces and line endings.

Also examine zero-byte copies, a crash artifact of an unstaged configuration. Teams should hunt for WMI filters tied to Win32_LocalTime, especially those linked to command-line consumers that start lookalike software.

Network monitoring can also flag the unusual chain of a ping followed by HTTP traffic, a behavior that differs from many encrypted HTTP C2 patterns used by remote-access malware.

Low prevalence should not reduce urgency. A narrowly deployed implant can still provide an attacker with durable access to a valuable machine.

The case reinforces why investigators should assess strange file structure and persistence behavior, not only known hashes, domains, or high-volume alerts.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	diagrtrack[.]com	Command-and-control domain; expired and no longer resolves
SHA-256	d411d93f358128c77aed0be91365b18cfb7575ecd188d22a216cbaeaa51c5e11	Backdoor executable hash
File name	RtkNGUI64.exe	Backdoor masquerading as Realtek software
SHA-256	1cc5a4be7f2e41086b53e698b487e43426e5e572bc99e5de62eada9baf83bdcd	Whitespace-encoded configuration hash
File path	C:Program FilesRealtekAudioRtkNGUI64.exe	Fake installation path
File path	C:ProgramDatadesktop.ini	Whitespace-encoded configuration location
URI path	/version/check.php	Command-and-control request path
WMI name	Realtek	WMI filter, consumer, and binding name

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world