ESET reports SparroWocky backdoor in Latin American government attacks

ESET researchers said China-linked FamousSparrow has used a new backdoor, SparroWocky, against government organizations in eight Latin American jurisdictions. The researchers said the operations have continued for more than a year and that the malware replaced SparrowDoor. SparroWocky can execute commands, collect system and user data, manipulate files, capture changing screen regions and proxy connections. ESET said it is deployed through DLL side-loading after a loader decrypts an RC4-encoded payload and maps it in memory.