The SquawkDoor backdoor uses browser-waiting and a one-time POST to /register-ip as anti-analysis and execution confirmation, then connects to its command-and-control server over TLS with a custom SQD1 protocol. After the handshake, it collects basic host information and awaits further commands from the C2 server. #SquawkDoor #register-ip #SQD1
Keypoints
- The backdoor waits for a running browser as an additional anti-analysis measure, likely because delivery occurred through fake web pages.
- If configured with
c2_json_ping_url, it sends a one-time HTTP/HTTPS POST request containing an empty JSON object. - All investigated attacks used the
/register-ipendpoint, which appears to act as a marker of successful malware execution on the victim system. - After preparatory steps, SquawkDoor repeatedly tries to establish a secure TLS-over-TCP connection to its command-and-control server.
- The first C2 handshake sends the
magic_tagvalue from the configuration, and subsequent traffic uses a custom protocol based on theSQD1magic value. - When the server allows it, the backdoor collects basic system information such as OS version, computer name, and the first active IPv4 address.
- Collected host data is sent back to the C2 server using
control_code9, after which the server returns commands for execution.
MITRE Techniques
- [T1057] Process Discovery – The malware waits for a running browser as an anti-analysis condition, checking for an active process before proceeding. [‘the program waits for a running browser’]
- [T1102] Web Service – The backdoor sends a one-time HTTP/HTTPS POST request to a configured URL and uses web traffic for its ping/registration behavior. [‘the backdoor sends a one-time HTTP/HTTPS POST request to the specified URL’]
- [T1071.001] Application Layer Protocol: Web Protocols – It communicates with the server using HTTP/HTTPS, including a POST to /register-ip. [‘POST /register-ip HTTP/1.1’]
- [T1105] Ingress Tool Transfer – The payload was delivered through fake web pages, indicating delivery via web content. [‘the payload was delivered through fake web pages’]
- [T1573.001] Encrypted Channel: Symmetric Cryptography – The backdoor establishes a secure TLS-over-TCP connection to the C2 server. [‘attempts to establish a secure TLS-over-TCP connection’]
- [T1095] Non-Application Layer Protocol – After the handshake, it uses a custom protocol over the established connection rather than a standard application protocol. [‘Subsequent data exchange uses a custom protocol’]
- [T1082] System Information Discovery – The malware collects OS version, computer name, and the first active IPv4 address from the compromised host. [‘collects basic information about the compromised system’]
- [T1106] Native API – The backdoor performs network communication and system data collection through its own internal logic and protocol handling. [‘the backdoor sends the magic_tag value extracted from the configuration’]
Indicators of Compromise
- [URL path] C2 confirmation endpoint used in the observed attacks –
/register-ip - [Protocol / magic value] Custom protocol marker used in inbound and outbound messages –
SQD1 - [HTTP header / user agent] Outgoing registration request fingerprint –
Mozilla/5.0 (Windows NT 10.0; Win64; x64),AppleWebKit/537.36 - [Configuration parameter] URL used for one-time ping/registration behavior –
c2_json_ping_url - [Message field] C2 handshake value sent to the server after connection –
magic_tag - [Network destination] C2 server host placeholder referenced in the request structure –